@effect-agent/pr-review 0.1.0-beta.21 → 0.1.0-beta.23

package/README.md

@@ -59,21 +59,26 @@ re-validated against the parsed unified diff (invalid ones are demoted into
 the review body with the reason named, never trusted), the findings bound is
 enforced host-side, and publication happens only through the
 `ReviewPublisher` port after the run settles. `PrReview.makeFanOut` builds the
-assured delegating variant. The host deterministically partitions bounded
+assured host-scheduled variant. The host deterministically partitions bounded
 evidence, classifies high-risk units, requires a general discovery pass for
 every unit, adds a fresh specialist discovery pass for every unit, and uses
 deterministic host-classified risk categories as explicit focus labels. A
-fresh verifier must confirm or reject every discovered candidate. These are
-S1 attached ephemeral children using Effect structured concurrency. Verifiers
-receive the exact candidate claims and the complete bounded unit, including
-neighboring evidence that can falsify a locally plausible claim; they do not
-receive discovery reasoning.
-The host reconstructs publishable findings and concerns from exact confirmed
-candidate IDs, deduplicates byte-identical cross-pass claims in deterministic
-plan order, and requires every delegation declaration to be consumed by one
-exact planned request. Neither a discovery child nor the coordinator can publish
-an unsupported or invented finding. Shared `guidance` reaches both discovery
-and verification; `maxFindings` remains a host-enforced publication cap.
+fresh verifier must confirm or reject every discovered candidate. Every pass
+runs as a bounded evidence-only child dispatched directly by host code with
+Effect structured concurrency — there is no coordinator model and no
+delegation tool, so nothing depends on a model copying the plan correctly. A
+pass that fails (child fault, malformed or misdirected output) is retried
+once; a pass that stays failed is reported and its unit's paths carry forward
+as retryable scope. Verifiers receive the exact candidate claims and the
+complete bounded unit, including neighboring evidence that can falsify a
+locally plausible claim; they do not receive discovery reasoning.
+The host builds publishable findings and concerns from exact confirmed
+candidate IDs and deduplicates byte-identical cross-pass claims in
+deterministic plan order; a discovery claim anchored outside its assigned
+evidence is discarded and counted, never published and never pass-fatal. The
+summary and verdict are composed deterministically from the confirmed
+severities. Shared `guidance` reaches both discovery and verification;
+`maxFindings` remains a host-enforced publication cap.
 
 GitHub may omit the `patch` field for large textual files as well as binary
 files. The GitHub source recovers a missing patch by reading bounded, strict
@@ -81,24 +86,29 @@ UTF-8 base/head content: additions require the head, deletions require the
 base, and other changes require both. Reviewers receive that content through
 the ordinary diff-read tool with non-anchorable `B`/`H` line labels and must
 report defects as review-body concerns. Invalid UTF-8, binary NUL content,
-missing sides, files beyond the per-side read bound, and complete B/H evidence
-beyond the model-facing render bound remain explicit coverage gaps.
+missing sides, and files beyond the per-side read bound leave a path with no
+reviewable textual evidence. Such paths keep input coverage incomplete and are
+carried for as long as they are part of the pull request — an unreviewable
+change must never authorize a green check; exclude them deliberately with
+ignore globs when that is intended.
 
 ## Assurance model
 
 The public result deliberately separates two claims:
 
-- **Input coverage** says every required path in the selected scope was
-  assigned every deterministic bounded evidence shard and separately names
-  partially assigned and unassigned paths, the exact unassigned-shard count
-  with a bounded identifier sample, undiffable paths, source truncation, or
-  over-capacity paths. A large textual diff is split across
-  shards and units instead of being called partial merely for exceeding one
-  prompt chunk. Input coverage does not say the model understood the evidence.
-- **Review assurance** says every configured general discovery pass, required
-  independent specialist pass, and candidate-verification batch settled
-  exactly. It reports discovered, confirmed, rejected, and unsettled
-  candidate counts plus failed pass IDs.
+- **Input coverage** says every reviewable required path in the selected
+  scope was assigned every deterministic bounded evidence shard and
+  separately names partially assigned and over-capacity paths, the exact
+  unassigned-shard count with a bounded identifier sample, undiffable paths,
+  and source truncation. A large textual diff is split across shards and
+  units instead of being called partial merely for exceeding one prompt
+  chunk. Input coverage does not say the model understood the evidence.
+- **Review assurance** says every scheduled general discovery pass, required
+  independent specialist pass, and candidate-verification pass settled after
+  at most one retry. It reports discovered, confirmed, rejected, unsettled,
+  and discarded (invalid-anchor) candidate counts plus failed pass IDs. A
+  failed pass is a reviewer-side gap: its unit's paths carry forward as
+  retryable scope and the next incremental run re-reviews exactly them.
 
 `settled` assurance means the configured work completed; it never means the
 review is exhaustive or the pull request is defect-free. Risk classification
@@ -126,10 +136,9 @@ discovery/specialist/verification settlement, and candidate dispositions.
 Below the summary, a collapsed **📝 Walkthrough** table carries the
 model's one-sentence per-file change summaries — walkthrough paths are
 validated like finding anchors, so entries naming files outside the changeset
-are dropped. Under fan-out the walkthrough is additionally host-verified
-against the delegation Tool events: only summaries a successfully settled
-child actually reported for its own unit's paths survive, so neither a child
-nor the coordinator can smuggle or invent entries. Non-anchored `concerns`
+are dropped. Under fan-out only summaries a
+successfully settled general pass actually reported for its own unit's paths
+survive, so a child cannot smuggle or invent entries. Non-anchored `concerns`
 (deletion plans, rollout sequencing,
 coverage gaps, scope questions — things with no diff line to point at) render
 as severity-tagged sections; demoted findings and findings carried from
@@ -137,7 +146,8 @@ unchanged scope collapse into counted `<details>` sections.
 
 Each inline comment is headed by its severity plus an optional model-claimed
 category chip (`**[⚠️ important · security] …**`), carries a committable
-GitHub `suggestion` fence when the model provided one, and ends with a
+GitHub `suggestion` fence when independent verification settled the model's
+suggestion as committable replacement source, and ends with a
 collapsed **🤖 Prompt for AI agents** — a copy-paste instruction derived
 host-side from the validated finding, opening with a fixed preamble telling
 the receiving agent to treat the finding content as untrusted review data.
@@ -171,17 +181,23 @@ ordinary gate.
 
 ## Incremental Action reviews
 
-A posted Action review with complete input coverage and settled review
-assurance carries bounded, versioned, HMAC-authenticated continuity state:
-the exact PR/base/head lineage, profile and settled-scope fingerprints, and
-the still-unresolved findings and concerns. A later Action run validates the
-state and reviews the GitHub comparison from that reviewed head to the
-current head, not the complete base...HEAD diff. Unchanged settled scope is
-not sent back to the model; unchanged unresolved findings remain active;
-changed or reverted paths invalidate their prior findings and receive fresh
-discovery and verification. Non-anchored
-concerns are carried conservatively until a full audit because they cannot be
-mapped safely to one path.
+Every completed Action review that can be signed carries bounded, versioned,
+HMAC-authenticated continuity state: the exact PR/base/head lineage, profile
+and settled-scope fingerprints, the still-unresolved findings and concerns,
+any retryable unreviewed paths, and whether the run fully settled. The
+baseline is monotone by design — a flaky or failed pass carries exactly its
+own scope forward instead of freezing the baseline and reopening everything
+reviewed since (the non-converging loop of issue #131). A later Action run
+validates the state and reviews the GitHub comparison from that reviewed head
+to the current head plus the carried unreviewed paths, not the complete
+base...HEAD diff. Unchanged settled scope is not sent back to the model;
+unchanged unresolved findings remain active; changed or reverted paths
+invalidate their prior findings and receive fresh discovery and verification.
+Whole overflow files are reviewed in bounded installments across pushes
+through the same carry; a single file beyond total plan capacity and
+undiffable paths stay explicitly incomplete instead — an unreviewable tail
+never moves behind a green check. Non-anchored concerns are carried conservatively
+until a full audit because they cannot be mapped safely to one path.
 
