Reviewed all three caches for invalidation completeness and mutation safety — they're correct. Verified:

1. readConfig mtime cache: atomicWriteSync is only ever called from writeConfig (config.ts:540), and every save*/clear* helper persists through writeConfig, which _configCache.delete(path)s — so there's no in-process write path that leaves the cache stale. statSync sits inside the existing try, so a missing config still falls through to {} exactly as before.

2. tools() frozen snapshot: prefix.tools() has a single caller (loop.ts:708) which only reads it — passes it straight to the model-call tools field where client.ts:218 assigns it by reference and JSON-serializes it. Nothing mutates it, so neither the freeze (top-level) nor the shared function.parameters (nested) can bite today. Invalidated correctly on addTool/removeTool.

3. toFullHistory cache: every mutator invalidates — initWindow, append, compactInPlace, and extend (which delegates to append). The shallow-copy-on-return matches the pre-existing { ...e } semantics, so no new aliasing exposure versus before.

Good, well-scoped optimization. Two small asks (non-blocking, your call):

• A one-line caveat comment on each cache about the immutability contract. Cache 2's frozen copy is shallow — function.parameters is shared by reference with _toolSpecs, so a future caller that mutates a schema would silently corrupt it. A note like 'result is deeply immutable; do not mutate' guards the next person, since the type (ToolSpec[] via as unknown as) hides the readonly-ness. Consider typing it readonly ToolSpec[] so the compiler enforces it.
• readConfig external-edit caveat: the cache trusts mtimeMs, so an out-of-band edit that preserves mtime (or collides within the FS granularity) would serve stale config. Negligible on modern FS, but worth a one-line comment so it's a known tradeoff.

CI hasn't run (fork PR) — I approved the workflow. Since this touches config.ts (read on basically every frame), I'd like CI green before merging, then it's good to land.

Following up on my approval — CI came back and CodeQL flagged a high-severity alert in this PR's change, so it's not green after all. Holding until it's resolved.

CodeQL: 'Potential file system race condition' at src/config.ts:465. The new cache introduces a TOCTOU pattern:

const st = statSync(path);                       // time-of-check (mtime)
const cached = _configCache.get(path);
if (cached && cached.mtimeMs === st.mtimeMs) return cached.cfg;
const raw = readFileSync(path, "utf8")…          // time-of-use (content)

The old code read the file directly with no preceding statSync, so this pattern is new to the PR. The real-world severity here is low — it's the user's own ~/.reasonix/config.json, not a privilege boundary — but it's a legitimate finding and it's a hard CI gate, so it has to be addressed one way or the other:

• Preferred fix (removes the race): stat the same file descriptor you read, so check and use are atomic — openSync → fstatSync(fd) for mtimeMs → readSync/readFileSync(fd) → closeSync. fstat-on-fd can't race the subsequent read of that same fd. This keeps the cache-hit fast path (you'd still statSync for the hit check; only the miss path opens the fd) — or restructure so the hit check uses the fd's fstat too.
• Alternative: if you'd rather keep statSync, dismiss the CodeQL alert with an explicit justification ('config file is owned by the user, not a security boundary; stale window is bounded by mtime and self-corrects next read'). That's defensible given the context, but the fstat-on-fd version is cleaner and makes the gate pass on its own.

Everything else in my earlier review still stands — the three caches are correct and invalidation is complete. Just resolve the CodeQL finding (fix or justified dismissal) and re-run, plus the two optional immutability/caveat comments, and this is good to land.

Re-reviewed — the TOCTOU fix is exactly right: openSync → fstatSync(fd) → readFileSync(fd) → closeSync(fd) on all paths (cache-hit, post-read, error), so check and use happen on the same descriptor. CodeQL now passes (the high-severity file-race alert is gone) and full CI is green. The three caches and their invalidation were verified correct on the first pass. Merging.