diff --git a/review-enrichment/src/analyzers/a11y-regression.ts b/review-enrichment/src/analyzers/a11y-regression.ts
index 156a5fdf2e..0d4b2beeaf 100644
--- a/review-enrichment/src/analyzers/a11y-regression.ts
+++ b/review-enrichment/src/analyzers/a11y-regression.ts
@@ -3,9 +3,10 @@
 // positive tabindex values. Pure compute over added lines in .jsx/.tsx/.html/.vue files, no network.
 import type { A11yFinding, EnrichRequest } from "../types.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 const MARKUP_PATH_RE = /\.(?:tsx|jsx|html|vue)$/i;
 
diff --git a/review-enrichment/src/analyzers/api-break.ts b/review-enrichment/src/analyzers/api-break.ts
index 676a32d304..0d8330641b 100644
--- a/review-enrichment/src/analyzers/api-break.ts
+++ b/review-enrichment/src/analyzers/api-break.ts
@@ -8,9 +8,10 @@
 // exact whole-name loss is; a non-entrypoint file is out of scope (that is the caller-impact analyzer's job).
 // Deterministic, no network, no token. Reports file, old-file line, and symbol only — never surrounding code.
 import type { ApiBreakFinding, EnrichRequest } from "../types.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const MAX_ENTRYPOINTS = 25; // cap changed entrypoint files scanned per PR
-const MAX_FINDINGS = 25; // keep the brief bounded
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 
 // Files whose top-level exports form a package's PUBLIC surface: barrel/entry modules only. Restricting to these
 // entrypoint basenames keeps the signal conservative — a removed export in an internal module is not a downstream
diff --git a/review-enrichment/src/analyzers/caller-impact.ts b/review-enrichment/src/analyzers/caller-impact.ts
index 65630e7bb7..64f1da9400 100644
--- a/review-enrichment/src/analyzers/caller-impact.ts
+++ b/review-enrichment/src/analyzers/caller-impact.ts
@@ -29,6 +29,7 @@ import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
 import { exportedNames, isPublicEntrypoint } from "./api-break.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const GITHUB_API = "https://api.github.com";
 const GITHUB_API_VERSION = "2022-11-28";
@@ -37,7 +38,7 @@ const MAX_SYMBOLS = 6; // removed symbols searched per PR (Code Search rate budg
 const MAX_SEARCHES = 6; // bounded Code Search queries per PR
 const MAX_FILE_FETCHES = 12; // bounded candidate-caller content fetches per PR
 const MAX_CALLERS_PER_FINDING = 5; // caller paths listed per finding (keeps the brief bounded)
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const MIN_SYMBOL_LEN = 3; // skip 1-2 char names — too generic to search reliably
 const MAX_FETCH_BYTES = 1_000_000;
 const MAX_SEARCH_JSON_BYTES = 256 * 1024;
diff --git a/review-enrichment/src/analyzers/commit-hygiene.ts b/review-enrichment/src/analyzers/commit-hygiene.ts
index 264defe2a3..3aae789b25 100644
--- a/review-enrichment/src/analyzers/commit-hygiene.ts
+++ b/review-enrichment/src/analyzers/commit-hygiene.ts
@@ -16,11 +16,12 @@ import type {
 } from "../types.js";
 import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const GITHUB_API = "https://api.github.com";
 const SLUG_RE = /^[A-Za-z0-9._-]+$/;
 const MAX_COMMITS = 100;
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const SHA_PREFIX_LEN = 12;
 
 // Git's own autosquash markers (`git commit --fixup`/`--squash`, `git rebase -i --autosquash`) — a documented,
diff --git a/review-enrichment/src/analyzers/commit-lint.ts b/review-enrichment/src/analyzers/commit-lint.ts
index 39938fb71e..51c7f55cd8 100644
--- a/review-enrichment/src/analyzers/commit-lint.ts
+++ b/review-enrichment/src/analyzers/commit-lint.ts
@@ -12,11 +12,12 @@ import type {
 } from "../types.js";
 import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const GITHUB_API = "https://api.github.com";
 const SLUG_RE = /^[A-Za-z0-9._-]+$/;
 const MAX_COMMITS = 100;
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const SHA_PREFIX_LEN = 12;
 const MAX_SUBJECT_LEN = 72; // Conventional Commits / git convention soft cap for the subject line.
 
diff --git a/review-enrichment/src/analyzers/complexity.ts b/review-enrichment/src/analyzers/complexity.ts
index 6645bd68e0..9e8d248e97 100644
--- a/review-enrichment/src/analyzers/complexity.ts
+++ b/review-enrichment/src/analyzers/complexity.ts
@@ -27,10 +27,11 @@
 import type { ComplexityFinding, EnrichRequest } from "../types.js";
 import { codeOnly } from "./secret-log.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 export const DEFAULT_MAX_COMPLEXITY = 10;
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 const JS_TS_PATH_RE = /\.(?:tsx?|jsx?|mts|cts|cjs|mjs)$/i;
 
@@ -90,6 +91,34 @@ function braceDepthDelta(code: string): number {
   return depth;
 }
 
+/** Given the current pending function (or none) and one added code line, return the updated pending
+ *  state -- mutated in place and returned when tracking continues, freshly started when the line opens
+ *  a new function, or null when neither applies. Extracted out of scanPatchForComplexity's own loop
+ *  (rather than left as an inline if/else) to keep that loop's own control-flow nesting under this
+ *  analyzer's sibling deep-nesting.ts threshold. Pure; deciding whether to flush (pending.depth <= 0)
+ *  stays the caller's job so this has no dependency on flushFunction's closure. */
+function advancePendingFunction(
+  pending: PendingFunction | null,
+  body: string,
+  commented: boolean,
+  code: string,
+  newLine: number,
+): PendingFunction | null {
+  if (pending) {
+    if (!commented) pending.complexity += countDecisionPoints(code);
+    pending.depth += braceDepthDelta(code);
+    return pending;
+  }
+  const name = functionNameFromLine(body);
+  if (!name) return null;
+  return {
+    name,
+    startLine: newLine,
+    complexity: 1 + (commented ? 0 : countDecisionPoints(code)),
+    depth: braceDepthDelta(code),
+  };
+}
+
 type ScanLimits = {
   maxComplexity?: number;
   maxFindings?: number;
@@ -150,22 +179,8 @@ export function scanPatchForComplexity(
       if (body.length <= MAX_LINE_CHARS) {
         const commented = isCommentLine(body);
         const code = codeOnly(body);
-        if (pending) {
-          if (!commented) pending.complexity += countDecisionPoints(code);
-          pending.depth += braceDepthDelta(code);
-          if (pending.depth <= 0) flushFunction();
-        } else {
-          const name = functionNameFromLine(body);
-          if (name) {
-            pending = {
-              name,
-              startLine: newLine,
-              complexity: 1 + (commented ? 0 : countDecisionPoints(code)),
-              depth: braceDepthDelta(code),
-            };
-            if (pending.depth <= 0) flushFunction();
-          }
-        }
+        pending = advancePendingFunction(pending, body, commented, code, newLine);
+        if (pending && pending.depth <= 0) flushFunction();
       }
       newLine++;
     } else {
diff --git a/review-enrichment/src/analyzers/conflict-marker.ts b/review-enrichment/src/analyzers/conflict-marker.ts
index 9080330c19..d924be1d90 100644
--- a/review-enrichment/src/analyzers/conflict-marker.ts
+++ b/review-enrichment/src/analyzers/conflict-marker.ts
@@ -4,8 +4,9 @@
 // Detection is purely structural (a fixed run of seven identical characters at column 0), so there is no
 // comment/string state to track. Line-cited via hunk headers, mirroring the sibling local analyzers.
 import type { EnrichRequest, ConflictMarkerFinding } from "../types.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 
 // Git writes each conflict marker as EXACTLY seven identical characters at the start of the line. The ours/base/
 // theirs markers may carry a trailing space + label (a branch or commit); the separator is a bare seven `=`.
diff --git a/review-enrichment/src/analyzers/debug-leftover.ts b/review-enrichment/src/analyzers/debug-leftover.ts
index b8c8154ca7..427cdb227e 100644
--- a/review-enrichment/src/analyzers/debug-leftover.ts
+++ b/review-enrichment/src/analyzers/debug-leftover.ts
@@ -1,90 +1,91 @@
-// Debug-leftover analyzer (#2015). Flags debugging leftovers introduced in the diff — `debugger;` statements
-// and bare `console.*` / `print()` calls added to non-test source files. Distinct from the secret-log analyzer
-// (which only fires on sensitive-value sinks); this catches plain debug noise regardless of payload. Pure compute,
-// no network. String-literal content is stripped before matching so a `"console.log('hi')"` inside a string is
-// not flagged. Line-cited via hunk headers, mirroring the sibling local analyzers.
-import type { DebugLeftoverFinding, EnrichRequest } from "../types.js";
-import { codeOnly } from "./secret-log.js";
-import { isTestPath } from "./test-ratio.js";
-
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-
-const DEBUGGER_RE = /\bdebugger\s*;/;
-const CONSOLE_RE = /\bconsole\s*\.\s*(?:log|debug|info|warn|error|trace|dir|table)\s*\(/;
-const PRINT_RE = /(?<![\w.])print\s*\(/;
-
-/** Classify one added line for a debug leftover, or null. Pure. */
-export function detectDebugLeftover(
-  line: string,
-  path?: string,
-): DebugLeftoverFinding["kind"] | null {
-  const code = codeOnly(line);
-  if (DEBUGGER_RE.test(code)) return "debugger";
-  if (CONSOLE_RE.test(code)) return "console";
-  // Python-only: `\bprint` after a dot would false-positive on `document.print()` / `obj.print()`.
-  if (path && /\.pyi?$/i.test(path) && PRINT_RE.test(code)) return "print";
-  return null;
-}
-
-type ScanLimits = {
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Scan one file patch's added lines for debug leftovers, line-cited via hunk headers. Pure. */
-export function scanPatchForDebugLeftover(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): DebugLeftoverFinding[] {
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || isTestPath(path)) return [];
-  const findings: DebugLeftoverFinding[] = [];
-  let newLine = 0;
-  let inHunk = false;
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS) {
-        const kind = detectDebugLeftover(body, path);
-        if (kind) {
-          findings.push({ file: path, line: newLine, kind });
-          if (findings.length >= maxFindings) return findings;
-        }
-      }
-      newLine++;
-    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
-      newLine++;
-    }
-  }
-  return findings;
-}
-
-/** Analyzer entrypoint: scan every changed non-test file's added lines for debug leftovers. */
-export async function scanDebugLeftover(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<DebugLeftoverFinding[]> {
-  const findings: DebugLeftoverFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForDebugLeftover(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+// Debug-leftover analyzer (#2015). Flags debugging leftovers introduced in the diff — `debugger;` statements
+// and bare `console.*` / `print()` calls added to non-test source files. Distinct from the secret-log analyzer
+// (which only fires on sensitive-value sinks); this catches plain debug noise regardless of payload. Pure compute,
+// no network. String-literal content is stripped before matching so a `"console.log('hi')"` inside a string is
+// not flagged. Line-cited via hunk headers, mirroring the sibling local analyzers.
+import type { DebugLeftoverFinding, EnrichRequest } from "../types.js";
+import { codeOnly } from "./secret-log.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
+
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
+
+const DEBUGGER_RE = /\bdebugger\s*;/;
+const CONSOLE_RE = /\bconsole\s*\.\s*(?:log|debug|info|warn|error|trace|dir|table)\s*\(/;
+const PRINT_RE = /(?<![\w.])print\s*\(/;
+
+/** Classify one added line for a debug leftover, or null. Pure. */
+export function detectDebugLeftover(
+  line: string,
+  path?: string,
+): DebugLeftoverFinding["kind"] | null {
+  const code = codeOnly(line);
+  if (DEBUGGER_RE.test(code)) return "debugger";
+  if (CONSOLE_RE.test(code)) return "console";
+  // Python-only: `\bprint` after a dot would false-positive on `document.print()` / `obj.print()`.
+  if (path && /\.pyi?$/i.test(path) && PRINT_RE.test(code)) return "print";
+  return null;
+}
+
+type ScanLimits = {
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Scan one file patch's added lines for debug leftovers, line-cited via hunk headers. Pure. */
+export function scanPatchForDebugLeftover(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): DebugLeftoverFinding[] {
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || isTestPath(path)) return [];
+  const findings: DebugLeftoverFinding[] = [];
+  let newLine = 0;
+  let inHunk = false;
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS) {
+        const kind = detectDebugLeftover(body, path);
+        if (kind) {
+          findings.push({ file: path, line: newLine, kind });
+          if (findings.length >= maxFindings) return findings;
+        }
+      }
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return findings;
+}
+
+/** Analyzer entrypoint: scan every changed non-test file's added lines for debug leftovers. */
+export async function scanDebugLeftover(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<DebugLeftoverFinding[]> {
+  const findings: DebugLeftoverFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForDebugLeftover(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/deep-nesting.ts b/review-enrichment/src/analyzers/deep-nesting.ts
index 84c1faf4b8..10ac49df7b 100644
--- a/review-enrichment/src/analyzers/deep-nesting.ts
+++ b/review-enrichment/src/analyzers/deep-nesting.ts
@@ -5,10 +5,11 @@
 import type { DeepNestingFinding, EnrichRequest } from "../types.js";
 import { codeOnly } from "./secret-log.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 export const DEFAULT_MAX_DEPTH = 4;
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 type BraceKind = "control" | "other";
 
diff --git a/review-enrichment/src/analyzers/dependency-diff.ts b/review-enrichment/src/analyzers/dependency-diff.ts
index 32edb7023a..0281606f99 100644
--- a/review-enrichment/src/analyzers/dependency-diff.ts
+++ b/review-enrichment/src/analyzers/dependency-diff.ts
@@ -1,28 +1,29 @@
-// Dependency-diff inventory analyzer (#2020). Emits a neutral summary of direct dependency manifest
-// changes — added, removed, or version-changed packages across package.json, requirements.txt, and go.mod.
-// Distinct from the CVE-scanning dependency analyzer: no registry calls, pure compute over manifest patches.
-import type { DependencyDiffFinding, EnrichRequest } from "../types.js";
-import {
-  extractDependencyInventoryChanges,
-  type ScanLimits,
-} from "./dependency-scan.js";
-
-const MAX_FINDINGS = 25;
-const LIMITS: ScanLimits = {
-  maxManifestFiles: 20,
-  maxPatchLinesPerFile: 500,
-};
-
-/** Scan changed manifest patches for direct dependency inventory deltas. Pure. */
-export function scanDependencyDiff(req: EnrichRequest): DependencyDiffFinding[] {
-  return extractDependencyInventoryChanges(req.files ?? [], LIMITS, MAX_FINDINGS);
-}
-
-/** Analyzer entrypoint: summarize direct dependency add/remove/change deltas from manifest patches. */
-export async function scanDependencyDiffInventory(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<DependencyDiffFinding[]> {
-  if (signal?.aborted) throw new Error("analyzer_aborted");
-  return scanDependencyDiff(req);
-}
+// Dependency-diff inventory analyzer (#2020). Emits a neutral summary of direct dependency manifest
+// changes — added, removed, or version-changed packages across package.json, requirements.txt, and go.mod.
+// Distinct from the CVE-scanning dependency analyzer: no registry calls, pure compute over manifest patches.
+import type { DependencyDiffFinding, EnrichRequest } from "../types.js";
+import {
+  extractDependencyInventoryChanges,
+  type ScanLimits,
+} from "./dependency-scan.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
+
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const LIMITS: ScanLimits = {
+  maxManifestFiles: 20,
+  maxPatchLinesPerFile: 500,
+};
+
+/** Scan changed manifest patches for direct dependency inventory deltas. Pure. */
+export function scanDependencyDiff(req: EnrichRequest): DependencyDiffFinding[] {
+  return extractDependencyInventoryChanges(req.files ?? [], LIMITS, MAX_FINDINGS);
+}
+
+/** Analyzer entrypoint: summarize direct dependency add/remove/change deltas from manifest patches. */
+export async function scanDependencyDiffInventory(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<DependencyDiffFinding[]> {
+  if (signal?.aborted) throw new Error("analyzer_aborted");
+  return scanDependencyDiff(req);
+}
diff --git a/review-enrichment/src/analyzers/deprecated-dep.ts b/review-enrichment/src/analyzers/deprecated-dep.ts
index aec64eb244..57874d2e11 100644
--- a/review-enrichment/src/analyzers/deprecated-dep.ts
+++ b/review-enrichment/src/analyzers/deprecated-dep.ts
@@ -9,10 +9,11 @@
 // version, the change direction, the documented reason, and the recommended replacement — never manifest contents.
 import type { DeprecatedDependencyFinding, EnrichRequest } from "../types.js";
 import { extractDependencyChanges } from "./dependency-scan.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const MAX_MANIFEST_FILES = 20; // bound manifest files parsed per PR
 const MAX_PATCH_LINES_PER_FILE = 500; // bound patch lines parsed per manifest
-const MAX_FINDINGS = 25; // keep the brief bounded
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 
 interface DeprecationNote {
   reason: string;
diff --git a/review-enrichment/src/analyzers/duplication-scan.ts b/review-enrichment/src/analyzers/duplication-scan.ts
index 62785fb2c2..ff2d07ebbc 100644
--- a/review-enrichment/src/analyzers/duplication-scan.ts
+++ b/review-enrichment/src/analyzers/duplication-scan.ts
@@ -15,6 +15,7 @@ import type {
 } from "../types.js";
 import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const GITHUB_API = "https://api.github.com";
 const GITHUB_API_VERSION = "2022-11-28";
@@ -22,7 +23,7 @@ const GITHUB_API_VERSION = "2022-11-28";
 const MIN_RUN = 8; // a contiguous run of >= this many significant normalized lines is required to flag a duplicate
 const MAX_CANDIDATES = 40; // cap candidate files (closest-by-path first) we consider per scan
 const MAX_FETCHES = 30; // global cap on candidate blob fetches per scan
-const MAX_FINDINGS = 25; // keep the brief bounded
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const MIN_SIGNIFICANT_LEN = 12; // lines shorter than this (after trim) are treated as trivial and dropped
 const MAX_FILE_BYTES = 500_000; // skip an oversized candidate blob so one huge (likely generated) file can't eat the budget
 const MAX_TREE_JSON_BYTES = 4 * 1024 * 1024; // recursive git tree can be large; bound it like asset-weight does
diff --git a/review-enrichment/src/analyzers/error-swallow.ts b/review-enrichment/src/analyzers/error-swallow.ts
index b42cc57698..7cf1311e95 100644
--- a/review-enrichment/src/analyzers/error-swallow.ts
+++ b/review-enrichment/src/analyzers/error-swallow.ts
@@ -5,9 +5,10 @@
 // of silent failures. Pure compute over added diff lines, no network. Scoped to JS/TS/Python/Go source files.
 import type { EnrichRequest, ErrorSwallowFinding } from "../types.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 const SOURCE_EXTS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts", "py", "go"]);
 
@@ -139,6 +140,43 @@ function flushPending(pending: PendingCatch): ErrorSwallowFinding["kind"] | null
   return bodySwallowsError(body, pending.binding);
 }
 
+type PendingCatchResult = {
+  pending: PendingCatch | null;
+  finding: ErrorSwallowFinding["kind"] | null;
+  findingLine: number | null;
+};
+
+/** Continue tracking an already-open catch/error block for one more added line: buffer it and update its
+ *  brace depth, then flush (classify + clear) once the depth balances back to zero. Pure. Extracted out
+ *  of scanPatchForErrorSwallow's own loop to keep that loop's control-flow nesting under this analyzer's
+ *  sibling deep-nesting.ts threshold. */
+function advancePendingCatch(pending: PendingCatch, body: string): PendingCatchResult {
+  const updated = updatePending(pending, body);
+  if (updated.depth > 0) return { pending: updated, finding: null, findingLine: null };
+  return { pending: null, finding: flushPending(updated), findingLine: updated.startLine };
+}
+
+/** Look for a NEW error-handling block opening on one added line when nothing is currently pending:
+ *  either an immediate single-line finding, or the start of a multi-line block whose closing brace
+ *  hasn't appeared yet. Pure. Same extraction rationale as advancePendingCatch. */
+function tryStartPendingCatch(body: string, newLine: number): PendingCatchResult {
+  const kind = detectErrorSwallow(body);
+  if (kind) return { pending: null, finding: kind, findingLine: newLine };
+
+  const open = matchErrorOpen(body);
+  if (!open) return { pending: null, finding: null, findingLine: null };
+  const braceIndex = body.indexOf("{", open.index ?? 0);
+  if (braceIndex < 0) return { pending: null, finding: null, findingLine: null };
+  const depth = braceBalanceFrom(body, braceIndex);
+  if (depth <= 0) return { pending: null, finding: null, findingLine: null };
+
+  return {
+    pending: { startLine: newLine, binding: open[1] ?? null, body: body.slice(braceIndex), depth },
+    finding: null,
+    findingLine: null,
+  };
+}
+
 type ScanLimits = {
   maxFindings?: number;
   signal?: AbortSignal;
@@ -175,38 +213,11 @@ export function scanPatchForErrorSwallow(
     if (line.startsWith("+")) {
       const body = line.slice(1);
       if (body.length <= MAX_LINE_CHARS) {
-        if (pending) {
-          pending = updatePending(pending, body);
-          if (pending.depth <= 0) {
-            const kind = flushPending(pending);
-            if (kind) {
-              pushFinding(pending.startLine, kind);
-              if (findings.length >= maxFindings) return findings;
-            }
-            pending = null;
-          }
-        } else {
-          const kind = detectErrorSwallow(body);
-          if (kind) {
-            pushFinding(newLine, kind);
-            if (findings.length >= maxFindings) return findings;
-          } else {
-            const open = matchErrorOpen(body);
-            if (open) {
-              const braceIndex = body.indexOf("{", open.index ?? 0);
-              if (braceIndex >= 0) {
-                const depth = braceBalanceFrom(body, braceIndex);
-                if (depth > 0) {
-                  pending = {
-                    startLine: newLine,
-                    binding: open[1] ?? null,
-                    body: body.slice(braceIndex),
-                    depth,
-                  };
-                }
-              }
-            }
-          }
+        const result: PendingCatchResult = pending ? advancePendingCatch(pending, body) : tryStartPendingCatch(body, newLine);
+        pending = result.pending;
+        if (result.finding) {
+          pushFinding(result.findingLine ?? newLine, result.finding);
+          if (findings.length >= maxFindings) return findings;
         }
       }
       newLine++;
diff --git a/review-enrichment/src/analyzers/exhaustiveness-drift.ts b/review-enrichment/src/analyzers/exhaustiveness-drift.ts
index 7cabe56b61..30195a9f3b 100644
--- a/review-enrichment/src/analyzers/exhaustiveness-drift.ts
+++ b/review-enrichment/src/analyzers/exhaustiveness-drift.ts
@@ -1,357 +1,358 @@
-// Enum / literal-union exhaustiveness-drift analyzer (#2028). Flags when a PR adds a new enum member or string-literal
-// union variant but a switch that previously covered every old member still omits the new one. Fetches changed type
-// files and other changed consumer files at headSha (injected fetch), reverse-applies the patch to recover the
-// pre-PR member set, and only reports high-confidence misses (explicit enum/union cases, no default branch). Bounded
-// file-fetch caps; fail-safe on missing token/headSha, bad slug, or fetch errors.
-import type { EnrichRequest, ExhaustivenessFinding } from "../types.js";
-import { reconstructOldContent } from "./doc-comment-drift.js";
-import { isDiffFileHeaderLine } from "./diff-lines.js";
-import { isTestPath } from "./test-ratio.js";
-
-const GITHUB_API = "https://api.github.com";
-const SLUG_RE = /^[A-Za-z0-9._-]+$/;
-const MAX_FILES = 10;
+// Enum / literal-union exhaustiveness-drift analyzer (#2028). Flags when a PR adds a new enum member or string-literal
+// union variant but a switch that previously covered every old member still omits the new one. Fetches changed type
+// files and other changed consumer files at headSha (injected fetch), reverse-applies the patch to recover the
+// pre-PR member set, and only reports high-confidence misses (explicit enum/union cases, no default branch). Bounded
+// file-fetch caps; fail-safe on missing token/headSha, bad slug, or fetch errors.
+import type { EnrichRequest, ExhaustivenessFinding } from "../types.js";
+import { reconstructOldContent } from "./doc-comment-drift.js";
+import { isDiffFileHeaderLine } from "./diff-lines.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
+
+const GITHUB_API = "https://api.github.com";
+const SLUG_RE = /^[A-Za-z0-9._-]+$/;
+const MAX_FILES = 10;
 const MAX_FETCHES = 10;
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const MAX_FETCH_BYTES = 1_000_000;
 const MAX_SWITCH_HEADER_LINES = 25;
 const SOURCE_RE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
-const SKIP_RE = /(?:\.d\.ts$|\.min\.|(?:^|\/)(?:dist|build|vendor)\/)/;
-
-const ENUM_DECL_RE = /^\s*(?:export\s+)?(?:declare\s+)?(?:const\s+)?enum\s+([A-Za-z_$][\w$]*)\s*\{/;
-const ENUM_MEMBER_RE = /^\s*([A-Za-z_$][\w$]*)\s*(?:=\s*[^,{]+)?,?\s*(?:\/\/.*)?$/;
-const UNION_DECL_RE = /^\s*(?:export\s+)?type\s+([A-Za-z_$][\w$]*)\s*=\s*/;
-const UNION_MEMBER_RE = /^\s*\|\s*["']([^"']+)["']\s*/;
-const DEFAULT_CASE_RE = /^\s*default\s*:/;
-
-interface ScanOptions {
-  signal?: AbortSignal;
-}
-
-interface AddedMemberCandidate {
-  file: string;
-  unionName: string;
-  addedMember: string;
-  line: number;
-  kind: "enum" | "union";
-}
-
-function escapeRegExp(value: string): string {
-  return value.replace(/[$.*+?^{}()|[\]\\]/g, "\\$&");
-}
-
-function isScannablePath(path: string): boolean {
-  return SOURCE_RE.test(path) && !SKIP_RE.test(path) && !isTestPath(path);
-}
-
-function githubHeaders(token: string): Record<string, string> {
-  return {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/vnd.github.raw",
-    "X-GitHub-Api-Version": "2022-11-28",
-  };
-}
-
-async function readBoundedText(resp: Response, signal?: AbortSignal): Promise<string | null> {
-  const length = Number(resp.headers.get("content-length"));
-  if (Number.isFinite(length) && length > MAX_FETCH_BYTES) return null;
-  if (!resp.body) return null;
-  const reader = resp.body.getReader();
-  const decoder = new TextDecoder();
-  let size = 0;
-  let text = "";
-  try {
-    while (true) {
-      if (signal?.aborted) return null;
-      const { done, value } = await reader.read();
-      if (done) break;
-      size += value.byteLength;
-      if (size > MAX_FETCH_BYTES) {
-        await reader.cancel();
-        return null;
-      }
-      text += decoder.decode(value, { stream: true });
-    }
-    text += decoder.decode();
-    return text;
-  } finally {
-    reader.releaseLock();
-  }
-}
-
-async function fetchFileAtHead(
-  owner: string,
-  repo: string,
-  path: string,
-  headSha: string,
-  token: string,
-  fetchFn: typeof fetch,
-  signal: AbortSignal | undefined,
-): Promise<string | null> {
-  try {
-    const encoded = path.split("/").map(encodeURIComponent).join("/");
-    const resp = await fetchFn(
-      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encoded}?ref=${encodeURIComponent(headSha)}`,
-      { headers: githubHeaders(token), signal },
-    );
-    if (!resp.ok) return null;
-    return await readBoundedText(resp, signal);
-  } catch {
-    return null;
-  }
-}
-
-/** Walk a unified diff and collect newly added enum/union members with their declaring type name and new-file line. */
-export function parseAddedTypeMembers(
-  patch: string,
-): Array<{ unionName: string; addedMember: string; line: number; kind: "enum" | "union" }> {
-  const out: Array<{ unionName: string; addedMember: string; line: number; kind: "enum" | "union" }> = [];
-  let newLine = 0;
-  let enumName: string | null = null;
-  let unionName: string | null = null;
-  let enumDepth = 0;
-
-  for (const raw of patch.split("\n")) {
-    const header = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
-    if (header) {
-      newLine = Number(header[1]);
-      enumName = null;
-      unionName = null;
-      enumDepth = 0;
-      continue;
-    }
-
-    const isAdd = raw.startsWith("+") && !isDiffFileHeaderLine(raw);
-    const isContext = !raw.startsWith("-") && !raw.startsWith("\\") && !isDiffFileHeaderLine(raw);
-    if (!isAdd && !isContext) continue;
-
-    const line = isAdd ? raw.slice(1) : raw.startsWith(" ") ? raw.slice(1) : raw;
-    const enumDecl = ENUM_DECL_RE.exec(line);
-    if (enumDecl) {
-      enumName = enumDecl[1]!;
-      unionName = null;
-      enumDepth = (line.match(/\{/g) ?? []).length - (line.match(/\}/g) ?? []).length;
-    }
-    const unionDecl = UNION_DECL_RE.exec(line);
-    if (unionDecl) {
-      unionName = unionDecl[1]!;
-      enumName = null;
-      enumDepth = 0;
-    }
-
-    if (isAdd) {
-      if (enumName && enumDepth >= 0) {
-        const member = ENUM_MEMBER_RE.exec(line);
-        if (member && member[1] !== "const") {
-          out.push({ unionName: enumName, addedMember: member[1]!, line: newLine, kind: "enum" });
-        }
-      }
-      const unionMember = UNION_MEMBER_RE.exec(line);
-      if (unionName && unionMember) {
-        out.push({ unionName, addedMember: unionMember[1]!, line: newLine, kind: "union" });
-      }
-      newLine += 1;
-    } else {
-      if (enumName) {
-        enumDepth += (line.match(/\{/g) ?? []).length - (line.match(/\}/g) ?? []).length;
-        if (enumDepth <= 0 && line.includes("}")) enumName = null;
-      }
-      newLine += 1;
-    }
-  }
-  return out;
-}
-
-/** Extract the member names of a TS enum declaration from file content. Returns null when the enum is not found. */
-export function extractEnumMembers(content: string, enumName: string): Set<string> | null {
-  const decl = new RegExp(`(?:export\\s+)?(?:declare\\s+)?(?:const\\s+)?enum\\s+${escapeRegExp(enumName)}\\s*\\{`).exec(
-    content,
-  );
-  if (!decl) return null;
-  const start = decl.index + decl[0].length;
-  let depth = 1;
-  let i = start;
-  const members = new Set<string>();
-  let chunk = "";
-  while (i < content.length && depth > 0) {
-    const ch = content[i]!;
-    if (ch === "{") depth += 1;
-    else if (ch === "}") depth -= 1;
-    if (depth === 1) chunk += ch;
-    i += 1;
-  }
-  for (const part of chunk.split(",")) {
-    const trimmed = part.trim();
-    if (!trimmed || trimmed.startsWith("//")) continue;
-    const name = /^([A-Za-z_$][\w$]*)/.exec(trimmed);
-    if (name) members.add(name[1]!);
-  }
-  return members.size ? members : null;
-}
-
-/** Extract string-literal members from a `type Name = ...` alias. Returns null when not found or ambiguous. */
-export function extractUnionMembers(content: string, unionName: string): Set<string> | null {
-  const decl = new RegExp(
-    `(?:export\\s+)?type\\s+${escapeRegExp(unionName)}\\s*=\\s*([^;]+);`,
-    "s",
-  ).exec(content);
-  if (!decl) return null;
-  const literals = [...decl[1]!.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]!);
-  return literals.length ? new Set(literals) : null;
-}
-
-interface SwitchGap {
-  line: number;
-}
-
-/** Find a switch that covered all `oldMembers` but omits `addedMember`. Skips switches with a default branch. */
-export function findExhaustivenessGap(
-  content: string,
-  kind: "enum" | "union",
-  typeName: string,
-  oldMembers: Set<string>,
-  addedMember: string,
-): SwitchGap | null {
-  const lines = content.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    if (!/^\s*switch\s*\(/.test(lines[i]!)) continue;
-    const block = extractSwitchBlock(lines, i);
-    if (!block) continue;
-    if (block.some((l) => DEFAULT_CASE_RE.test(l))) continue;
-    const cases = kind === "enum" ? collectEnumCases(block, typeName) : collectUnionCases(block);
-    if (!oldMembers.size || ![...oldMembers].every((m) => cases.has(m))) continue;
-    if (cases.has(addedMember)) continue;
-    return { line: i + 1 };
-  }
-  return null;
-}
-
-function extractSwitchBlock(lines: string[], switchLine: number): string[] | null {
-  let depth = 0;
+const SKIP_RE = /(?:\.d\.ts$|\.min\.|(?:^|\/)(?:dist|build|vendor)\/)/;
+
+const ENUM_DECL_RE = /^\s*(?:export\s+)?(?:declare\s+)?(?:const\s+)?enum\s+([A-Za-z_$][\w$]*)\s*\{/;
+const ENUM_MEMBER_RE = /^\s*([A-Za-z_$][\w$]*)\s*(?:=\s*[^,{]+)?,?\s*(?:\/\/.*)?$/;
+const UNION_DECL_RE = /^\s*(?:export\s+)?type\s+([A-Za-z_$][\w$]*)\s*=\s*/;
+const UNION_MEMBER_RE = /^\s*\|\s*["']([^"']+)["']\s*/;
+const DEFAULT_CASE_RE = /^\s*default\s*:/;
+
+interface ScanOptions {
+  signal?: AbortSignal;
+}
+
+interface AddedMemberCandidate {
+  file: string;
+  unionName: string;
+  addedMember: string;
+  line: number;
+  kind: "enum" | "union";
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[$.*+?^{}()|[\]\\]/g, "\\$&");
+}
+
+function isScannablePath(path: string): boolean {
+  return SOURCE_RE.test(path) && !SKIP_RE.test(path) && !isTestPath(path);
+}
+
+function githubHeaders(token: string): Record<string, string> {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github.raw",
+    "X-GitHub-Api-Version": "2022-11-28",
+  };
+}
+
+async function readBoundedText(resp: Response, signal?: AbortSignal): Promise<string | null> {
+  const length = Number(resp.headers.get("content-length"));
+  if (Number.isFinite(length) && length > MAX_FETCH_BYTES) return null;
+  if (!resp.body) return null;
+  const reader = resp.body.getReader();
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = "";
+  try {
+    while (true) {
+      if (signal?.aborted) return null;
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_FETCH_BYTES) {
+        await reader.cancel();
+        return null;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+async function fetchFileAtHead(
+  owner: string,
+  repo: string,
+  path: string,
+  headSha: string,
+  token: string,
+  fetchFn: typeof fetch,
+  signal: AbortSignal | undefined,
+): Promise<string | null> {
+  try {
+    const encoded = path.split("/").map(encodeURIComponent).join("/");
+    const resp = await fetchFn(
+      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encoded}?ref=${encodeURIComponent(headSha)}`,
+      { headers: githubHeaders(token), signal },
+    );
+    if (!resp.ok) return null;
+    return await readBoundedText(resp, signal);
+  } catch {
+    return null;
+  }
+}
+
+/** Walk a unified diff and collect newly added enum/union members with their declaring type name and new-file line. */
+export function parseAddedTypeMembers(
+  patch: string,
+): Array<{ unionName: string; addedMember: string; line: number; kind: "enum" | "union" }> {
+  const out: Array<{ unionName: string; addedMember: string; line: number; kind: "enum" | "union" }> = [];
+  let newLine = 0;
+  let enumName: string | null = null;
+  let unionName: string | null = null;
+  let enumDepth = 0;
+
+  for (const raw of patch.split("\n")) {
+    const header = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+    if (header) {
+      newLine = Number(header[1]);
+      enumName = null;
+      unionName = null;
+      enumDepth = 0;
+      continue;
+    }
+
+    const isAdd = raw.startsWith("+") && !isDiffFileHeaderLine(raw);
+    const isContext = !raw.startsWith("-") && !raw.startsWith("\\") && !isDiffFileHeaderLine(raw);
+    if (!isAdd && !isContext) continue;
+
+    const line = isAdd ? raw.slice(1) : raw.startsWith(" ") ? raw.slice(1) : raw;
+    const enumDecl = ENUM_DECL_RE.exec(line);
+    if (enumDecl) {
+      enumName = enumDecl[1]!;
+      unionName = null;
+      enumDepth = (line.match(/\{/g) ?? []).length - (line.match(/\}/g) ?? []).length;
+    }
+    const unionDecl = UNION_DECL_RE.exec(line);
+    if (unionDecl) {
+      unionName = unionDecl[1]!;
+      enumName = null;
+      enumDepth = 0;
+    }
+
+    if (isAdd) {
+      if (enumName && enumDepth >= 0) {
+        const member = ENUM_MEMBER_RE.exec(line);
+        if (member && member[1] !== "const") {
+          out.push({ unionName: enumName, addedMember: member[1]!, line: newLine, kind: "enum" });
+        }
+      }
+      const unionMember = UNION_MEMBER_RE.exec(line);
+      if (unionName && unionMember) {
+        out.push({ unionName, addedMember: unionMember[1]!, line: newLine, kind: "union" });
+      }
+      newLine += 1;
+    } else {
+      if (enumName) {
+        enumDepth += (line.match(/\{/g) ?? []).length - (line.match(/\}/g) ?? []).length;
+        if (enumDepth <= 0 && line.includes("}")) enumName = null;
+      }
+      newLine += 1;
+    }
+  }
+  return out;
+}
+
+/** Extract the member names of a TS enum declaration from file content. Returns null when the enum is not found. */
+export function extractEnumMembers(content: string, enumName: string): Set<string> | null {
+  const decl = new RegExp(`(?:export\\s+)?(?:declare\\s+)?(?:const\\s+)?enum\\s+${escapeRegExp(enumName)}\\s*\\{`).exec(
+    content,
+  );
+  if (!decl) return null;
+  const start = decl.index + decl[0].length;
+  let depth = 1;
+  let i = start;
+  const members = new Set<string>();
+  let chunk = "";
+  while (i < content.length && depth > 0) {
+    const ch = content[i]!;
+    if (ch === "{") depth += 1;
+    else if (ch === "}") depth -= 1;
+    if (depth === 1) chunk += ch;
+    i += 1;
+  }
+  for (const part of chunk.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const name = /^([A-Za-z_$][\w$]*)/.exec(trimmed);
+    if (name) members.add(name[1]!);
+  }
+  return members.size ? members : null;
+}
+
+/** Extract string-literal members from a `type Name = ...` alias. Returns null when not found or ambiguous. */
+export function extractUnionMembers(content: string, unionName: string): Set<string> | null {
+  const decl = new RegExp(
+    `(?:export\\s+)?type\\s+${escapeRegExp(unionName)}\\s*=\\s*([^;]+);`,
+    "s",
+  ).exec(content);
+  if (!decl) return null;
+  const literals = [...decl[1]!.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]!);
+  return literals.length ? new Set(literals) : null;
+}
+
+interface SwitchGap {
+  line: number;
+}
+
+/** Find a switch that covered all `oldMembers` but omits `addedMember`. Skips switches with a default branch. */
+export function findExhaustivenessGap(
+  content: string,
+  kind: "enum" | "union",
+  typeName: string,
+  oldMembers: Set<string>,
+  addedMember: string,
+): SwitchGap | null {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*switch\s*\(/.test(lines[i]!)) continue;
+    const block = extractSwitchBlock(lines, i);
+    if (!block) continue;
+    if (block.some((l) => DEFAULT_CASE_RE.test(l))) continue;
+    const cases = kind === "enum" ? collectEnumCases(block, typeName) : collectUnionCases(block);
+    if (!oldMembers.size || ![...oldMembers].every((m) => cases.has(m))) continue;
+    if (cases.has(addedMember)) continue;
+    return { line: i + 1 };
+  }
+  return null;
+}
+
+function extractSwitchBlock(lines: string[], switchLine: number): string[] | null {
+  let depth = 0;
   let started = false;
   const block: string[] = [];
   for (let i = switchLine; i < lines.length; i++) {
     if (!started && i - switchLine >= MAX_SWITCH_HEADER_LINES) return null;
     const line = lines[i]!;
-    block.push(line);
-    for (const ch of line) {
-      if (ch === "{") {
-        depth += 1;
-        started = true;
-      } else if (ch === "}") depth -= 1;
-    }
-    if (started && depth === 0) return block;
-  }
-  return null;
-}
-
-function collectEnumCases(block: string[], enumName: string): Set<string> {
-  const cases = new Set<string>();
-  const qualified = new RegExp(`case\\s+${escapeRegExp(enumName)}\\.([A-Za-z_$][\\w$]*)\\s*:`);
-  const bare = /case\s+([A-Za-z_$][\w$]*)\s*:/;
-  for (const line of block) {