 The state marker must be terminal, signed with the configured stable
 `PR_REVIEW_STATE_SECRET`, authored by the configured review-posting bot, and
@@ -197,11 +213,12 @@ full unless the authenticated settled-scope fingerprint still matches. The
 schema field retains the compatibility name `acceptedScopeFingerprint`. That
 fingerprint hashes the ignore-filtered effective diff, patchless base/head
 evidence, PR framing, and review-shaping profile while excluding commit IDs,
-base ancestry, and unified-diff hunk coordinates. Re-running the same settled
-head or a patch-equivalent rebase skips model execution by default while
-preserving its stored blocking/success conclusion and posting no duplicate
-review comments. Missing/corrupt state and any fingerprint or profile mismatch
-review conservatively.
+base ancestry, and unified-diff hunk coordinates. Re-running the same head or a
+patch-equivalent rebase skips model execution by default ONLY when the stored
+state fully settled — a state carrying unreviewed scope is always retried.
+The preserved skip keeps its stored blocking/success conclusion and posts no
+duplicate review comments. Missing/corrupt state and any fingerprint or
+profile mismatch review conservatively.
 
 After a new state-bearing Action review posts, prior marker-bearing bot reviews
 are retired by default: their bodies become collapsed, superseded history,

package/dist/action.d.mts

@@ -1,11 +1,8 @@
-import { Nt as ReviewRetirementHost, Sr as ChangedFile, St as ReviewPublisher, Zt as ReviewMode, _r as PullRequestMetadata, _t as GitHubApiFailure, bt as PriorReviews, nn as ReviewStateAuthenticator, vr as PullRequestSource, yr as PullRequestSourceFailure } from "./fan-out-D5xrmadQ.mjs";
+import { L as PriorReviews, P as GitHubApiFailure, X as ReviewRetirementHost, ar as PullRequestSource, bt as ReviewStateAuthenticator, ht as ReviewMode, ir as PullRequestMetadata, lr as ChangedFile, or as PullRequestSourceFailure, z as ReviewPublisher } from "./fan-out-BJBTAYuh.mjs";
 import { EffortPosition, InvalidEffortInput, ReviewProgressReporter, ReviewProvider, ReviewRunOutcome, ReviewTargetUnresolved, RunReviewOptions } from "./index.mjs";
 import { Config, Effect, FileSystem, Schema } from "effect";
 import { BudgetExceeded } from "effect-agent";
 //#region src/action.d.ts
-/** Deprecated compatibility input; host-derived conclusions are unconditional. */
-declare const FailOnPolicy: Schema.Literals<readonly ["never", "request-changes"]>;
-type FailOnPolicy = typeof FailOnPolicy.Type;
 declare const ReviewCheckConclusion: Schema.Literals<readonly ["success", "blocking", "incomplete"]>;
 type ReviewCheckConclusion = typeof ReviewCheckConclusion.Type;
 declare const ReviewGateFailed_base: Schema.Class<ReviewGateFailed, Schema.TaggedStruct<"ReviewGateFailed", {
@@ -37,8 +34,6 @@ interface ResolvedActionInputs {
   readonly maxFindings: number | undefined;
   readonly maxDurationMinutes: number | undefined;
   readonly reviewMode: ReviewMode;
-  /** Deprecated compatibility input; conclusions are always conservative. */
-  readonly failOn: FailOnPolicy;
   readonly skipUnchanged: boolean;
   readonly retireStaleReviews: boolean;
   readonly progressComment: boolean;
@@ -57,7 +52,6 @@ declare const resolveActionInputs: () => Effect.Effect<{
   maxFindings: number | undefined;
   maxDurationMinutes: number | undefined;
   reviewMode: "final" | "incremental";
-  failOn: "never" | "request-changes";
   skipUnchanged: boolean;
   retireStaleReviews: boolean;
   progressComment: boolean;
@@ -113,7 +107,15 @@ interface HarnessedReviewer<E, R, FingerprintE, FingerprintR> {
   }, FingerprintE, FingerprintR> | undefined;
   readonly filterFiles?: ((files: ReadonlyArray<ChangedFile>) => ReadonlyArray<ChangedFile>) | undefined;
 }
-/** Host-derived check conclusion; model verdict prose cannot weaken it. */
+/**
+ * Host-derived check conclusion; model verdict prose cannot weaken it.
+ *
+ * Blocking code findings outrank machinery gaps — they are the actionable
+ * signal. A machinery gap (incomplete input, unsettled passes) concludes
+ * `incomplete` with reasons that explicitly say the failure is reviewer-side
+ * uncertainty carried forward for retry, never an invitation to change code.
+ * The flat reviewer's constant `unverified` assurance is not a gap.
+ */
 declare const concludeReviewOutcome: (outcome: ReviewRunOutcome) => {
   readonly conclusion: ReviewCheckConclusion;
   readonly reasons: ReadonlyArray<string>;
@@ -129,7 +131,6 @@ declare const concludeReviewOutcome: (outcome: ReviewRunOutcome) => {
  */
 declare const runReviewAction: <E, R, FingerprintE = never, FingerprintR = never>(reviewer: HarnessedReviewer<E, R, FingerprintE, FingerprintR>, options?: {
   readonly post?: boolean | undefined;
-  readonly failOn?: FailOnPolicy | undefined;
   /** Skip model execution when the current head already has complete stored coverage. */
   readonly skipUnchanged?: boolean | undefined;
   /** Incremental by default; `final` deliberately re-reviews the full PR diff. */
@@ -165,7 +166,7 @@ declare const reviewActionProgram: Effect.Effect<{
 } | {
   _tag: "Completed";
   outcome: ReviewRunOutcome;
-}, import("effect-agent").AgentApprovalDenied | import("effect-agent").AgentApprovalPending | import("effect-agent").AgentChildPending | import("effect-agent").AgentInputError | import("effect-agent").AgentOutputError | import("effect-agent").AgentPolicyError | import("effect/unstable/ai/AiError").AiError | import("effect-agent").BudgetAdapterError | BudgetExceeded | Config.ConfigError | import("effect-agent").ContextOverflowError | GitHubApiFailure | GuidanceFileUnreadable | InvalidEffortInput | InvalidMaxDurationInput | import("effect-agent").ModelProtocolError | import("effect/PlatformError").PlatformError | PullRequestSourceFailure | ReviewGateFailed | ReviewTargetUnresolved | Schema.SchemaError, FileSystem.FileSystem | import("effect/unstable/http/HttpClient").HttpClient>;
+}, import("effect-agent").AgentApprovalDenied | import("effect-agent").AgentApprovalPending | import("effect-agent").AgentChildPending | import("effect-agent").AgentInputError | import("effect-agent").AgentOutputError | import("effect-agent").AgentPolicyError | import("effect-agent").AgentToolAuthorizationDenied | import("effect/unstable/ai/AiError").AiError | import("effect-agent").BudgetAdapterError | BudgetExceeded | Config.ConfigError | import("effect-agent").ContextOverflowError | GitHubApiFailure | GuidanceFileUnreadable | InvalidEffortInput | InvalidMaxDurationInput | import("effect-agent").ModelProtocolError | import("effect/PlatformError").PlatformError | PullRequestSourceFailure | ReviewGateFailed | ReviewTargetUnresolved | Schema.SchemaError, FileSystem.FileSystem | import("effect/unstable/http/HttpClient").HttpClient>;
 /** Run the packaged action program on Node; the bundled action entrypoint. */
 declare const main: () => void;
 /** The packaged GitHub Actions surface. */
@@ -183,7 +184,6 @@ declare const PrReviewAction: {
     maxFindings: number | undefined;
     maxDurationMinutes: number | undefined;
     reviewMode: "final" | "incremental";
-    failOn: "never" | "request-changes";
     skipUnchanged: boolean;
     retireStaleReviews: boolean;
     progressComment: boolean;
@@ -195,9 +195,9 @@ declare const PrReviewAction: {
   } | {
     _tag: "Completed";
     outcome: ReviewRunOutcome;
-  }, import("effect-agent").AgentApprovalDenied | import("effect-agent").AgentApprovalPending | import("effect-agent").AgentChildPending | import("effect-agent").AgentInputError | import("effect-agent").AgentOutputError | import("effect-agent").AgentPolicyError | import("effect/unstable/ai/AiError").AiError | import("effect-agent").BudgetAdapterError | BudgetExceeded | Config.ConfigError | import("effect-agent").ContextOverflowError | GitHubApiFailure | GuidanceFileUnreadable | InvalidEffortInput | InvalidMaxDurationInput | import("effect-agent").ModelProtocolError | import("effect/PlatformError").PlatformError | PullRequestSourceFailure | ReviewGateFailed | ReviewTargetUnresolved | Schema.SchemaError, FileSystem.FileSystem | import("effect/unstable/http/HttpClient").HttpClient>;
+  }, import("effect-agent").AgentApprovalDenied | import("effect-agent").AgentApprovalPending | import("effect-agent").AgentChildPending | import("effect-agent").AgentInputError | import("effect-agent").AgentOutputError | import("effect-agent").AgentPolicyError | import("effect-agent").AgentToolAuthorizationDenied | import("effect/unstable/ai/AiError").AiError | import("effect-agent").BudgetAdapterError | BudgetExceeded | Config.ConfigError | import("effect-agent").ContextOverflowError | GitHubApiFailure | GuidanceFileUnreadable | InvalidEffortInput | InvalidMaxDurationInput | import("effect-agent").ModelProtocolError | import("effect/PlatformError").PlatformError | PullRequestSourceFailure | ReviewGateFailed | ReviewTargetUnresolved | Schema.SchemaError, FileSystem.FileSystem | import("effect/unstable/http/HttpClient").HttpClient>;
   readonly main: typeof main;
 };
 //#endregion
-export { FailOnPolicy, GuidanceFileUnreadable, HarnessedReviewer, InvalidMaxDurationInput, MAX_GUIDANCE_FILE_CHARS, PrReviewAction, ResolvedActionInputs, ReviewActionResult, ReviewCheckConclusion, ReviewGateFailed, concludeReviewOutcome, main, resolveActionInputs, resolveGuidance, reviewActionProgram, runReviewAction, writeActionOutputs, writeStepSummary };
+export { GuidanceFileUnreadable, HarnessedReviewer, InvalidMaxDurationInput, MAX_GUIDANCE_FILE_CHARS, PrReviewAction, ResolvedActionInputs, ReviewActionResult, ReviewCheckConclusion, ReviewGateFailed, concludeReviewOutcome, main, resolveActionInputs, resolveGuidance, reviewActionProgram, runReviewAction, writeActionOutputs, writeStepSummary };
 //# sourceMappingURL=action.d.mts.map

package/dist/action.mjs

@@ -1,13 +1,11 @@
-import { A as ReviewStateAuthenticator, B as selectedPullRequestSourceLayer, G as webCryptoReviewStateAuthenticatorLayer, Jn as PullRequestSource, T as ReviewHeadComparison, U as unavailableReviewStateAuthenticatorLayer, W as validateReviewState, Zn as normalizeRepoRelativePath, a as PriorReviews, w as ReviewExecutionContext, x as retireStaleReviews, z as selectReviewRange } from "./github-DSqZp3Ce.mjs";
-import { C as PrReview, O as fanOutReviewBudgetLimits, U as parseEffortPosition, V as InvalidEffortInput, a as anthropicClientLayer, c as makeOpenAiReviewModel, f as gitHubReviewLayers, g as ReviewProgressReporter, k as reviewBudgetLimits, l as openAiClientLayer, m as resolveReviewTarget, n as DEFAULT_PROVIDER, o as describeReviewModel, p as readGitHubEvent, s as makeAnthropicReviewModel } from "./providers-CblG1G9b.mjs";
+import { B as selectReviewRange, E as ReviewHeadComparison, G as validateReviewState, K as webCryptoReviewStateAuthenticatorLayer, Kn as normalizeRepoRelativePath, T as ReviewExecutionContext, Un as PullRequestSource, V as selectedPullRequestSourceLayer, W as unavailableReviewStateAuthenticatorLayer, a as PriorReviews, j as ReviewStateAuthenticator, x as retireStaleReviews } from "./github-BbwYzNrC.mjs";
+import { A as reviewBudgetLimits, C as PrReview, H as InvalidEffortInput, W as parseEffortPosition, a as anthropicClientLayer, c as makeOpenAiReviewModel, f as gitHubReviewLayers, g as ReviewProgressReporter, k as fanOutReviewBudgetLimits, l as openAiClientLayer, m as resolveReviewTarget, n as DEFAULT_PROVIDER, o as describeReviewModel, p as readGitHubEvent, s as makeAnthropicReviewModel } from "./providers-NyP-4rS6.mjs";
 import { n as compactReviewLoggingLayer } from "./logging-Q4j0oub-.mjs";
 import { Config, Console, Effect, FileSystem, Layer, Option, Redacted, Schema } from "effect";
 import { BudgetExceeded, UsageBudgetLimits } from "effect-agent";
 import { FetchHttpClient } from "effect/unstable/http";
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
 //#region src/action.ts
-/** Deprecated compatibility input; host-derived conclusions are unconditional. */
-const FailOnPolicy = Schema.Literals(["never", "request-changes"]);
 const ReviewCheckConclusion = Schema.Literals([
 	"success",
 	"blocking",
@@ -48,7 +46,6 @@ const resolveActionInputs = Effect.fn("resolveActionInputs")(function* () {
 	const ignoreRaw = yield* Config.string("PR_REVIEW_IGNORE").pipe(Config.withDefault(""));
 	const maxFindings = yield* Config.option(Config.int("PR_REVIEW_MAX_FINDINGS"));
 	const reviewMode = yield* Config.literals(["incremental", "final"], "PR_REVIEW_MODE").pipe(Config.withDefault("incremental"));
-	const failOn = yield* Config.literals(["never", "request-changes"], "PR_REVIEW_FAIL_ON").pipe(Config.withDefault("never"));
 	const skipUnchanged = yield* Config.boolean("PR_REVIEW_SKIP_UNCHANGED").pipe(Config.withDefault(true));
 	const retireStaleReviews = yield* Config.boolean("PR_REVIEW_RETIRE_STALE_REVIEWS").pipe(Config.withDefault(true));
 	const progressComment = yield* Config.boolean("PR_REVIEW_PROGRESS_COMMENT").pipe(Config.withDefault(true));
@@ -65,7 +62,6 @@ const resolveActionInputs = Effect.fn("resolveActionInputs")(function* () {
 		maxFindings: Option.getOrUndefined(maxFindings),
 		maxDurationMinutes,
 		reviewMode,
-		failOn,
 		skipUnchanged,
 		retireStaleReviews,
 		progressComment
@@ -137,6 +133,7 @@ const outcomeOutputs = (outcome, conclusion) => [
 	["inline-comments", String(outcome.plan.comments.length)],
 	["demoted-findings", String(outcome.plan.demoted.length)],
 	["concerns", String(outcome.review.concerns?.length ?? 0)],
+	["unreviewed-paths", String(outcome.unreviewedPaths.length)],
 	...outcome.usage === void 0 ? [] : [["input-tokens", String(outcome.usage.inputTokens)], ["output-tokens", String(outcome.usage.outputTokens)]],
 	["review-url", outcome.published?.url ?? ""]
 ];
@@ -147,8 +144,9 @@ const outcomeSummary = (outcome, modelLabel, conclusion) => [
 	`- Input coverage: **${outcome.inputCoverage.status}** · scope: ${outcome.reviewMode ?? "full"}`,
 	`- Review assurance: **${outcome.assurance.status}** · general discovery ${outcome.assurance.completedGeneralDiscoveryPasses}/${outcome.assurance.requiredGeneralDiscoveryPasses} · specialist ${outcome.assurance.completedSpecialistPasses}/${outcome.assurance.requiredSpecialistPasses} · verification ${outcome.assurance.completedVerificationPasses}/${outcome.assurance.requiredVerificationPasses}`,
 	`- Inline comments: ${outcome.plan.comments.length} · demoted findings: ${outcome.plan.demoted.length} · concerns: ${outcome.review.concerns?.length ?? 0}`,
