Review Inspect Feature Cleanup

I've reviewed the in-scope changes thoroughly: read the highest-risk logic (per-inspector timeout, single-writer RunMulti state, model-component matching, profile merge/persistence, codex error envelopes, synthesis sink), confirmed go build ./... is clean, and ran the review/settings/codex test packages (all green).

Review: review-profiles branch

Overview — Reworks entire review/inspect into a profile-based system: named profiles with N parallel inspectors + a single consolidating judge, stored in project/local settings; adds a per-inspector timeout, a local/trail output destination, live model enumeration, and codex error-envelope surfacing. Deletes the old migration path and most of fix.go. ~4900 LOC, exceptionally well-documented.

Findings

1. Untracked working-tree files risk being committed (actionable) Four untracked files are in scope and not gitignored:

• .pi/extensions/entire.ts — header says "Auto-generated by entire enable --agent pi… Do not edit manually". This is a local install artifact, not a source deliverable.
• prompt-default-tasks.md, prompt-inspector.md, prompt-synthesis-judge.md — dev scratch notes dropped at repo root (they just describe where prompt text lives in the Go source).

A git add -A would commit all four. Recommend deleting them or adding ignore rules before committing. None are referenced by the Go code.

2. Parent-cancel vs deadline race in RunMulti (minor / negligible) run_multi.go:252-255: st.timedOut overrides status to Failed after classifyStatus already returned Cancelled for a parent-cancelled ctx. If a user Ctrl+C races with an inspector's deadline firing and the deadline wins (waitErr == DeadlineExceeded), that agent reports "timed out" instead of "cancelled". Single-agent Run isn't affected (parent cancel surfaces as Canceled). Cosmetic, extremely rare — flagging for completeness, not blocking.

Verified sound

• Timeout flag — --timeout 0 is correctly translated to the -1 disable sentinel (cmd.go:214-217); help text "(0 disables)" matches behavior. The 3-state convention (positive/zero-default/negative-disable) in inspectorTimeout is consistent.
• Single-writer perAgentState — terminal fields routed through fanIn as a tagged marker; dispatch loop is the sole writer, post-loop reads are safe by construction. Sound.
• OnResult/aggregateOutput — SynthesisSink is a direct sink; RunFinished (and thus OnResult) runs synchronously inside RunMulti before it returns, so the read at cmd.go:1216 is not racing the deferred tuiSink.Wait(). Correct.
• modelComponentsMatch — boundary-aware matching with the numeric-suffix requirement correctly distinguishes version (sonnet→claude-sonnet-4-5) from variant (gpt-4o→gpt-4o-mini); the suffix-exclusion tradeoff is documented.
• mergeReviewProfiles — pure, non-nil, no input mutation; per-profile merge semantics match the documented intent.
• Codex --model + error envelope — failureMsg only emitted when !seenTurnComplete, so stray messages on successful runs are ignored. Correct.

No correctness regressions found in the core logic. The only thing I'd act on before committing is the four stray untracked files.