-    const q = qualified.exec(line);
-    if (q) cases.add(q[1]!);
-    else {
-      const b = bare.exec(line);
-      if (b) cases.add(b[1]!);
-    }
-  }
-  return cases;
-}
-
-function collectUnionCases(block: string[]): Set<string> {
-  const cases = new Set<string>();
-  const re = /case\s+["']([^"']+)["']\s*:/;
-  for (const line of block) {
-    const match = re.exec(line);
-    if (match) cases.add(match[1]!);
-  }
-  return cases;
-}
-
-/** Analyzer entrypoint. Fail-safe — returns no finding on missing token/headSha or fetch errors. */
-export async function scanExhaustivenessDrift(
-  req: EnrichRequest,
-  fetchFn: typeof fetch = fetch,
-  options: ScanOptions = {},
-): Promise<ExhaustivenessFinding[]> {
-  const { repoFullName, githubToken, headSha, files = [] } = req;
-  if (!githubToken || !headSha) return [];
-  const parts = repoFullName.split("/");
-  const [owner, repo] = parts;
-  if (parts.length !== 2 || !owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
-
-  const candidates: AddedMemberCandidate[] = [];
-  for (const file of files) {
-    if (!file.patch || !isScannablePath(file.path)) continue;
-    for (const item of parseAddedTypeMembers(file.patch)) {
-      candidates.push({ file: file.path, ...item });
-    }
-  }
-  if (!candidates.length) return [];
-
-  const scannableFiles = files.filter((f) => f.patch && isScannablePath(f.path)).slice(0, MAX_FILES);
-  const contentCache = new Map<string, string | null>();
-  let fetches = 0;
-
-  const loadFile = async (path: string, patch?: string): Promise<string | null> => {
-    if (contentCache.has(path)) return contentCache.get(path) ?? null;
-    if (fetches >= MAX_FETCHES) {
-      contentCache.set(path, null);
-      return null;
-    }
-    fetches += 1;
-    const content = await fetchFileAtHead(owner, repo, path, headSha, githubToken, fetchFn, options.signal);
-    contentCache.set(path, content);
-    return content;
-  };
-
-  const findings: ExhaustivenessFinding[] = [];
-  const seen = new Set<string>();
-
-  for (const candidate of candidates) {
-    if (options.signal?.aborted) break;
-    if (findings.length >= MAX_FINDINGS) break;
-    if (!scannableFiles.some((f) => f.path === candidate.file)) continue;
-
-    const typeFile = files.find((f) => f.path === candidate.file);
-    if (!typeFile?.patch) continue;
-    const headContent = await loadFile(candidate.file, typeFile.patch);
-    if (!headContent) continue;
-    const oldContent = reconstructOldContent(headContent, typeFile.patch);
-    if (!oldContent) continue;
-
-    const extract = candidate.kind === "enum" ? extractEnumMembers : extractUnionMembers;
-    const oldMembers = extract(oldContent, candidate.unionName);
-    const newMembers = extract(headContent, candidate.unionName);
-    if (!oldMembers || !newMembers) continue;
-    if (!newMembers.has(candidate.addedMember) || oldMembers.has(candidate.addedMember)) continue;
-
-    for (const consumer of scannableFiles) {
-      const consumerContent =
-        consumer.path === candidate.file ? headContent : await loadFile(consumer.path, consumer.patch);
-      if (!consumerContent) continue;
-      const gap = findExhaustivenessGap(
-        consumerContent,
-        candidate.kind,
-        candidate.unionName,
-        oldMembers,
-        candidate.addedMember,
-      );
-      if (!gap) continue;
-      const key = `${consumer.path}:${gap.line}:${candidate.unionName}:${candidate.addedMember}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      findings.push({
-        file: candidate.file,
-        line: candidate.line,
-        unionName: candidate.unionName,
-        addedMember: candidate.addedMember,
-        ...(consumer.path !== candidate.file ? { consumerFile: consumer.path } : {}),
-      });
-      break;
-    }
-  }
-  return findings;
-}
+    block.push(line);
+    for (const ch of line) {
+      if (ch === "{") {
+        depth += 1;
+        started = true;
+      } else if (ch === "}") depth -= 1;
+    }
+    if (started && depth === 0) return block;
+  }
+  return null;
+}
+
+function collectEnumCases(block: string[], enumName: string): Set<string> {
+  const cases = new Set<string>();
+  const qualified = new RegExp(`case\\s+${escapeRegExp(enumName)}\\.([A-Za-z_$][\\w$]*)\\s*:`);
+  const bare = /case\s+([A-Za-z_$][\w$]*)\s*:/;
+  for (const line of block) {
+    const q = qualified.exec(line);
+    if (q) cases.add(q[1]!);
+    else {
+      const b = bare.exec(line);
+      if (b) cases.add(b[1]!);
+    }
+  }
+  return cases;
+}
+
+function collectUnionCases(block: string[]): Set<string> {
+  const cases = new Set<string>();
+  const re = /case\s+["']([^"']+)["']\s*:/;
+  for (const line of block) {
+    const match = re.exec(line);
+    if (match) cases.add(match[1]!);
+  }
+  return cases;
+}
+
+/** Analyzer entrypoint. Fail-safe — returns no finding on missing token/headSha or fetch errors. */
+export async function scanExhaustivenessDrift(
+  req: EnrichRequest,
+  fetchFn: typeof fetch = fetch,
+  options: ScanOptions = {},
+): Promise<ExhaustivenessFinding[]> {
+  const { repoFullName, githubToken, headSha, files = [] } = req;
+  if (!githubToken || !headSha) return [];
+  const parts = repoFullName.split("/");
+  const [owner, repo] = parts;
+  if (parts.length !== 2 || !owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
+
+  const candidates: AddedMemberCandidate[] = [];
+  for (const file of files) {
+    if (!file.patch || !isScannablePath(file.path)) continue;
+    for (const item of parseAddedTypeMembers(file.patch)) {
+      candidates.push({ file: file.path, ...item });
+    }
+  }
+  if (!candidates.length) return [];
+
+  const scannableFiles = files.filter((f) => f.patch && isScannablePath(f.path)).slice(0, MAX_FILES);
+  const contentCache = new Map<string, string | null>();
+  let fetches = 0;
+
+  const loadFile = async (path: string, patch?: string): Promise<string | null> => {
+    if (contentCache.has(path)) return contentCache.get(path) ?? null;
+    if (fetches >= MAX_FETCHES) {
+      contentCache.set(path, null);
+      return null;
+    }
+    fetches += 1;
+    const content = await fetchFileAtHead(owner, repo, path, headSha, githubToken, fetchFn, options.signal);
+    contentCache.set(path, content);
+    return content;
+  };
+
+  const findings: ExhaustivenessFinding[] = [];
+  const seen = new Set<string>();
+
+  for (const candidate of candidates) {
+    if (options.signal?.aborted) break;
+    if (findings.length >= MAX_FINDINGS) break;
+    if (!scannableFiles.some((f) => f.path === candidate.file)) continue;
+
+    const typeFile = files.find((f) => f.path === candidate.file);
+    if (!typeFile?.patch) continue;
+    const headContent = await loadFile(candidate.file, typeFile.patch);
+    if (!headContent) continue;
+    const oldContent = reconstructOldContent(headContent, typeFile.patch);
+    if (!oldContent) continue;
+
+    const extract = candidate.kind === "enum" ? extractEnumMembers : extractUnionMembers;
+    const oldMembers = extract(oldContent, candidate.unionName);
+    const newMembers = extract(headContent, candidate.unionName);
+    if (!oldMembers || !newMembers) continue;
+    if (!newMembers.has(candidate.addedMember) || oldMembers.has(candidate.addedMember)) continue;
+
+    for (const consumer of scannableFiles) {
+      const consumerContent =
+        consumer.path === candidate.file ? headContent : await loadFile(consumer.path, consumer.patch);
+      if (!consumerContent) continue;
+      const gap = findExhaustivenessGap(
+        consumerContent,
+        candidate.kind,
+        candidate.unionName,
+        oldMembers,
+        candidate.addedMember,
+      );
+      if (!gap) continue;
+      const key = `${consumer.path}:${gap.line}:${candidate.unionName}:${candidate.addedMember}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        file: candidate.file,
+        line: candidate.line,
+        unionName: candidate.unionName,
+        addedMember: candidate.addedMember,
+        ...(consumer.path !== candidate.file ? { consumerFile: consumer.path } : {}),
+      });
+      break;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/flaky-test.ts b/review-enrichment/src/analyzers/flaky-test.ts
index 4f83f3e4c2..d1b9abf7a7 100644
--- a/review-enrichment/src/analyzers/flaky-test.ts
+++ b/review-enrichment/src/analyzers/flaky-test.ts
@@ -1,214 +1,215 @@
-// Flaky-test history annotator (#2033). For test files a PR touches, probes bounded recent default-branch commit +
-// check-run history and counts CI test-check failures whose output references that file — a signal the change
-// lands on historically flaky coverage. Structured GitHub API fields only in findings (counts + window, never
-// logs). Bounded file/commit/check-run fanout; marks partial status when the probe budget is exhausted. Fail-safe
-// without a token, bad slug, or fetch errors.
-import type {
-  AnalyzerDiagnostics,
-  EnrichRequest,
-  FlakyTestFinding,
-} from "../types.js";
-import type { AnalysisContext } from "../analysis-context.js";
-import { boundedFetchJson } from "../external-fetch.js";
-import { isTestPath } from "./test-ratio.js";
-
-const GITHUB_API = "https://api.github.com";
-const SLUG_RE = /^[A-Za-z0-9._-]+$/;
-const WINDOW_DAYS = 30;
-const WINDOW_LABEL = "30d";
-const MAX_FILES_PROBED = 6;
-const MAX_COMMITS_PER_FILE = 5;
-const MAX_CHECK_RUN_FETCHES = 12;
-const MAX_FINDINGS = 25;
-const MIN_FAILURE_EVENTS = 2;
-const COMMITS_PER_PAGE = 20;
-
-const FAILURE_CONCLUSIONS = new Set(["failure", "timed_out", "cancelled", "action_required"]);
-const TEST_CHECK_RE =
-  /test|jest|vitest|pytest|mocha|rspec|unittest|validate-code|go test|cargo test|npm test|yarn test|pnpm test/i;
-
-interface ScanOptions {
-  signal?: AbortSignal;
-  analysis?: Pick<AnalysisContext, "fetchJson">;
-  diagnostics?: AnalyzerDiagnostics;
-}
-
-interface CommitItem {
-  sha?: string;
-}
-
-interface CheckRunItem {
-  name?: string;
-  status?: string;
-  conclusion?: string | null;
-  output?: { title?: string | null; summary?: string | null; text?: string | null };
-}
-
-interface CheckRunsResponse {
-  check_runs?: CheckRunItem[];
-}
-
-interface RepoInfo {
-  default_branch?: string;
-}
-
-function githubHeaders(token: string): Record<string, string> {
-  return {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/vnd.github+json",
-    "X-GitHub-Api-Version": "2022-11-28",
-  };
-}
-
-function markPartial(diagnostics: AnalyzerDiagnostics | undefined, reason: string): void {
-  if (!diagnostics) return;
-  diagnostics.partialStatus = "partial";
-  diagnostics.partialReason ??= reason;
-}
-
-/** True when a check-run name looks like a test/CI test job rather than lint/build-only. Pure. */
-export function isTestCheckName(name: string): boolean {
-  return TEST_CHECK_RE.test(name);
-}
-
-/** True when structured check-run output references the test file path or its basename. Pure. */
-export function referencesTestFile(
-  output: { title?: string | null; summary?: string | null; text?: string | null } | undefined,
-  filePath: string,
-): boolean {
-  if (!output) return false;
-  const haystack = `${output.title ?? ""}\n${output.summary ?? ""}\n${output.text ?? ""}`;
-  if (haystack.includes(filePath)) return true;
-  const base = filePath.split("/").pop() ?? filePath;
-  if (base && haystack.includes(base)) return true;
-  const stem = base.replace(/\.[^.]+$/, "");
-  return Boolean(stem && stem.length >= 3 && haystack.includes(stem));
-}
-
-/** Count completed test-check failures on one commit's runs that reference `filePath`. Pure. */
-export function countCommitTestFailures(runs: CheckRunItem[], filePath: string): number {
-  let failures = 0;
-  for (const run of runs) {
-    if (run.status !== "completed" || !run.name || !run.conclusion) continue;
-    if (!FAILURE_CONCLUSIONS.has(run.conclusion)) continue;
-    if (!isTestCheckName(run.name)) continue;
-    if (!referencesTestFile(run.output, filePath)) continue;
-    failures += 1;
-  }
-  return failures;
-}
-
-async function fetchJson<T>(
-  url: string,
-  token: string,
-  fetchFn: typeof fetch,
-  options: ScanOptions,
-  endpointCategory: string,
-  phase: string,
-  subcall: string,
-  maxCallsPerCategory?: number,
-): Promise<T | null> {
-  const fetchOptions = {
-    endpointCategory,
-    headers: githubHeaders(token),
-    signal: options.signal,
-    fetchImpl: fetchFn,
-    diagnostics: options.diagnostics,
-    phase,
-    subcall,
-    maxBytes: 512 * 1024,
-    maxCallsPerCategory,
-  };
-  const response = options.analysis
-    ? await options.analysis.fetchJson<T>(url, fetchOptions)
-    : await boundedFetchJson<T>(url, fetchOptions);
-  return response.ok ? response.data : null;
-}
-
-/** Analyzer entrypoint. Fail-safe — returns no finding without a token or on fetch errors. */
-export async function scanFlakyTest(
-  req: EnrichRequest,
-  fetchFn: typeof fetch = fetch,
-  options: ScanOptions = {},
-): Promise<FlakyTestFinding[]> {
-  const { repoFullName, githubToken, files = [] } = req;
-  if (!githubToken) return [];
-  const parts = repoFullName.split("/");
-  if (parts.length !== 2) return [];
-  const [owner, repo] = parts;
-  if (!owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
-
-  const testPaths = [...new Set(files.filter((f) => isTestPath(f.path)).map((f) => f.path))].slice(
-    0,
-    MAX_FILES_PROBED,
-  );
-  if (!testPaths.length) return [];
-
-  const repoInfo = await fetchJson<RepoInfo>(
-    `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
-    githubToken,
-    fetchFn,
-    options,
-    "github-repo-info",
-    "flaky-test",
-    "default-branch",
-    1,
-  );
-  const defaultBranch = repoInfo?.default_branch;
-  if (!defaultBranch) return [];
-
-  const since = new Date(Date.now() - WINDOW_DAYS * 86_400_000).toISOString();
-  const findings: FlakyTestFinding[] = [];
-  let checkRunFetches = 0;
-  let capped = false;
-
-  for (const path of testPaths) {
-    if (options.signal?.aborted) break;
-    if (findings.length >= MAX_FINDINGS) break;
-
-    const commits = await fetchJson<CommitItem[]>(
-      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits` +
-        `?sha=${encodeURIComponent(defaultBranch)}&path=${encodeURIComponent(path)}` +
-        `&since=${encodeURIComponent(since)}&per_page=${COMMITS_PER_PAGE}`,
-      githubToken,
-      fetchFn,
-      options,
-      "github-commits",
-      "flaky-test",
-      "file-commits",
-      MAX_FILES_PROBED,
-    );
-    if (!commits?.length) continue;
-
-    let failureEvents = 0;
-    for (const commit of commits.slice(0, MAX_COMMITS_PER_FILE)) {
-      if (!commit.sha) continue;
-      if (checkRunFetches >= MAX_CHECK_RUN_FETCHES) {
-        capped = true;
-        break;
-      }
-      checkRunFetches += 1;
-      const checkData = await fetchJson<CheckRunsResponse>(
-        `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits/` +
-          `${encodeURIComponent(commit.sha)}/check-runs?per_page=100&filter=all`,
-        githubToken,
-        fetchFn,
-        options,
-        "github-check-runs",
-        "flaky-test",
-        "commit-check-runs",
-        MAX_CHECK_RUN_FETCHES,
-      );
-      const runs = checkData?.check_runs ?? [];
-      if (countCommitTestFailures(runs, path) > 0) failureEvents += 1;
-    }
-
-    if (failureEvents >= MIN_FAILURE_EVENTS) {
-      findings.push({ file: path, recentFailures: failureEvents, window: WINDOW_LABEL });
-    }
-    if (capped) break;
-  }
-
-  if (capped) markPartial(options.diagnostics, "flaky_test_probe_cap");
-  return findings;
-}
+// Flaky-test history annotator (#2033). For test files a PR touches, probes bounded recent default-branch commit +
+// check-run history and counts CI test-check failures whose output references that file — a signal the change
+// lands on historically flaky coverage. Structured GitHub API fields only in findings (counts + window, never
+// logs). Bounded file/commit/check-run fanout; marks partial status when the probe budget is exhausted. Fail-safe
+// without a token, bad slug, or fetch errors.
+import type {
+  AnalyzerDiagnostics,
+  EnrichRequest,
+  FlakyTestFinding,
+} from "../types.js";
+import type { AnalysisContext } from "../analysis-context.js";
+import { boundedFetchJson } from "../external-fetch.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
+
+const GITHUB_API = "https://api.github.com";
+const SLUG_RE = /^[A-Za-z0-9._-]+$/;
+const WINDOW_DAYS = 30;
+const WINDOW_LABEL = "30d";
+const MAX_FILES_PROBED = 6;
+const MAX_COMMITS_PER_FILE = 5;
+const MAX_CHECK_RUN_FETCHES = 12;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MIN_FAILURE_EVENTS = 2;
+const COMMITS_PER_PAGE = 20;
+
+const FAILURE_CONCLUSIONS = new Set(["failure", "timed_out", "cancelled", "action_required"]);
+const TEST_CHECK_RE =
+  /test|jest|vitest|pytest|mocha|rspec|unittest|validate-code|go test|cargo test|npm test|yarn test|pnpm test/i;
+
+interface ScanOptions {
+  signal?: AbortSignal;
+  analysis?: Pick<AnalysisContext, "fetchJson">;
+  diagnostics?: AnalyzerDiagnostics;
+}
+
+interface CommitItem {
+  sha?: string;
+}
+
+interface CheckRunItem {
+  name?: string;
+  status?: string;
+  conclusion?: string | null;
+  output?: { title?: string | null; summary?: string | null; text?: string | null };
+}
+
+interface CheckRunsResponse {
+  check_runs?: CheckRunItem[];
+}
+
+interface RepoInfo {
+  default_branch?: string;
+}
+
+function githubHeaders(token: string): Record<string, string> {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+  };
+}
+
+function markPartial(diagnostics: AnalyzerDiagnostics | undefined, reason: string): void {
+  if (!diagnostics) return;
+  diagnostics.partialStatus = "partial";
+  diagnostics.partialReason ??= reason;
+}
+
+/** True when a check-run name looks like a test/CI test job rather than lint/build-only. Pure. */
+export function isTestCheckName(name: string): boolean {
+  return TEST_CHECK_RE.test(name);
+}
+
+/** True when structured check-run output references the test file path or its basename. Pure. */
+export function referencesTestFile(
+  output: { title?: string | null; summary?: string | null; text?: string | null } | undefined,
+  filePath: string,
+): boolean {
+  if (!output) return false;
+  const haystack = `${output.title ?? ""}\n${output.summary ?? ""}\n${output.text ?? ""}`;
+  if (haystack.includes(filePath)) return true;
+  const base = filePath.split("/").pop() ?? filePath;
+  if (base && haystack.includes(base)) return true;
+  const stem = base.replace(/\.[^.]+$/, "");
+  return Boolean(stem && stem.length >= 3 && haystack.includes(stem));
+}
+
+/** Count completed test-check failures on one commit's runs that reference `filePath`. Pure. */
+export function countCommitTestFailures(runs: CheckRunItem[], filePath: string): number {
+  let failures = 0;
+  for (const run of runs) {
+    if (run.status !== "completed" || !run.name || !run.conclusion) continue;
+    if (!FAILURE_CONCLUSIONS.has(run.conclusion)) continue;
+    if (!isTestCheckName(run.name)) continue;
+    if (!referencesTestFile(run.output, filePath)) continue;
+    failures += 1;
+  }
+  return failures;
+}
+
+async function fetchJson<T>(
+  url: string,
+  token: string,
+  fetchFn: typeof fetch,
+  options: ScanOptions,
+  endpointCategory: string,
+  phase: string,
+  subcall: string,
+  maxCallsPerCategory?: number,
+): Promise<T | null> {
+  const fetchOptions = {
+    endpointCategory,
+    headers: githubHeaders(token),
+    signal: options.signal,
+    fetchImpl: fetchFn,
+    diagnostics: options.diagnostics,
+    phase,
+    subcall,
+    maxBytes: 512 * 1024,
+    maxCallsPerCategory,
+  };
+  const response = options.analysis
+    ? await options.analysis.fetchJson<T>(url, fetchOptions)
+    : await boundedFetchJson<T>(url, fetchOptions);
+  return response.ok ? response.data : null;
+}
+
+/** Analyzer entrypoint. Fail-safe — returns no finding without a token or on fetch errors. */
+export async function scanFlakyTest(
+  req: EnrichRequest,
+  fetchFn: typeof fetch = fetch,
+  options: ScanOptions = {},
+): Promise<FlakyTestFinding[]> {
+  const { repoFullName, githubToken, files = [] } = req;
+  if (!githubToken) return [];
+  const parts = repoFullName.split("/");
+  if (parts.length !== 2) return [];
+  const [owner, repo] = parts;
+  if (!owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
+
+  const testPaths = [...new Set(files.filter((f) => isTestPath(f.path)).map((f) => f.path))].slice(
+    0,
+    MAX_FILES_PROBED,
+  );
+  if (!testPaths.length) return [];
+
+  const repoInfo = await fetchJson<RepoInfo>(
+    `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
+    githubToken,
+    fetchFn,
+    options,
+    "github-repo-info",
+    "flaky-test",
+    "default-branch",
+    1,
+  );
+  const defaultBranch = repoInfo?.default_branch;
+  if (!defaultBranch) return [];
+
