diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 2c8224e4fa..a31c1b2616 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -11,6 +11,8 @@ chat:
 knowledge_base:
     web_search:
         enabled: true
+    learnings:
+        scope: local
 
 reviews:
     profile: assertive
@@ -61,6 +63,8 @@ reviews:
               cancellation, retry, and compatibility paths. Verify promises and errors are handled,
               existing helpers are reused, and new code introduces no `any`, unjustified double
               assertions, floating promises, duplicated helpers, or increased lint suppressions.
+              When a refactor adds early-return guards that redirect a subset of inputs to a new
+              code path, confirm the old branches for those inputs are removed or unreachable.
 
         - path: "{**/*.{test,spec}.{ts,tsx,js,jsx},**/__tests__/**}"
           instructions: >-
@@ -76,6 +80,11 @@ reviews:
               Flag tests that assert in-flight behavior only after the call completes — these cannot
               prove the behavior fires during execution. Check that describe block names match the
               actual subjects of the tests they contain.
+              For tests that assert only mock call counts, confirm a corresponding return-value
+              assertion exists; a regression that silently returns stale fallback data can satisfy
+              a call-count check. For code with fallback behavior, verify both the cold-start case
+              (no prior state) and the warm case (prior state exists) are covered, as they exercise
+              different branches.
 
         - path: "apps/vscode-e2e/**"
           instructions: >-
@@ -115,6 +124,9 @@ reviews:
               Check persistence and lifecycle invariants: awaited atomic writes, rollback or explicit
               partial-failure behavior, cross-window state consistency, stale listeners/watchers,
               cancellation, idempotency, and safe restart/resume without lost or duplicated state.
+              For async functions that read shared mutable state before an `await` and write it back
+              after, verify the captured reference is still valid when the write executes; a concurrent
+              mutation during the await can cause a stale snapshot to overwrite a newer state.
 
         - path: ".github/**"
           instructions: >-
@@ -128,8 +140,20 @@ reviews:
               during release preparation. Verify documentation describes real behavior and contracts,
               and deprioritize prose-only nits that do not affect correctness or usability.
 
+    finishing_touches:
+        docstrings:
+            enabled: false
+
     pre_merge_checks:
         override_requested_reviewers_only: true
+        docstrings:
+            mode: off
+        title:
+            mode: warning
+        description:
+            mode: warning
+        issue_assessment:
+            mode: warning
         custom_checks:
             - name: Regression evidence
               mode: warning
@@ -140,18 +164,32 @@ reviews:
                   snapshot. Do not demand tests for unchanged behavior, mechanical configuration, or every
                   branch without a plausible regression scenario. Cite the changed behavior and missing
                   evidence.
-            - name: Trust and persistence invariants
+            - name: Security boundaries
+              mode: error
+              instructions: >-
+                  Fail only when a concrete changed path leaks secrets or PII, trusts or executes
+                  unvalidated input, or bypasses approval or allowlist controls. Cite the changed path
+                  and a plausible triggering scenario; pass when no such changed path exists.
+            - name: Persistence integrity
               mode: error
               instructions: >-
-                  Fail only for a concrete changed path that leaks secrets or PII, trusts or executes
-                  unvalidated input, bypasses approval or allowlist controls, can lose persisted state due
-                  to a missing await, non-atomic write, or omitted default propagation, or leaks lifecycle
-                  resources. Cite the path and a plausible triggering scenario; pass when no such changed
-                  path exists.
+                  Fail only when a concrete changed persistence path can lose or corrupt state because an
+                  operation is not awaited, a write is non-atomic, rollback or explicit partial-failure
+                  behavior is missing, or a persisted default is not propagated to a consumer. Cite the
+                  changed path and a plausible triggering scenario; pass when no such changed path exists.
+            - name: Lifecycle resource cleanup
+              mode: error
+              instructions: >-
+                  Fail only when a concrete changed lifecycle path can leak a listener, watcher, provider,
+                  timer, task, or other resource, or can duplicate work after cancellation, disposal, or
+                  restart. Cite the changed path and a plausible triggering scenario; pass when no such
+                  changed path exists.
 
     tools:
         eslint:
             enabled: true
+        github-checks:
+            enabled: true
         actionlint:
             enabled: true
         shellcheck: