up

src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptions.cs

@@ -201,5 +201,11 @@ public sealed class ScannerWorkerOptions
         /// If true, trims noisy log fields (duration, PIDs) to stable placeholders.
         /// </summary>
         public bool FilterLogs { get; set; }
+
+        /// <summary>
+        /// Optional hard cap for in-flight jobs to keep replay runs hermetic.
+        /// When set, the worker will clamp MaxConcurrentJobs to this value.
+        /// </summary>
+        public int? ConcurrencyLimit { get; set; }
     }
 }

src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptionsValidator.cs

@@ -13,11 +13,19 @@ public sealed class ScannerWorkerOptionsValidator : IValidateOptions<ScannerWork
 
         var failures = new List<string>();
 
-        if (options.MaxConcurrentJobs <= 0)
-        {
-            failures.Add("Scanner.Worker:MaxConcurrentJobs must be greater than zero.");
-        }
-
+        if (options.MaxConcurrentJobs <= 0)
+        {
+            failures.Add("Scanner.Worker:MaxConcurrentJobs must be greater than zero.");
+        }
+
+        if (options.Determinism.ConcurrencyLimit is { } limit)
+        {
+            if (limit <= 0)
+            {
+                failures.Add("Scanner.Worker:Determinism:ConcurrencyLimit must be greater than zero when provided.");
+            }
+        }
+
         if (options.Queue.HeartbeatSafetyFactor < 3.0)
         {
             failures.Add("Scanner.Worker:Queue:HeartbeatSafetyFactor must be at least 3.");

src/Scanner/StellaOps.Scanner.Worker/Program.cs

@@ -33,7 +33,14 @@ var builder = Host.CreateApplicationBuilder(args);
 
 builder.Services.AddOptions<ScannerWorkerOptions>()
     .BindConfiguration(ScannerWorkerOptions.SectionName)
-    .ValidateOnStart();
+    .ValidateOnStart()
+    .PostConfigure(options =>
+    {
+        if (options.Determinism.ConcurrencyLimit is { } limit && limit > 0)
+        {
+            options.MaxConcurrentJobs = Math.Min(options.MaxConcurrentJobs, limit);
+        }
+    });
 
 builder.Services.AddSingleton<IValidateOptions<ScannerWorkerOptions>, ScannerWorkerOptionsValidator>();
 var workerOptions = builder.Configuration.GetSection(ScannerWorkerOptions.SectionName).Get<ScannerWorkerOptions>() ?? new ScannerWorkerOptions();