+  const since = new Date(Date.now() - WINDOW_DAYS * 86_400_000).toISOString();
+  const findings: FlakyTestFinding[] = [];
+  let checkRunFetches = 0;
+  let capped = false;
+
+  for (const path of testPaths) {
+    if (options.signal?.aborted) break;
+    if (findings.length >= MAX_FINDINGS) break;
+
+    const commits = await fetchJson<CommitItem[]>(
+      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits` +
+        `?sha=${encodeURIComponent(defaultBranch)}&path=${encodeURIComponent(path)}` +
+        `&since=${encodeURIComponent(since)}&per_page=${COMMITS_PER_PAGE}`,
+      githubToken,
+      fetchFn,
+      options,
+      "github-commits",
+      "flaky-test",
+      "file-commits",
+      MAX_FILES_PROBED,
+    );
+    if (!commits?.length) continue;
+
+    let failureEvents = 0;
+    for (const commit of commits.slice(0, MAX_COMMITS_PER_FILE)) {
+      if (!commit.sha) continue;
+      if (checkRunFetches >= MAX_CHECK_RUN_FETCHES) {
+        capped = true;
+        break;
+      }
+      checkRunFetches += 1;
+      const checkData = await fetchJson<CheckRunsResponse>(
+        `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits/` +
+          `${encodeURIComponent(commit.sha)}/check-runs?per_page=100&filter=all`,
+        githubToken,
+        fetchFn,
+        options,
+        "github-check-runs",
+        "flaky-test",
+        "commit-check-runs",
+        MAX_CHECK_RUN_FETCHES,
+      );
+      const runs = checkData?.check_runs ?? [];
+      if (countCommitTestFailures(runs, path) > 0) failureEvents += 1;
+    }
+
+    if (failureEvents >= MIN_FAILURE_EVENTS) {
+      findings.push({ file: path, recentFailures: failureEvents, window: WINDOW_LABEL });
+    }
+    if (capped) break;
+  }
+
+  if (capped) markPartial(options.diagnostics, "flaky_test_probe_cap");
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/floating-promise.ts b/review-enrichment/src/analyzers/floating-promise.ts
index 764302ca5c..f8e2886bc6 100644
--- a/review-enrichment/src/analyzers/floating-promise.ts
+++ b/review-enrichment/src/analyzers/floating-promise.ts
@@ -1,134 +1,135 @@
-// Floating-promise analyzer (#2023). Flags newly-added async-shaped calls whose returned promise is neither
-// awaited, returned, voided, nor .catch()/.then()-chained on the same statement — a common silent-failure bug.
-// Precision-first structural heuristic over added TS/JS lines only: promise-shaped callees (`fetch`, `Promise.*`,
-// or an `*Async` suffix) on bare expression statements. Pure compute, no network.
-import type { EnrichRequest, FloatingPromiseFinding } from "../types.js";
-import { codeOnly } from "./secret-log.js";
-import { isTestPath } from "./test-ratio.js";
-
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-const MAX_CALL_CHARS = 40;
-
-const JS_TS_PATH_RE = /\.(?:tsx?|jsx?|mts|cts|cjs|mjs)$/i;
-
-const HANDLED_PREFIX =
-  /^\s*(?:await\b|return\b|void\b|throw\b|if\b|for\b|while\b|switch\b|case\b|else\b|try\b|catch\b|finally\b|import\b|export\b|const\b|let\b|var\b|type\b|interface\b|class\b|function\b|async\s+function\b)/;
-
-const PROMISE_CHAIN_RE = /\.(?:then|catch)\s*\(/;
-
-function isJsTsPath(path: string): boolean {
-  return JS_TS_PATH_RE.test(path) && !isTestPath(path);
-}
-
-function isCommentLine(line: string): boolean {
-  const trimmed = line.trimStart();
-  return /^(?:\/\/|\/\*|\*)/.test(trimmed);
-}
-
-function truncateCall(call: string): string {
-  if (call.length <= MAX_CALL_CHARS) return call;
-  return `${call.slice(0, MAX_CALL_CHARS - 3)}...`;
-}
-
-function isPromiseShapedCallee(callee: string): boolean {
-  if (callee === "fetch" || callee.endsWith(".fetch")) return true;
-  if (callee === "Promise" || /^Promise\.(?:all(?:Settled)?|race|any|resolve|reject)$/.test(callee)) {
-    return true;
-  }
-  const last = callee.split(".").pop() ?? callee;
-  return /Async$/.test(last);
-}
-
-function extractLeadingCallCallee(line: string): string | null {
-  const code = codeOnly(line).trim();
-  const semiIdx = code.indexOf(";");
-  if (semiIdx >= 0 && semiIdx < code.length - 1) {
-    const after = code.slice(semiIdx + 1).trim();
-    if (after.length > 0) return null;
-  }
-
-  const newPromise = /^new\s+Promise\s*\(/.exec(code);
-  if (newPromise) return "Promise";
-
-  const match = /^((?:[a-zA-Z_$][\w$]*(?:\.[a-zA-Z_$][\w$]*)*))\s*\(/.exec(code);
-  return match?.[1] ?? null;
-}
-
-/** Classify one added line for a floating promise call, or null. Pure. */
-export function detectFloatingPromise(line: string): string | null {
-  if (isCommentLine(line) || HANDLED_PREFIX.test(line)) {
-    return null;
-  }
-
-  const code = codeOnly(line).replace(/=>/g, "  ");
-  if (PROMISE_CHAIN_RE.test(code)) return null;
-  if (/(?<![=<>!])=(?!=)/.test(code)) return null;
-
-  const callee = extractLeadingCallCallee(line);
-  if (!callee || !isPromiseShapedCallee(callee)) return null;
-
-  return truncateCall(callee);
-}
-
-type ScanLimits = {
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Scan one file patch's added lines for floating promises, line-cited via hunk headers. Pure. */
-export function scanPatchForFloatingPromise(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): FloatingPromiseFinding[] {
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || !isJsTsPath(path)) return [];
-  const findings: FloatingPromiseFinding[] = [];
-  let newLine = 0;
-  let inHunk = false;
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS) {
-        const call = detectFloatingPromise(body);
-        if (call) {
-          findings.push({ file: path, line: newLine, call });
-          if (findings.length >= maxFindings) return findings;
-        }
-      }
-      newLine++;
-    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
-      newLine++;
-    }
-  }
-  return findings;
-}
-
-/** Analyzer entrypoint: scan every changed TS/JS file's added lines for floating promises. */
-export async function scanFloatingPromise(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<FloatingPromiseFinding[]> {
-  const findings: FloatingPromiseFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForFloatingPromise(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+// Floating-promise analyzer (#2023). Flags newly-added async-shaped calls whose returned promise is neither
+// awaited, returned, voided, nor .catch()/.then()-chained on the same statement — a common silent-failure bug.
+// Precision-first structural heuristic over added TS/JS lines only: promise-shaped callees (`fetch`, `Promise.*`,
+// or an `*Async` suffix) on bare expression statements. Pure compute, no network.
+import type { EnrichRequest, FloatingPromiseFinding } from "../types.js";
+import { codeOnly } from "./secret-log.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
+
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
+const MAX_CALL_CHARS = 40;
+
+const JS_TS_PATH_RE = /\.(?:tsx?|jsx?|mts|cts|cjs|mjs)$/i;
+
+const HANDLED_PREFIX =
+  /^\s*(?:await\b|return\b|void\b|throw\b|if\b|for\b|while\b|switch\b|case\b|else\b|try\b|catch\b|finally\b|import\b|export\b|const\b|let\b|var\b|type\b|interface\b|class\b|function\b|async\s+function\b)/;
+
+const PROMISE_CHAIN_RE = /\.(?:then|catch)\s*\(/;
+
+function isJsTsPath(path: string): boolean {
+  return JS_TS_PATH_RE.test(path) && !isTestPath(path);
+}
+
+function isCommentLine(line: string): boolean {
+  const trimmed = line.trimStart();
+  return /^(?:\/\/|\/\*|\*)/.test(trimmed);
+}
+
+function truncateCall(call: string): string {
+  if (call.length <= MAX_CALL_CHARS) return call;
+  return `${call.slice(0, MAX_CALL_CHARS - 3)}...`;
+}
+
+function isPromiseShapedCallee(callee: string): boolean {
+  if (callee === "fetch" || callee.endsWith(".fetch")) return true;
+  if (callee === "Promise" || /^Promise\.(?:all(?:Settled)?|race|any|resolve|reject)$/.test(callee)) {
+    return true;
+  }
+  const last = callee.split(".").pop() ?? callee;
+  return /Async$/.test(last);
+}
+
+function extractLeadingCallCallee(line: string): string | null {
+  const code = codeOnly(line).trim();
+  const semiIdx = code.indexOf(";");
+  if (semiIdx >= 0 && semiIdx < code.length - 1) {
+    const after = code.slice(semiIdx + 1).trim();
+    if (after.length > 0) return null;
+  }
+
+  const newPromise = /^new\s+Promise\s*\(/.exec(code);
+  if (newPromise) return "Promise";
+
+  const match = /^((?:[a-zA-Z_$][\w$]*(?:\.[a-zA-Z_$][\w$]*)*))\s*\(/.exec(code);
+  return match?.[1] ?? null;
+}
+
+/** Classify one added line for a floating promise call, or null. Pure. */
+export function detectFloatingPromise(line: string): string | null {
+  if (isCommentLine(line) || HANDLED_PREFIX.test(line)) {
+    return null;
+  }
+
+  const code = codeOnly(line).replace(/=>/g, "  ");
+  if (PROMISE_CHAIN_RE.test(code)) return null;
+  if (/(?<![=<>!])=(?!=)/.test(code)) return null;
+
+  const callee = extractLeadingCallCallee(line);
+  if (!callee || !isPromiseShapedCallee(callee)) return null;
+
+  return truncateCall(callee);
+}
+
+type ScanLimits = {
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Scan one file patch's added lines for floating promises, line-cited via hunk headers. Pure. */
+export function scanPatchForFloatingPromise(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): FloatingPromiseFinding[] {
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || !isJsTsPath(path)) return [];
+  const findings: FloatingPromiseFinding[] = [];
+  let newLine = 0;
+  let inHunk = false;
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS) {
+        const call = detectFloatingPromise(body);
+        if (call) {
+          findings.push({ file: path, line: newLine, call });
+          if (findings.length >= maxFindings) return findings;
+        }
+      }
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return findings;
+}
+
+/** Analyzer entrypoint: scan every changed TS/JS file's added lines for floating promises. */
+export async function scanFloatingPromise(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<FloatingPromiseFinding[]> {
+  const findings: FloatingPromiseFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForFloatingPromise(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/hardcoded-url.ts b/review-enrichment/src/analyzers/hardcoded-url.ts
index c5790d50ba..56ce031997 100644
--- a/review-enrichment/src/analyzers/hardcoded-url.ts
+++ b/review-enrichment/src/analyzers/hardcoded-url.ts
@@ -1,143 +1,144 @@
-// Hardcoded-URL / raw-endpoint analyzer (#2027). Flags absolute HTTP(S) URLs and IP:port endpoints newly
-// added in non-test, non-config source — often environment leakage or a value that should come from config.
-// Distinct from the secret scanner (no credential); this is a portability/config-hygiene signal. Pure compute
-// over added lines, no network. Hostnames are redacted/truncated in findings — never full paths or queries.
-import type { EnrichRequest, HardcodedUrlFinding } from "../types.js";
-import { isMagicNumberSourcePath } from "./magic-number.js";
-
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-const MAX_HOST_CHARS = 40;
-
-const CONFIG_PATH_RE =
-  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|values(?:\.[^/]+)?\.ya?ml|\.env(?:\.[^/]+)?|.*\.(?:tf|tfvars|hcl|ya?ml|json|toml|ini|conf|env)|Dockerfile(?:\.[^/]+)?|nginx[^/]*\.conf)$/i;
-
-const HTTP_URL_RE = /https?:\/\/[^\s'"\`<>]+/gi;
-const IP_ENDPOINT_RE = /\b(?:\d{1,3}\.){3}\d{1,3}:\d{1,5}\b/g;
-
-const ALLOWLISTED_HOSTS = new Set(["localhost", "127.0.0.1", "example.com"]);
-
-function isConfigPath(path: string): boolean {
-  return CONFIG_PATH_RE.test(path);
-}
-
-function isScannablePath(path: string): boolean {
-  return isMagicNumberSourcePath(path) && !isConfigPath(path);
-}
-
-function redactHost(host: string): string {
-  const lower = host.toLowerCase();
-  if (lower.length <= MAX_HOST_CHARS) return lower;
-  return `${lower.slice(0, MAX_HOST_CHARS - 3)}...`;
-}
-
-function isAllowlistedHost(host: string): boolean {
-  const lower = host.toLowerCase();
-  if (ALLOWLISTED_HOSTS.has(lower)) return true;
-  if (lower.endsWith(".example.com")) return true;
-  return false;
-}
-
-function hostFromHttpUrl(url: string): string {
-  const match = /^https?:\/\/([^/?#:]+)(?::\d+)?/i.exec(url);
-  return match?.[1] ?? url;
-}
-
-function isCommentLine(line: string): boolean {
-  const trimmed = line.trimStart();
-  return /^(?:\/\/|#|\/\*|\*|<!--)/.test(trimmed);
-}
-
-function isImportLine(line: string): boolean {
-  const trimmed = line.trimStart();
-  return /^(?:import\b|from\b|#include\b|require\s*\(|use\s+\w+::)/.test(trimmed);
-}
-
-/** Classify one added line for a hardcoded URL or IP endpoint, or null. Pure. */
-export function detectHardcodedUrl(
-  line: string,
-): { kind: HardcodedUrlFinding["kind"]; host: string } | null {
-  if (isCommentLine(line) || isImportLine(line)) return null;
-
-  HTTP_URL_RE.lastIndex = 0;
-  const urlMatch = HTTP_URL_RE.exec(line);
-  if (urlMatch) {
-    const host = hostFromHttpUrl(urlMatch[0]);
-    if (!isAllowlistedHost(host)) {
-      return { kind: "http-url", host: redactHost(host) };
-    }
-  }
-
-  IP_ENDPOINT_RE.lastIndex = 0;
-  const ipMatch = IP_ENDPOINT_RE.exec(line);
-  if (ipMatch) {
-    const host = ipMatch[0].split(":")[0] ?? ipMatch[0];
-    if (!isAllowlistedHost(host)) {
-      return { kind: "ip-endpoint", host: redactHost(host) };
-    }
-  }
-
-  return null;
-}
-
-type ScanLimits = {
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Scan one file patch's added lines for hardcoded URLs/endpoints, line-cited via hunk headers. Pure. */
-export function scanPatchForHardcodedUrl(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): HardcodedUrlFinding[] {
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || !isScannablePath(path)) return [];
-  const findings: HardcodedUrlFinding[] = [];
-  let newLine = 0;
-  let inHunk = false;
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS) {
-        const hit = detectHardcodedUrl(body);
-        if (hit) {
-          findings.push({ file: path, line: newLine, kind: hit.kind, host: hit.host });
-          if (findings.length >= maxFindings) return findings;
-        }
-      }
-      newLine++;
-    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
-      newLine++;
-    }
-  }
-  return findings;
-}
-
-/** Analyzer entrypoint: scan every changed scannable file's added lines for hardcoded endpoints. */
-export async function scanHardcodedUrl(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<HardcodedUrlFinding[]> {
-  const findings: HardcodedUrlFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForHardcodedUrl(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+// Hardcoded-URL / raw-endpoint analyzer (#2027). Flags absolute HTTP(S) URLs and IP:port endpoints newly
+// added in non-test, non-config source — often environment leakage or a value that should come from config.
+// Distinct from the secret scanner (no credential); this is a portability/config-hygiene signal. Pure compute
+// over added lines, no network. Hostnames are redacted/truncated in findings — never full paths or queries.
+import type { EnrichRequest, HardcodedUrlFinding } from "../types.js";
+import { isMagicNumberSourcePath } from "./magic-number.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
+
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
+const MAX_HOST_CHARS = 40;
+
+const CONFIG_PATH_RE =
+  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|values(?:\.[^/]+)?\.ya?ml|\.env(?:\.[^/]+)?|.*\.(?:tf|tfvars|hcl|ya?ml|json|toml|ini|conf|env)|Dockerfile(?:\.[^/]+)?|nginx[^/]*\.conf)$/i;
+
+const HTTP_URL_RE = /https?:\/\/[^\s'"\`<>]+/gi;
+const IP_ENDPOINT_RE = /\b(?:\d{1,3}\.){3}\d{1,3}:\d{1,5}\b/g;
+
+const ALLOWLISTED_HOSTS = new Set(["localhost", "127.0.0.1", "example.com"]);
+
+function isConfigPath(path: string): boolean {
+  return CONFIG_PATH_RE.test(path);
+}
+
+function isScannablePath(path: string): boolean {
+  return isMagicNumberSourcePath(path) && !isConfigPath(path);
+}
+
+function redactHost(host: string): string {
+  const lower = host.toLowerCase();
+  if (lower.length <= MAX_HOST_CHARS) return lower;
+  return `${lower.slice(0, MAX_HOST_CHARS - 3)}...`;
+}
+
+function isAllowlistedHost(host: string): boolean {
+  const lower = host.toLowerCase();
+  if (ALLOWLISTED_HOSTS.has(lower)) return true;
+  if (lower.endsWith(".example.com")) return true;
+  return false;
+}
+
+function hostFromHttpUrl(url: string): string {
+  const match = /^https?:\/\/([^/?#:]+)(?::\d+)?/i.exec(url);
+  return match?.[1] ?? url;
+}
+
+function isCommentLine(line: string): boolean {
+  const trimmed = line.trimStart();
+  return /^(?:\/\/|#|\/\*|\*|<!--)/.test(trimmed);
+}
+
+function isImportLine(line: string): boolean {
+  const trimmed = line.trimStart();
+  return /^(?:import\b|from\b|#include\b|require\s*\(|use\s+\w+::)/.test(trimmed);
+}
+
+/** Classify one added line for a hardcoded URL or IP endpoint, or null. Pure. */
+export function detectHardcodedUrl(
+  line: string,
+): { kind: HardcodedUrlFinding["kind"]; host: string } | null {
+  if (isCommentLine(line) || isImportLine(line)) return null;
+
+  HTTP_URL_RE.lastIndex = 0;
+  const urlMatch = HTTP_URL_RE.exec(line);
+  if (urlMatch) {
+    const host = hostFromHttpUrl(urlMatch[0]);
+    if (!isAllowlistedHost(host)) {
+      return { kind: "http-url", host: redactHost(host) };
+    }
+  }
+
+  IP_ENDPOINT_RE.lastIndex = 0;
+  const ipMatch = IP_ENDPOINT_RE.exec(line);
+  if (ipMatch) {
+    const host = ipMatch[0].split(":")[0] ?? ipMatch[0];
+    if (!isAllowlistedHost(host)) {
+      return { kind: "ip-endpoint", host: redactHost(host) };
+    }
+  }
+
+  return null;
+}
+
+type ScanLimits = {
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Scan one file patch's added lines for hardcoded URLs/endpoints, line-cited via hunk headers. Pure. */
+export function scanPatchForHardcodedUrl(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): HardcodedUrlFinding[] {
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || !isScannablePath(path)) return [];
+  const findings: HardcodedUrlFinding[] = [];
+  let newLine = 0;
+  let inHunk = false;
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS) {
+        const hit = detectHardcodedUrl(body);
+        if (hit) {
+          findings.push({ file: path, line: newLine, kind: hit.kind, host: hit.host });
+          if (findings.length >= maxFindings) return findings;
+        }
+      }
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return findings;
+}
+
+/** Analyzer entrypoint: scan every changed scannable file's added lines for hardcoded endpoints. */
+export async function scanHardcodedUrl(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<HardcodedUrlFinding[]> {
+  const findings: HardcodedUrlFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForHardcodedUrl(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/i18n-regression.ts b/review-enrichment/src/analyzers/i18n-regression.ts
index 3fb8930214..8eaae67f28 100644
--- a/review-enrichment/src/analyzers/i18n-regression.ts
+++ b/review-enrichment/src/analyzers/i18n-regression.ts
@@ -1,47 +1,48 @@
-// i18n regression analyzer (#2029). When added lines in a UI file show a translation convention
-// (t('…'), useTranslation, FormattedMessage, etc.), flags newly-added user-facing string literals that
-// bypass it — JSX text nodes and common label/title props. Inactive when the diff shows no i18n usage.
-// Pure compute over added lines, no network. Never returns string content in findings.
-import type { EnrichRequest, I18nFinding } from "../types.js";
-import { isTestPath } from "./test-ratio.js";
-
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-
-const UI_PATH_RE = /\.(?:tsx|jsx|vue)$/i;
-
-const I18N_CONVENTION_RES = [
-  /\bt\s*\(\s*['"`]/,
-  /\buseTranslation\s*\(/,
-  /<FormattedMessage\b/,
-  /\bformatMessage\s*\(/,
-  /\bi18n\.t\s*\(/,
-  /\bi18next\.t\s*\(/,
-  /\$t\s*\(/,
-];
-
+// i18n regression analyzer (#2029). When added lines in a UI file show a translation convention
+// (t('…'), useTranslation, FormattedMessage, etc.), flags newly-added user-facing string literals that
+// bypass it — JSX text nodes and common label/title props. Inactive when the diff shows no i18n usage.
+// Pure compute over added lines, no network. Never returns string content in findings.
+import type { EnrichRequest, I18nFinding } from "../types.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
+
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
+
+const UI_PATH_RE = /\.(?:tsx|jsx|vue)$/i;
+
+const I18N_CONVENTION_RES = [
+  /\bt\s*\(\s*['"`]/,
+  /\buseTranslation\s*\(/,
+  /<FormattedMessage\b/,
+  /\bformatMessage\s*\(/,
+  /\bi18n\.t\s*\(/,
+  /\bi18next\.t\s*\(/,
+  /\$t\s*\(/,
+];
+
 const USER_FACING_PROP_RE =
   /\b(?:title|label|placeholder|aria-label|helperText|message|description|heading|tooltip|hint|alt|caption|subtitle|confirmText|cancelText|buttonText|emptyText)\s*=\s*["']([^"']+)["']/gi;
 
 /** True when a line shows the repo uses an i18n/translation call convention. Pure. */
 export function detectI18nConvention(line: string): boolean {
-  return I18N_CONVENTION_RES.some((re) => {
-    re.lastIndex = 0;
-    return re.test(line);
-  });
-}
-
-/** True when a string literal looks like user-facing copy rather than a key/id. Pure. */
-export function looksLikeUserFacingLiteral(value: string): boolean {
-  const trimmed = value.trim();
-  if (!trimmed || !/[A-Za-z]/.test(trimmed)) return false;
-  if (/\s/.test(trimmed)) return true;
-  if (/^[a-z0-9_.-]+$/.test(trimmed) && trimmed.includes(".")) return false;
-  if (trimmed.length <= 3 && /^[a-z]+$/.test(trimmed)) return false;
-  if (/[A-Z]/.test(trimmed)) return true;
-  return trimmed.length >= 8;
-}
-
+  return I18N_CONVENTION_RES.some((re) => {
+    re.lastIndex = 0;
+    return re.test(line);
+  });
+}
+
+/** True when a string literal looks like user-facing copy rather than a key/id. Pure. */
+export function looksLikeUserFacingLiteral(value: string): boolean {
+  const trimmed = value.trim();
+  if (!trimmed || !/[A-Za-z]/.test(trimmed)) return false;
+  if (/\s/.test(trimmed)) return true;
+  if (/^[a-z0-9_.-]+$/.test(trimmed) && trimmed.includes(".")) return false;
+  if (trimmed.length <= 3 && /^[a-z]+$/.test(trimmed)) return false;
+  if (/[A-Z]/.test(trimmed)) return true;
+  return trimmed.length >= 8;
+}
+
 function isCommentOrImportLine(line: string): boolean {
   const trimmed = line.trimStart();
   return /^(?:\/\/|\/\*|\*|<!--|import\b|from\b)/.test(trimmed);
@@ -67,91 +68,91 @@ function hasUserFacingJsxText(line: string): boolean {
 
 /** True when one added UI line adds a hardcoded user-facing string, or null. Pure. */
 export function detectHardcodedUiString(line: string): boolean {
-  if (isCommentOrImportLine(line)) return false;
-
-  USER_FACING_PROP_RE.lastIndex = 0;
-  let propMatch: RegExpExecArray | null;
-  while ((propMatch = USER_FACING_PROP_RE.exec(line))) {
-    if (looksLikeUserFacingLiteral(propMatch[1] ?? "")) return true;
-  }
-
+  if (isCommentOrImportLine(line)) return false;
+
+  USER_FACING_PROP_RE.lastIndex = 0;
+  let propMatch: RegExpExecArray | null;
+  while ((propMatch = USER_FACING_PROP_RE.exec(line))) {
+    if (looksLikeUserFacingLiteral(propMatch[1] ?? "")) return true;
+  }
+
   if (hasUserFacingJsxText(line)) return true;
 
   return false;
 }
-
-function isUiPath(path: string): boolean {
-  return UI_PATH_RE.test(path) && !isTestPath(path);
-}
-
-function patchShowsI18nConvention(patch: string): boolean {
-  for (const line of patch.split("\n")) {
-    if (!line.startsWith("+")) continue;
-    const body = line.slice(1);
-    if (body.length > MAX_LINE_CHARS) continue;
-    if (detectI18nConvention(body)) return true;
-  }
-  return false;
-}
-
-type ScanLimits = {
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Scan one file patch for i18n regressions, line-cited via hunk headers. Pure. */
-export function scanPatchForI18nRegression(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): I18nFinding[] {
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || !isUiPath(path) || !patchShowsI18nConvention(patch)) return [];
-
-  const findings: I18nFinding[] = [];
-  let newLine = 0;
-  let inHunk = false;
-
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS && detectHardcodedUiString(body)) {
-        findings.push({ file: path, line: newLine });
-        if (findings.length >= maxFindings) return findings;
-      }
-      newLine++;
-    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
-      newLine++;
-    }
-  }
-
-  return findings;
-}
-
-/** Analyzer entrypoint: scan UI files whose diff shows an i18n convention. */
-export async function scanI18nRegression(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<I18nFinding[]> {
-  const findings: I18nFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForI18nRegression(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+
+function isUiPath(path: string): boolean {
+  return UI_PATH_RE.test(path) && !isTestPath(path);
+}
+
+function patchShowsI18nConvention(patch: string): boolean {
+  for (const line of patch.split("\n")) {
+    if (!line.startsWith("+")) continue;
+    const body = line.slice(1);
+    if (body.length > MAX_LINE_CHARS) continue;
+    if (detectI18nConvention(body)) return true;
+  }
+  return false;
+}
+
+type ScanLimits = {
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Scan one file patch for i18n regressions, line-cited via hunk headers. Pure. */
+export function scanPatchForI18nRegression(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): I18nFinding[] {
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || !isUiPath(path) || !patchShowsI18nConvention(patch)) return [];
+
+  const findings: I18nFinding[] = [];
+  let newLine = 0;
+  let inHunk = false;
+
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS && detectHardcodedUiString(body)) {
+        findings.push({ file: path, line: newLine });
+        if (findings.length >= maxFindings) return findings;
+      }
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+
+  return findings;
+}
+
+/** Analyzer entrypoint: scan UI files whose diff shows an i18n convention. */
+export async function scanI18nRegression(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<I18nFinding[]> {
+  const findings: I18nFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForI18nRegression(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/iac-misconfig.ts b/review-enrichment/src/analyzers/iac-misconfig.ts
index 960cb4bcec..3ad2b0f50e 100644
--- a/review-enrichment/src/analyzers/iac-misconfig.ts
+++ b/review-enrichment/src/analyzers/iac-misconfig.ts
@@ -1,7 +1,8 @@
 import type { EnrichRequest, IacMisconfigFinding } from "../types.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 const CONFIG_PATH_RE =
   /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|values(?:\.[^/]+)?\.ya?ml|\.env(?:\.[^/]+)?|.*\.(?:tf|tfvars|hcl|ya?ml|json|toml|ini|conf|env)|Dockerfile(?:\.[^/]+)?|nginx[^/]*\.conf)$/i;
diff --git a/review-enrichment/src/analyzers/limits.ts b/review-enrichment/src/analyzers/limits.ts
new file mode 100644
index 0000000000..98c0954393
--- /dev/null
+++ b/review-enrichment/src/analyzers/limits.ts
@@ -0,0 +1,12 @@
+// Shared default limits for REES analyzers (#1477 follow-up). Most analyzers cap their findings and
+// skip pathologically long lines at the same two numbers -- centralizing them here means changing the
+// platform-wide bound in ONE place instead of ~30 duplicated literals scattered across analyzer files
+// and their registry.ts descriptors. An analyzer with a genuinely different bound (e.g. asset-weight's
+// 50, heavy-dependency's 15) keeps its own local override -- only the REPEATED 25/2000 pair moves here.
+
+/** Default cap on findings a single analyzer emits per request, keeping the brief bounded. */
+export const DEFAULT_MAX_FINDINGS = 25;
+
+/** Default per-line length ceiling analyzers skip past without inspecting -- defensive against a
+ *  pathologically long generated/minified line, not a real code-quality signal. */
+export const DEFAULT_MAX_LINE_CHARS = 2000;
diff --git a/review-enrichment/src/analyzers/loose-range.ts b/review-enrichment/src/analyzers/loose-range.ts
index 3431199e29..bfda9f78f2 100644
--- a/review-enrichment/src/analyzers/loose-range.ts
+++ b/review-enrichment/src/analyzers/loose-range.ts
@@ -8,9 +8,10 @@
 // without resolving the whole tree.
 import type { EnrichRequest, LooseRangeFinding } from "../types.js";
 import { isDiffFileHeaderLine } from "./diff-lines.js";
+import { DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 const MAX_FINDINGS = 20;
-const MAX_LINE_CHARS = 2000;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 // `"name": "spec"` on an added line, same shape the sibling dependency-scan.ts keys on.
 const NPM_LINE_RE = /^"([^"]+)"\s*:\s*"([^"]+)"/;
diff --git a/review-enrichment/src/analyzers/magic-number.ts b/review-enrichment/src/analyzers/magic-number.ts
index 734133c0d1..10f28ce67f 100644
--- a/review-enrichment/src/analyzers/magic-number.ts
+++ b/review-enrichment/src/analyzers/magic-number.ts
@@ -5,9 +5,10 @@
 import type { EnrichRequest, MagicNumberFinding } from "../types.js";
 import { codeOnly } from "./secret-log.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 const REPORT_CHARS = 40;
 
 const SOURCE_EXTS = new Set([
diff --git a/review-enrichment/src/analyzers/migration-safety.ts b/review-enrichment/src/analyzers/migration-safety.ts
index b131d1c4d6..dacdaecf8f 100644
--- a/review-enrichment/src/analyzers/migration-safety.ts
+++ b/review-enrichment/src/analyzers/migration-safety.ts
@@ -6,9 +6,10 @@
 // line-anchored: a statement split across lines is missed (fail-quiet) rather than tracked with cross-line
 // state, and each shape is a finite, documented DDL form — never a general SQL grammar.
 import type { EnrichRequest, MigrationSafetyFinding } from "../types.js";
+import { DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 const MAX_FINDINGS = 20;
-const MAX_LINE_CHARS = 2000;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 // Migration SQL locations: a migrations/ directory (Wrangler/D1, Prisma, Flyway, …), Rails-style db/migrate/,
 // or any .sql file — the three forms named by #2022.
diff --git a/review-enrichment/src/analyzers/redos.ts b/review-enrichment/src/analyzers/redos.ts
index a836c2513a..a127f9b14b 100644
--- a/review-enrichment/src/analyzers/redos.ts
+++ b/review-enrichment/src/analyzers/redos.ts
@@ -4,11 +4,12 @@
 // Pure compute, no network, no external detector (structural-only → high precision: linear shapes like `(abc)+`
 // are NOT flagged). Line-cited via hunk headers, mirroring the actions-pin analyzer.
 import type { EnrichRequest, RedosFinding } from "../types.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 // Every loop runs over an attacker-controlled patch, so each is bounded.
-const MAX_FINDINGS = 25; // keep the brief bounded
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 const MAX_PATTERN_CHARS = 1000; // ignore absurdly long literals (a hand-written regex is never this long)
-const MAX_LINE_CHARS = 2000; // skip extraction on pathologically long lines (defensive)
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 const REPORT_CHARS = 80; // truncate the reported pattern so the brief stays readable
 
 type RedosScanLimits = {
diff --git a/review-enrichment/src/analyzers/registry.ts b/review-enrichment/src/analyzers/registry.ts
index 2d26e6a987..7edb5f46c9 100644
--- a/review-enrichment/src/analyzers/registry.ts
+++ b/review-enrichment/src/analyzers/registry.ts
@@ -32,10 +32,10 @@ import { scanLooseRanges } from "./loose-range.js";
 import { scanMagicNumbers } from "./magic-number.js";
 import { scanConflictMarkers } from "./conflict-marker.js";
 import { scanDebugLeftover } from "./debug-leftover.js";
-import { scanDeepNesting } from "./deep-nesting.js";
+import { scanDeepNesting, DEFAULT_MAX_DEPTH } from "./deep-nesting.js";
 import { scanI18nRegression } from "./i18n-regression.js";
 import { scanErrorSwallow } from "./error-swallow.js";
-import { scanComplexity } from "./complexity.js";
+import { scanComplexity, DEFAULT_MAX_COMPLEXITY } from "./complexity.js";
 import { scanFloatingPromise } from "./floating-promise.js";
 import { scanSizeSmell } from "./size-smell.js";
 import { scanA11yRegression } from "./a11y-regression.js";
@@ -60,6 +60,7 @@ import type {
   AnalyzerRegistry,
   AnyAnalyzerDescriptor,
 } from "./types.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
 function descriptor<Name extends AnalyzerName>(
   definition: AnalyzerDescriptor<Name>,
@@ -76,7 +77,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxManifestFiles: 20, maxPatchLinesPerFile: 500 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxManifestFiles: 20, maxPatchLinesPerFile: 500 },
     docs: {
       summary:
         "Summarizes direct dependency add/remove/version-change deltas in changed manifest patches — informational, not a CVE scan.",
@@ -196,7 +197,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000, maxHostChars: 40 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS, maxHostChars: 40 },
     docs: {
       summary:
         "Flags absolute HTTP(S) URLs and raw IP:port endpoints newly added in non-test, non-config source.",
@@ -261,7 +262,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxPatternChars: 1000, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxPatternChars: 1000, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary: "Finds newly introduced regex shapes that can catastrophically backtrack.",
       looksAt: "Regex literals and RegExp constructor string arguments in added lines.",
@@ -324,7 +325,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary: "Flags added code that writes sensitive values to logs or stdout.",
       looksAt: "Added lines that call console, logger, process.stdout, or process.stderr sinks.",
@@ -406,7 +407,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary: "Flags risky IaC/config changes such as public buckets or insecure CORS.",
       looksAt: "Added lines in Docker, Terraform, YAML, JSON, and similar config files.",
@@ -500,7 +501,7 @@ export const ANALYZER_DESCRIPTORS = [
       minRun: 8,
       maxCandidates: 40,
       maxFetches: 30,
-      maxFindings: 25,
+      maxFindings: DEFAULT_MAX_FINDINGS,
       maxFileBytes: 500_000,
     },
     docs: {
@@ -717,7 +718,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "github-light",
     defaultEnabled: true,
     requires: ["github-token"],
-    limits: { maxCommits: 100, maxFindings: 25 },
+    limits: { maxCommits: 100, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags commit-history hygiene issues: a merge commit pulled into the PR's own history, a commit left with git's fixup!/squash! autosquash marker, and a commit carrying a Co-authored-by trailer.",
@@ -807,7 +808,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 20, maxLineChars: 2000 },
+    limits: { maxFindings: 20, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags risky schema operations in added migration SQL: drops, renames, non-nullable columns without a default, and blocking table rewrites.",
@@ -848,7 +849,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 20, maxLineChars: 2000 },
+    limits: { maxFindings: 20, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags newly-added npm dependency specifiers that use dangerously loose ranges instead of a pinned/caret/tilde range.",
@@ -889,7 +890,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags non-inclusive terms newly added in identifiers or comments (whitelist/blacklist, master/slave) and suggests the neutral replacement.",
@@ -918,7 +919,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000, maxNoteChars: 120 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS, maxNoteChars: 120 },
     docs: {
       summary:
         "Surfaces TODO/FIXME/HACK/XXX markers a PR adds in comments, so a reviewer sees the change is shipping known-incomplete work.",
@@ -948,7 +949,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags newly-added non-trivial numeric literals in non-test source where a named constant would clarify intent.",
@@ -978,7 +979,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags leftover VCS conflict markers (`<<<<<<<`, `|||||||`, `=======`, `>>>>>>>`) accidentally committed in added lines.",
@@ -1007,7 +1008,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags debugging leftovers a PR adds in non-test source — `debugger;`, bare console sinks, or `print()` calls.",
@@ -1036,7 +1037,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxFileLines: 400, maxFunctionLines: 60, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxFileLines: 400, maxFunctionLines: 60, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags maintainability size smells from patch structure: an estimated resulting file length or an added function body span that exceeds configured thresholds.",
@@ -1068,7 +1069,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000, maxCallChars: 40 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS, maxCallChars: 40 },
     docs: {
       summary:
         "Flags newly-added promise-shaped calls whose returned promise is neither awaited, returned, voided, nor same-line .then/.catch-chained.",
@@ -1097,7 +1098,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxDepth: 4, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxDepth: DEFAULT_MAX_DEPTH, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags newly-added control-flow blocks whose nesting depth exceeds a threshold inside a contiguous run of added lines.",
@@ -1126,7 +1127,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags newly-added catch/except blocks (and Go if-err checks) that swallow or mishandle the error — empty body, unused binding, a bare `return null`/`nil`, or a Python bare `except:` naming no exception type.",
@@ -1165,7 +1166,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxComplexity: 10, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxComplexity: DEFAULT_MAX_COMPLEXITY, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags a newly-added function whose approximate cyclomatic complexity (branch/loop/logical-operator density, computed on the diff-visible lines) exceeds a threshold.",
@@ -1195,7 +1196,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Counts and locates explicit `any` annotations, `<any>` assertions, and `as any` casts newly introduced in TypeScript diffs.",
@@ -1224,7 +1225,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "Flags common accessibility regressions in newly added JSX/HTML markup lines.",
@@ -1255,7 +1256,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxFindings: 25, maxLineChars: 2000 },
+    limits: { maxFindings: DEFAULT_MAX_FINDINGS, maxLineChars: DEFAULT_MAX_LINE_CHARS },
     docs: {
       summary:
         "When the diff shows a translation convention, flags newly-added user-facing JSX text or label/title props that bypass it.",
@@ -1282,7 +1283,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "github-light",
     defaultEnabled: true,
     requires: ["files", "github-token", "head-sha"],
-    limits: { maxSymbols: 10, maxSearches: 10, maxFindings: 25 },
+    limits: { maxSymbols: 10, maxSearches: 10, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags exports newly added by the PR that have zero non-declaration references anywhere in the repo.",
@@ -1314,7 +1315,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "github-light",
     defaultEnabled: true,
     requires: ["files", "github-token", "head-sha"],
-    limits: { maxFiles: 10, maxFetches: 10, maxFindings: 25 },
+    limits: { maxFiles: 10, maxFetches: 10, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags when a PR adds a new enum member or string-literal union variant but an exhaustive switch still omits it.",
@@ -1353,7 +1354,7 @@ export const ANALYZER_DESCRIPTORS = [
       maxCommitsPerFile: 5,
       maxCheckRunFetches: 12,
       windowDays: 30,
-      maxFindings: 25,
+      maxFindings: DEFAULT_MAX_FINDINGS,
     },
     docs: {
       summary:
@@ -1386,7 +1387,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "github-light",
     defaultEnabled: true,
     requires: ["github-token"],
-    limits: { maxCommits: 100, maxFindings: 25 },
+    limits: { maxCommits: 100, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Lints the PR's commit subjects against the Conventional Commits spec and flags non-conforming subjects (bad/absent type, over-long, or empty).",
@@ -1428,7 +1429,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxEntrypoints: 25, maxFindings: 25 },
+    limits: { maxEntrypoints: 25, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags an exported symbol a PR removes or renames in a package public entrypoint — a semver-major break for downstream consumers shipped without a major version bump.",
@@ -1461,7 +1462,7 @@ export const ANALYZER_DESCRIPTORS = [
     cost: "local",
     defaultEnabled: true,
     requires: ["files"],
-    limits: { maxManifestFiles: 20, maxPatchLinesPerFile: 500, maxFindings: 25 },
+    limits: { maxManifestFiles: 20, maxPatchLinesPerFile: 500, maxFindings: DEFAULT_MAX_FINDINGS },
     docs: {
       summary:
         "Flags a direct dependency a PR newly adds or upgrades that is an officially deprecated or unmaintained package with a maintained successor — an adoption risk the review brief should surface.",
@@ -1501,7 +1502,7 @@ export const ANALYZER_DESCRIPTORS = [
       maxFilesProbed: 5,
       commitsPerFile: 15,
       maxRevertLookups: 10,
-      maxFindings: 25,
+      maxFindings: DEFAULT_MAX_FINDINGS,
     },
     docs: {
       summary:
@@ -1589,7 +1590,7 @@ export const ANALYZER_DESCRIPTORS = [
       maxSearches: 6,
       maxFileFetches: 12,
       maxCallersPerFinding: 5,
-      maxFindings: 25,
+      maxFindings: DEFAULT_MAX_FINDINGS,
     },
     docs: {
       summary:
diff --git a/review-enrichment/src/analyzers/revert-recurrence.ts b/review-enrichment/src/analyzers/revert-recurrence.ts
index de2e549639..ba6be8767d 100644
--- a/review-enrichment/src/analyzers/revert-recurrence.ts
+++ b/review-enrichment/src/analyzers/revert-recurrence.ts
@@ -14,13 +14,14 @@ import type {
 import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
 import { isHistoryUninformativePath } from "./history-path.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
 
 const GITHUB_API = "https://api.github.com";
 const SLUG_RE = /^[A-Za-z0-9._-]+$/;
 const MAX_FILES_PROBED = 5; // bound the per-file commit-history fan-out, matching the other history-class analyzers
 const COMMITS_PER_FILE = 15; // recent commits to inspect per probed file when looking for a revert
 const MAX_REVERT_LOOKUPS = 10; // global cap on revert-commit detail fetches across all probed files
-const MAX_FINDINGS = 25;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
 // GitHub's auto-generated revert commit has a `Revert "<original> (#N)"` subject; a hand-written revert body
 // carries the `This reverts commit <sha>` trailer. Either shape confirms a revert without diff-classifying a patch.
 const REVERT_SUBJECT_RE = /^revert\b/i;
diff --git a/review-enrichment/src/analyzers/secret-log.ts b/review-enrichment/src/analyzers/secret-log.ts
index 6eac08fc32..899071c812 100644
--- a/review-enrichment/src/analyzers/secret-log.ts
+++ b/review-enrichment/src/analyzers/secret-log.ts
@@ -5,9 +5,10 @@
 // `console.log("password reset")` is NOT flagged — a hit requires a sensitive name used as CODE (property access,
 // a `${…}` interpolation, or a dumped request object). Line-cited via hunk headers, mirroring the other analyzers.
 import type { EnrichRequest, SecretLogFinding } from "../types.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25; // keep the brief bounded
-const MAX_LINE_CHARS = 2000; // skip pathologically long lines (defensive)
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 // All matchers below are FLAT alternations (no group is itself quantified), so each is linear-time — the analyzer
 // can never be the DoS class it sits beside (#1503). Logging / stdout sinks. The console branch is kept separate
diff --git a/review-enrichment/src/analyzers/size-smell.ts b/review-enrichment/src/analyzers/size-smell.ts
index 2ffb3926cc..235bde7e44 100644
--- a/review-enrichment/src/analyzers/size-smell.ts
+++ b/review-enrichment/src/analyzers/size-smell.ts
@@ -1,166 +1,167 @@
-// Size-smell analyzer (#2019). Flags maintainability smells from patch structure alone: a changed file
-// whose estimated resulting length exceeds a threshold, or a newly-added function body whose brace span is
-// too long. Pure compute over diff hunks, no network. Skips test paths.
-import type { EnrichRequest, SizeSmellFinding } from "../types.js";
-import { codeOnly } from "./secret-log.js";
-import { isTestPath } from "./test-ratio.js";
-
-export const DEFAULT_MAX_FILE_LINES = 400;
-export const DEFAULT_MAX_FUNCTION_LINES = 60;
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-
-const HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
-
-const FUNCTION_BODY_OPEN_RE =
-  /\bfunction\s+(\w+)\s*\([^)]*\)\s*\{|\b(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?(?:function\s*)?\([^)]*\)\s*=>\s*\{/;
-
-type ScanLimits = {
-  maxFileLines?: number;
-  maxFunctionLines?: number;
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Estimate the resulting file length from unified-diff hunk headers. Pure. */
-export function estimateFileLengthFromPatch(patch: string): number {
-  let maxEndLine = 0;
-  for (const line of patch.split("\n")) {
-    const hunk = HUNK_RE.exec(line);
-    if (!hunk) continue;
-    const newStart = Number(hunk[3]);
-    const newLen = hunk[4] ? Number(hunk[4]) : 1;
-    maxEndLine = Math.max(maxEndLine, newStart + newLen - 1);
-  }
-  return maxEndLine;
-}
-
-function functionNameFromLine(line: string): string | undefined {
-  const code = codeOnly(line);
-  const match = FUNCTION_BODY_OPEN_RE.exec(code);
-  if (!match) return undefined;
-  return match[1] ?? match[2];
-}
-
-function braceDepthDelta(code: string): number {
-  let depth = 0;
-  for (const ch of code) {
-    if (ch === "{") depth++;
-    else if (ch === "}") depth--;
-  }
-  return depth;
-}
-
-type PendingFunction = {
-  name: string;
-  startLine: number;
-  bodyLines: number;
-  depth: number;
-};
-export function scanPatchForSizeSmell(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): SizeSmellFinding[] {
-  const maxFileLines = limits.maxFileLines ?? DEFAULT_MAX_FILE_LINES;
-  const maxFunctionLines = limits.maxFunctionLines ?? DEFAULT_MAX_FUNCTION_LINES;
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || isTestPath(path)) return [];
-
-  const findings: SizeSmellFinding[] = [];
-  const fileLength = estimateFileLengthFromPatch(patch);
-  if (fileLength > maxFileLines) {
-    findings.push({
-      file: path,
-      kind: "long-file",
-      measure: fileLength,
-      threshold: maxFileLines,
-    });
-    if (findings.length >= maxFindings) return findings;
-  }
-
-  let newLine = 0;
-  let inHunk = false;
-  let pending: PendingFunction | null = null;
-
-  const flushFunction = () => {
-    if (!pending) return;
-    if (pending.bodyLines > maxFunctionLines) {
-      findings.push({
-        file: path,
-        line: pending.startLine,
-        kind: "big-function",
-        measure: pending.bodyLines,
-        threshold: maxFunctionLines,
-        name: pending.name,
-      });
-    }
-    pending = null;
-  };
-
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = HUNK_RE.exec(line);
-    if (hunk) {
-      flushFunction();
-      newLine = Number(hunk[3]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS) {
-        const code = codeOnly(body);
-        if (pending) {
-          pending.bodyLines++;
-          pending.depth += braceDepthDelta(code);
-          if (pending.depth <= 0) flushFunction();
-        } else {
-          const name = functionNameFromLine(body);
-          if (name) {
-            pending = {
-              name,
-              startLine: newLine,
-              bodyLines: 1,
-              depth: braceDepthDelta(code),
-            };
-            if (pending.depth <= 0) flushFunction();
-          }
-        }
-      }
-      newLine++;
-    } else {
-      flushFunction();
-      if (!line.startsWith("-") && !line.startsWith("\\")) {
-        newLine++;
-      }
-    }
-
-    if (findings.length >= maxFindings) return findings;
-  }
-
-  flushFunction();
-  return findings;
-}
-
-/** Analyzer entrypoint: scan changed non-test files for size smells. */
-export async function scanSizeSmell(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<SizeSmellFinding[]> {
-  const findings: SizeSmellFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForSizeSmell(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+// Size-smell analyzer (#2019). Flags maintainability smells from patch structure alone: a changed file
+// whose estimated resulting length exceeds a threshold, or a newly-added function body whose brace span is
+// too long. Pure compute over diff hunks, no network. Skips test paths.
+import type { EnrichRequest, SizeSmellFinding } from "../types.js";
+import { codeOnly } from "./secret-log.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
+
+export const DEFAULT_MAX_FILE_LINES = 400;
+export const DEFAULT_MAX_FUNCTION_LINES = 60;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
+
+const HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+
+const FUNCTION_BODY_OPEN_RE =
+  /\bfunction\s+(\w+)\s*\([^)]*\)\s*\{|\b(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?(?:function\s*)?\([^)]*\)\s*=>\s*\{/;
+
+type ScanLimits = {
+  maxFileLines?: number;
+  maxFunctionLines?: number;
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Estimate the resulting file length from unified-diff hunk headers. Pure. */
+export function estimateFileLengthFromPatch(patch: string): number {
+  let maxEndLine = 0;
+  for (const line of patch.split("\n")) {
+    const hunk = HUNK_RE.exec(line);
+    if (!hunk) continue;
+    const newStart = Number(hunk[3]);
+    const newLen = hunk[4] ? Number(hunk[4]) : 1;
+    maxEndLine = Math.max(maxEndLine, newStart + newLen - 1);
+  }
+  return maxEndLine;
+}
+
+function functionNameFromLine(line: string): string | undefined {
+  const code = codeOnly(line);
+  const match = FUNCTION_BODY_OPEN_RE.exec(code);
+  if (!match) return undefined;
+  return match[1] ?? match[2];
+}
+
+function braceDepthDelta(code: string): number {
+  let depth = 0;
+  for (const ch of code) {
+    if (ch === "{") depth++;
+    else if (ch === "}") depth--;
+  }
+  return depth;
+}
+
+type PendingFunction = {
+  name: string;
+  startLine: number;
+  bodyLines: number;
+  depth: number;
+};
+export function scanPatchForSizeSmell(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): SizeSmellFinding[] {
+  const maxFileLines = limits.maxFileLines ?? DEFAULT_MAX_FILE_LINES;
+  const maxFunctionLines = limits.maxFunctionLines ?? DEFAULT_MAX_FUNCTION_LINES;
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || isTestPath(path)) return [];
+
+  const findings: SizeSmellFinding[] = [];
+  const fileLength = estimateFileLengthFromPatch(patch);
+  if (fileLength > maxFileLines) {
+    findings.push({
+      file: path,
+      kind: "long-file",
+      measure: fileLength,
+      threshold: maxFileLines,
+    });
+    if (findings.length >= maxFindings) return findings;
+  }
+
+  let newLine = 0;
+  let inHunk = false;
+  let pending: PendingFunction | null = null;
+
+  const flushFunction = () => {
+    if (!pending) return;
+    if (pending.bodyLines > maxFunctionLines) {
+      findings.push({
+        file: path,
+        line: pending.startLine,
+        kind: "big-function",
+        measure: pending.bodyLines,
+        threshold: maxFunctionLines,
+        name: pending.name,
+      });
+    }
+    pending = null;
+  };
+
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = HUNK_RE.exec(line);
+    if (hunk) {
+      flushFunction();
+      newLine = Number(hunk[3]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS) {
+        const code = codeOnly(body);
+        if (pending) {
+          pending.bodyLines++;
+          pending.depth += braceDepthDelta(code);
+          if (pending.depth <= 0) flushFunction();
+        } else {
+          const name = functionNameFromLine(body);
+          if (name) {
+            pending = {
+              name,
+              startLine: newLine,
+              bodyLines: 1,
+              depth: braceDepthDelta(code),
+            };
+            if (pending.depth <= 0) flushFunction();
+          }
+        }
+      }
+      newLine++;
+    } else {
+      flushFunction();
+      if (!line.startsWith("-") && !line.startsWith("\\")) {
+        newLine++;
+      }
+    }
+
+    if (findings.length >= maxFindings) return findings;
+  }
+
+  flushFunction();
+  return findings;
+}
+
+/** Analyzer entrypoint: scan changed non-test files for size smells. */
+export async function scanSizeSmell(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<SizeSmellFinding[]> {
+  const findings: SizeSmellFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForSizeSmell(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/src/analyzers/terminology.ts b/review-enrichment/src/analyzers/terminology.ts
index d1ad64f1ab..38b4e70425 100644
--- a/review-enrichment/src/analyzers/terminology.ts
+++ b/review-enrichment/src/analyzers/terminology.ts
@@ -6,9 +6,10 @@
 // `master` token (in `master`, `master_node`, `masterNode`, or a comment word) does. URLs are blanked first so a
 // link path segment cannot trip a finding. Line-cited via hunk headers, mirroring the sibling local analyzers.
 import type { EnrichRequest, TerminologyFinding } from "../types.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 // A bounded, in-file term → neutral-suggestion table (self-host operators can read the whole policy here). Keys
 // are the lowercased TOKENS the tokenizer produces. A key matches whenever it appears as a WHOLE token after
diff --git a/review-enrichment/src/analyzers/todo-marker.ts b/review-enrichment/src/analyzers/todo-marker.ts
index 63a394ec91..41a5609385 100644
--- a/review-enrichment/src/analyzers/todo-marker.ts
+++ b/review-enrichment/src/analyzers/todo-marker.ts
@@ -10,9 +10,10 @@
 // anchors on the leading `*`. Line-cited via hunk headers, mirroring the sibling local analyzers.
 import type { EnrichRequest, TodoMarkerFinding } from "../types.js";
 import { codeOnly } from "./secret-log.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 const MAX_NOTE_CHARS = 120;
 
 // A comment lead-in followed by an UPPERCASE tag as a whole word, then an optional separator and the note.
diff --git a/review-enrichment/src/analyzers/unsafe-any.ts b/review-enrichment/src/analyzers/unsafe-any.ts
index 25c392b0db..5245177396 100644
--- a/review-enrichment/src/analyzers/unsafe-any.ts
+++ b/review-enrichment/src/analyzers/unsafe-any.ts
@@ -4,9 +4,10 @@
 import type { EnrichRequest, UnsafeAnyFinding } from "../types.js";
 import { codeOnly } from "./secret-log.js";
 import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS, DEFAULT_MAX_LINE_CHARS } from "./limits.js";
 
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MAX_LINE_CHARS = DEFAULT_MAX_LINE_CHARS;
 
 const TS_PATH_RE = /\.(?:tsx?|mts|cts)$/i;
 
diff --git a/review-enrichment/src/analyzers/unused-export.ts b/review-enrichment/src/analyzers/unused-export.ts
index d565042064..971b2edce3 100644
--- a/review-enrichment/src/analyzers/unused-export.ts
+++ b/review-enrichment/src/analyzers/unused-export.ts
@@ -1,250 +1,251 @@
-// Unused-export / dead-on-arrival scan (#2025). Flags exports NEWLY ADDED by the PR that have zero non-declaration
-// references anywhere in the repo — net-new public surface with no callers yet. Narrow subset of caller-impact (#1509):
-// only added direct exports, not changed/removed symbols. Parses added export declarations from the diff, checks the
-// declaring file at headSha for same-file references, then resolves external references via repo-scoped GitHub Code
-// Search on the default-branch index (injected fetch). A brand-new PR export is usually absent from that index
-// (`total_count: 0`), which is treated as dead-on-arrival once same-file uses are ruled out. Bounded symbol, search,
-// and file-fetch caps; fail-safe on missing token/headSha, bad slug, search errors, or incomplete results.
-import type {
-  AnalyzerDiagnostics,
-  EnrichRequest,
-  UnusedExportFinding,
-} from "../types.js";
-import type { AnalysisContext } from "../analysis-context.js";
-import { boundedFetchJson } from "../external-fetch.js";
-import { exportedSymbols, parseAddedExports } from "./undocumented-export.js";
-import { isTestPath } from "./test-ratio.js";
-
-const GITHUB_API = "https://api.github.com";
-const GITHUB_API_VERSION = "2022-11-28";
-const SLUG_RE = /^[A-Za-z0-9._-]+$/;
-const MAX_SYMBOLS = 10;
-const MAX_SEARCHES = 10;
-const MAX_FILE_FETCHES = 10;
-const MAX_FINDINGS = 25;
-const MIN_SYMBOL_LEN = 3;
-const MAX_FETCH_BYTES = 1_000_000;
-const MAX_SEARCH_JSON_BYTES = 256 * 1024;
-
-const SOURCE_EXTS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
-const SKIP_RE = /(?:\.d\.ts$|\.min\.|(?:^|\/)(?:dist|build|vendor)\/)/;
-
-interface ScanOptions {
-  signal?: AbortSignal;
-  analysis?: Pick<AnalysisContext, "fetchJson">;
-  diagnostics?: AnalyzerDiagnostics;
-}
-
-interface CodeSearchItem {
-  path?: string;
-}
-
-interface CodeSearchResponse {
-  total_count?: number;
-  incomplete_results?: boolean;
-  items?: CodeSearchItem[];
-}
-
-function githubHeaders(token: string, raw = false): Record<string, string> {
-  return {
-    Authorization: `Bearer ${token}`,
-    Accept: raw ? "application/vnd.github.raw" : "application/vnd.github+json",
-    "X-GitHub-Api-Version": GITHUB_API_VERSION,
-    "User-Agent": "gittensory-review-enrichment",
-  };
-}
-
-function escapeRegExp(value: string): string {
-  return value.replace(/[$.*+?^{}()|[\]\\]/g, "\\$&");
-}
-
-function isScannablePath(path: string): boolean {
-  const ext = /\.([^.]+)$/.exec(path)?.[1]?.toLowerCase();
-  return Boolean(ext && SOURCE_EXTS.has(ext) && !SKIP_RE.test(path) && !isTestPath(path));
-}
-
-/** True when `source` references `symbol` on any line other than the export declaration at `declLine` (1-based). */
-export function referencesSymbolInSource(
-  source: string,
-  symbol: string,
-  declLine: number,
-): boolean {
-  const refRe = new RegExp(`(?<![A-Za-z0-9_$])${escapeRegExp(symbol)}(?![A-Za-z0-9_$])`);
-  const lines = source.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    if (i === declLine - 1) continue;
-    if (refRe.test(lines[i]!)) return true;
-  }
-  return false;
-}
-
-/** True when default-branch Code Search shows no external references: zero indexed hits (typical for a brand-new PR
- *  export) or exactly one hit confined to the declaring file. Returns null when the response is unusable. */
-export function isDeadOnArrivalFromSearch(
-  exportFile: string,
-  response: CodeSearchResponse | null,
-): boolean | null {
-  if (!response || response.incomplete_results) return null;
-  const total = response.total_count ?? 0;
-  if (total === 0) return true;
-  const items = response.items ?? [];
-  if (items.some((item) => item.path && item.path !== exportFile)) return false;
-  return total === 1;
-}
-
-async function readBoundedText(resp: Response, signal?: AbortSignal): Promise<string | null> {
-  const length = Number(resp.headers.get("content-length"));
-  if (Number.isFinite(length) && length > MAX_FETCH_BYTES) return null;
-  if (!resp.body) return null;
-  const reader = resp.body.getReader();
-  const decoder = new TextDecoder();
-  let size = 0;
-  let text = "";
-  try {
-    while (true) {
-      if (signal?.aborted) return null;
-      const { done, value } = await reader.read();
-      if (done) break;
-      size += value.byteLength;
-      if (size > MAX_FETCH_BYTES) {
-        await reader.cancel();
-        return null;
-      }
-      text += decoder.decode(value, { stream: true });
-    }
-    text += decoder.decode();
-    return text;
-  } finally {
-    reader.releaseLock();
-  }
-}
-
-async function fetchFileAtHead(
-  owner: string,
-  repo: string,
-  path: string,
-  headSha: string,
-  token: string,
-  fetchImpl: typeof fetch,
-  signal: AbortSignal | undefined,
-): Promise<string | null> {
-  try {
-    const encoded = path.split("/").map(encodeURIComponent).join("/");
-    const resp = await fetchImpl(
-      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encoded}?ref=${encodeURIComponent(headSha)}`,
-      { headers: githubHeaders(token, true), signal },
-    );
-    if (!resp.ok) return null;
-    return await readBoundedText(resp, signal);
-  } catch {
-    return null;
-  }
-}
-
-async function searchSymbolReferences(
-  owner: string,
-  repo: string,
-  symbol: string,
-  token: string,
-  fetchImpl: typeof fetch,
-  options: ScanOptions,
-): Promise<CodeSearchResponse | null> {
-  const q = `"${symbol}" repo:${owner}/${repo}`;
-  const url = `${GITHUB_API}/search/code?q=${encodeURIComponent(q)}&per_page=100`;
-  const fetchOptions = {
-    endpointCategory: "github-code-search",
-    headers: githubHeaders(token),
-    signal: options.signal,
-    fetchImpl,
-    diagnostics: options.diagnostics,
-    phase: "unused-export",
-    subcall: "code-search",
-    maxBytes: MAX_SEARCH_JSON_BYTES,
-    maxCallsPerCategory: MAX_SEARCHES,
-  };
-  const response = options.analysis
-    ? await options.analysis.fetchJson<CodeSearchResponse>(url, fetchOptions)
-    : await boundedFetchJson<CodeSearchResponse>(url, fetchOptions);
-  return response.ok ? response.data : null;
-}
-
-/** Analyzer entrypoint: parse added direct exports from changed source files and flag symbols with no non-declaration
- *  references. Fail-safe — returns no finding on missing token/headSha or search/fetch errors. */
-export async function scanUnusedExport(
-  req: EnrichRequest,
-  fetchFn: typeof fetch = fetch,
-  options: ScanOptions = {},
-): Promise<UnusedExportFinding[]> {
-  const { repoFullName, githubToken, headSha, files = [] } = req;
-  if (!githubToken || !headSha) return [];
-  const parts = repoFullName.split("/");
-  const [owner, repo] = parts;
-  if (parts.length !== 2 || !owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
-
-  const candidates: Array<{ file: string; symbol: string; line: number }> = [];
-  for (const file of files) {
-    if (!file.patch || !isScannablePath(file.path)) continue;
-    for (const { symbol, newLine } of parseAddedExports(file.patch)) {
-      if (symbol.length < MIN_SYMBOL_LEN) continue;
-      candidates.push({ file: file.path, symbol, line: newLine });
-      if (candidates.length >= MAX_SYMBOLS) break;
-    }
-    if (candidates.length >= MAX_SYMBOLS) break;
-  }
-  if (!candidates.length) return [];
-
-  const fileCache = new Map<string, string | null>();
-  let fileFetches = 0;
-  const loadFile = async (path: string): Promise<string | null> => {
-    if (fileCache.has(path)) return fileCache.get(path) ?? null;
-    if (fileFetches >= MAX_FILE_FETCHES) {
-      fileCache.set(path, null);
-      return null;
-    }
-    fileFetches += 1;
-    const content = await fetchFileAtHead(owner, repo, path, headSha, githubToken, fetchFn, options.signal);
-    fileCache.set(path, content);
-    return content;
-  };
-
-  const findings: UnusedExportFinding[] = [];
-  let searches = 0;
-  for (const candidate of candidates) {
-    if (options.signal?.aborted) break;
-    if (searches >= MAX_SEARCHES) break;
-
-    const content = await loadFile(candidate.file);
-    if (content) {
-      const idx = candidate.line - 1;
-      const line = content.split("\n")[idx];
-      if (line !== undefined && !exportedSymbols(line).includes(candidate.symbol)) continue;
-      if (referencesSymbolInSource(content, candidate.symbol, candidate.line)) continue;
-    }
-
-    let response: CodeSearchResponse | null = null;
-    try {
-      response = await searchSymbolReferences(
-        owner,
-        repo,
-        candidate.symbol,
-        githubToken,
-        fetchFn,
-        options,
-      );
-    } catch {
-      response = null;
-    }
-    searches += 1;
-    if (response === null) continue;
-
-    const dead = isDeadOnArrivalFromSearch(candidate.file, response);
-    if (dead !== true) continue;
-    findings.push({
-      file: candidate.file,
-      line: candidate.line,
-      symbol: candidate.symbol,
-    });
-    if (findings.length >= MAX_FINDINGS) break;
-  }
-  return findings;
-}
+// Unused-export / dead-on-arrival scan (#2025). Flags exports NEWLY ADDED by the PR that have zero non-declaration
+// references anywhere in the repo — net-new public surface with no callers yet. Narrow subset of caller-impact (#1509):
+// only added direct exports, not changed/removed symbols. Parses added export declarations from the diff, checks the
+// declaring file at headSha for same-file references, then resolves external references via repo-scoped GitHub Code
+// Search on the default-branch index (injected fetch). A brand-new PR export is usually absent from that index
+// (`total_count: 0`), which is treated as dead-on-arrival once same-file uses are ruled out. Bounded symbol, search,
+// and file-fetch caps; fail-safe on missing token/headSha, bad slug, search errors, or incomplete results.
+import type {
+  AnalyzerDiagnostics,
+  EnrichRequest,
+  UnusedExportFinding,
+} from "../types.js";
+import type { AnalysisContext } from "../analysis-context.js";
+import { boundedFetchJson } from "../external-fetch.js";
+import { exportedSymbols, parseAddedExports } from "./undocumented-export.js";
+import { isTestPath } from "./test-ratio.js";
+import { DEFAULT_MAX_FINDINGS } from "./limits.js";
+
+const GITHUB_API = "https://api.github.com";
+const GITHUB_API_VERSION = "2022-11-28";
+const SLUG_RE = /^[A-Za-z0-9._-]+$/;
+const MAX_SYMBOLS = 10;
+const MAX_SEARCHES = 10;
+const MAX_FILE_FETCHES = 10;
+const MAX_FINDINGS = DEFAULT_MAX_FINDINGS;
+const MIN_SYMBOL_LEN = 3;
+const MAX_FETCH_BYTES = 1_000_000;
+const MAX_SEARCH_JSON_BYTES = 256 * 1024;
+
+const SOURCE_EXTS = new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]);
+const SKIP_RE = /(?:\.d\.ts$|\.min\.|(?:^|\/)(?:dist|build|vendor)\/)/;
+
+interface ScanOptions {
+  signal?: AbortSignal;
+  analysis?: Pick<AnalysisContext, "fetchJson">;
+  diagnostics?: AnalyzerDiagnostics;
+}
+
+interface CodeSearchItem {
+  path?: string;
+}
+
+interface CodeSearchResponse {
+  total_count?: number;
+  incomplete_results?: boolean;
+  items?: CodeSearchItem[];
+}
+
+function githubHeaders(token: string, raw = false): Record<string, string> {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: raw ? "application/vnd.github.raw" : "application/vnd.github+json",
+    "X-GitHub-Api-Version": GITHUB_API_VERSION,
+    "User-Agent": "gittensory-review-enrichment",
+  };
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[$.*+?^{}()|[\]\\]/g, "\\$&");
+}
+
+function isScannablePath(path: string): boolean {
+  const ext = /\.([^.]+)$/.exec(path)?.[1]?.toLowerCase();
+  return Boolean(ext && SOURCE_EXTS.has(ext) && !SKIP_RE.test(path) && !isTestPath(path));
+}
+
+/** True when `source` references `symbol` on any line other than the export declaration at `declLine` (1-based). */
+export function referencesSymbolInSource(
+  source: string,
+  symbol: string,
+  declLine: number,
+): boolean {
+  const refRe = new RegExp(`(?<![A-Za-z0-9_$])${escapeRegExp(symbol)}(?![A-Za-z0-9_$])`);
+  const lines = source.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (i === declLine - 1) continue;
+    if (refRe.test(lines[i]!)) return true;
+  }
+  return false;
+}
+
+/** True when default-branch Code Search shows no external references: zero indexed hits (typical for a brand-new PR
+ *  export) or exactly one hit confined to the declaring file. Returns null when the response is unusable. */
+export function isDeadOnArrivalFromSearch(
+  exportFile: string,
+  response: CodeSearchResponse | null,
+): boolean | null {
+  if (!response || response.incomplete_results) return null;
+  const total = response.total_count ?? 0;
+  if (total === 0) return true;
+  const items = response.items ?? [];
+  if (items.some((item) => item.path && item.path !== exportFile)) return false;
+  return total === 1;
+}
+
+async function readBoundedText(resp: Response, signal?: AbortSignal): Promise<string | null> {
+  const length = Number(resp.headers.get("content-length"));
+  if (Number.isFinite(length) && length > MAX_FETCH_BYTES) return null;
+  if (!resp.body) return null;
+  const reader = resp.body.getReader();
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = "";
+  try {
+    while (true) {
+      if (signal?.aborted) return null;
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_FETCH_BYTES) {
+        await reader.cancel();
+        return null;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+async function fetchFileAtHead(
+  owner: string,
+  repo: string,
+  path: string,
+  headSha: string,
+  token: string,
+  fetchImpl: typeof fetch,
+  signal: AbortSignal | undefined,
+): Promise<string | null> {
+  try {
+    const encoded = path.split("/").map(encodeURIComponent).join("/");
+    const resp = await fetchImpl(
+      `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encoded}?ref=${encodeURIComponent(headSha)}`,
+      { headers: githubHeaders(token, true), signal },
+    );
+    if (!resp.ok) return null;
+    return await readBoundedText(resp, signal);
+  } catch {
+    return null;
+  }
+}
+
+async function searchSymbolReferences(
+  owner: string,
+  repo: string,
+  symbol: string,
+  token: string,
+  fetchImpl: typeof fetch,
+  options: ScanOptions,
+): Promise<CodeSearchResponse | null> {
+  const q = `"${symbol}" repo:${owner}/${repo}`;
+  const url = `${GITHUB_API}/search/code?q=${encodeURIComponent(q)}&per_page=100`;
+  const fetchOptions = {
+    endpointCategory: "github-code-search",
+    headers: githubHeaders(token),
+    signal: options.signal,
+    fetchImpl,
+    diagnostics: options.diagnostics,
+    phase: "unused-export",
+    subcall: "code-search",
+    maxBytes: MAX_SEARCH_JSON_BYTES,
+    maxCallsPerCategory: MAX_SEARCHES,
+  };
+  const response = options.analysis
+    ? await options.analysis.fetchJson<CodeSearchResponse>(url, fetchOptions)
+    : await boundedFetchJson<CodeSearchResponse>(url, fetchOptions);
+  return response.ok ? response.data : null;
+}
+
+/** Analyzer entrypoint: parse added direct exports from changed source files and flag symbols with no non-declaration
+ *  references. Fail-safe — returns no finding on missing token/headSha or search/fetch errors. */
+export async function scanUnusedExport(
+  req: EnrichRequest,
+  fetchFn: typeof fetch = fetch,
+  options: ScanOptions = {},
+): Promise<UnusedExportFinding[]> {
+  const { repoFullName, githubToken, headSha, files = [] } = req;
+  if (!githubToken || !headSha) return [];
+  const parts = repoFullName.split("/");
+  const [owner, repo] = parts;
+  if (parts.length !== 2 || !owner || !repo || !SLUG_RE.test(owner) || !SLUG_RE.test(repo)) return [];
+
+  const candidates: Array<{ file: string; symbol: string; line: number }> = [];
+  for (const file of files) {
+    if (!file.patch || !isScannablePath(file.path)) continue;
+    for (const { symbol, newLine } of parseAddedExports(file.patch)) {
+      if (symbol.length < MIN_SYMBOL_LEN) continue;
+      candidates.push({ file: file.path, symbol, line: newLine });
+      if (candidates.length >= MAX_SYMBOLS) break;
+    }
+    if (candidates.length >= MAX_SYMBOLS) break;
+  }
+  if (!candidates.length) return [];
+
+  const fileCache = new Map<string, string | null>();
+  let fileFetches = 0;
+  const loadFile = async (path: string): Promise<string | null> => {
+    if (fileCache.has(path)) return fileCache.get(path) ?? null;
+    if (fileFetches >= MAX_FILE_FETCHES) {
+      fileCache.set(path, null);
+      return null;
+    }
+    fileFetches += 1;
+    const content = await fetchFileAtHead(owner, repo, path, headSha, githubToken, fetchFn, options.signal);
+    fileCache.set(path, content);
+    return content;
+  };
+
+  const findings: UnusedExportFinding[] = [];
+  let searches = 0;
+  for (const candidate of candidates) {
+    if (options.signal?.aborted) break;
+    if (searches >= MAX_SEARCHES) break;
+
+    const content = await loadFile(candidate.file);
+    if (content) {
+      const idx = candidate.line - 1;
+      const line = content.split("\n")[idx];
+      if (line !== undefined && !exportedSymbols(line).includes(candidate.symbol)) continue;
+      if (referencesSymbolInSource(content, candidate.symbol, candidate.line)) continue;
+    }
+
+    let response: CodeSearchResponse | null = null;
+    try {
+      response = await searchSymbolReferences(
+        owner,
+        repo,
+        candidate.symbol,
+        githubToken,
+        fetchFn,
+        options,
+      );
+    } catch {
+      response = null;
+    }
+    searches += 1;
+    if (response === null) continue;
+
+    const dead = isDeadOnArrivalFromSearch(candidate.file, response);
+    if (dead !== true) continue;
+    findings.push({
+      file: candidate.file,
+      line: candidate.line,
+      symbol: candidate.symbol,
+    });
+    if (findings.length >= MAX_FINDINGS) break;
+  }
+  return findings;
+}