+	...outcome.unreviewedPaths.length === 0 ? [] : [`- Carried forward: ${outcome.unreviewedPaths.length} unreviewed path(s) retried automatically on the next run (reviewer-side gap, not a code defect)`],
 	...modelLabel === void 0 ? [] : [`- Model: \`${modelLabel}\``],
-	...outcome.usage === void 0 ? [] : [`- Tokens: ${outcome.usage.inputTokens} in / ${outcome.usage.outputTokens} out${outcome.usageScope === "coordinator" ? " (coordinator)" : ""}`],
+	...outcome.usage === void 0 ? [] : [`- Tokens: ${outcome.usage.inputTokens} in / ${outcome.usage.outputTokens} out`],
 	...outcome.published === void 0 ? ["- Dry run: nothing posted"] : [`- Posted: ${outcome.published.url}`]
 ];
 const skip = (reason) => Effect.gen(function* () {
@@ -168,26 +166,37 @@ const resolveRunUrl = Effect.fn("resolveRunUrl")(function* () {
 	return `${yield* Config.string("GITHUB_SERVER_URL").pipe(Config.withDefault("https://github.com"))}/${repository}/actions/runs/${runId}`;
 });
 const blockingReasons = (input) => [...input.findings.filter((finding) => finding.severity === "blocking").map((finding) => `blocking finding: ${finding.title}`), ...input.concerns.filter((concern) => concern.severity === "blocking").map((concern) => `blocking concern: ${concern.title}`)];
-/** Host-derived check conclusion; model verdict prose cannot weaken it. */
+/**
+* Host-derived check conclusion; model verdict prose cannot weaken it.
+*
+* Blocking code findings outrank machinery gaps — they are the actionable
+* signal. A machinery gap (incomplete input, unsettled passes) concludes
+* `incomplete` with reasons that explicitly say the failure is reviewer-side
+* uncertainty carried forward for retry, never an invitation to change code.
+* The flat reviewer's constant `unverified` assurance is not a gap.
+*/
 const concludeReviewOutcome = (outcome) => {
-	if (outcome.inputCoverage.status === "incomplete") return {
-		conclusion: "incomplete",
-		reasons: outcome.inputCoverage.reasons
-	};
-	if (outcome.assurance.status !== "settled") return {
-		conclusion: "incomplete",
-		reasons: outcome.assurance.reasons.length > 0 ? outcome.assurance.reasons : ["configured discovery and verification work did not settle"]
-	};
-	const reasons = blockingReasons({
+	const machinery = [];
+	if (outcome.inputCoverage.status === "incomplete" || outcome.assurance.status === "incomplete") {
+		machinery.push(outcome.unreviewedPaths.length > 0 ? `review infrastructure did not settle — a reviewer-side gap, not a code defect; ${outcome.unreviewedPaths.length} path(s) are carried forward and retried automatically on the next run` : "review infrastructure did not settle — a reviewer-side gap, not a code defect");
+		if (outcome.inputCoverage.status === "incomplete") machinery.push(...outcome.inputCoverage.reasons);
+		if (outcome.assurance.status === "incomplete") machinery.push(...outcome.assurance.reasons);
+	}
+	const blocking = blockingReasons({
 		findings: outcome.activeFindings,
 		concerns: outcome.activeConcerns
 	});
-	return reasons.length > 0 ? {
+	if (blocking.length > 0) return {
 		conclusion: "blocking",
-		reasons
-	} : {
+		reasons: [...blocking, ...machinery]
+	};
+	if (machinery.length > 0) return {
+		conclusion: "incomplete",
+		reasons: machinery
+	};
+	return {
 		conclusion: "success",
-		reasons
+		reasons: []
 	};
 };
 const concludeReviewState = (state) => {
@@ -274,7 +283,7 @@ const runReviewAction = (reviewer, options = {}) => Effect.gen(function* () {
 					failure: void 0
 				})
 			}));
-			const equivalentPatchState = (options.reviewMode ?? "incremental") === "incremental" && options.skipUnchanged !== false && recovered.state !== void 0 && currentFingerprint !== void 0 && validateReviewState(recovered.state, metadata, profileFingerprint) === void 0 && recovered.state.acceptedScopeFingerprint === currentFingerprint ? recovered.state : void 0;
+			const equivalentPatchState = (options.reviewMode ?? "incremental") === "incremental" && options.skipUnchanged !== false && recovered.state !== void 0 && recovered.state.settled && currentFingerprint !== void 0 && validateReviewState(recovered.state, metadata, profileFingerprint) === void 0 && recovered.state.acceptedScopeFingerprint === currentFingerprint ? recovered.state : void 0;
 			if (equivalentPatchState !== void 0) return yield* skipCoveredReview({
 				repository: target.repository,
 				pullRequestNumber: target.number,
@@ -321,7 +330,7 @@ const runReviewAction = (reviewer, options = {}) => Effect.gen(function* () {
 				}),
 				stateAuthenticator
 			};
-			if (options.skipUnchanged !== false && selection.mode === "incremental" && selection.files.length === 0 && selection.priorState !== void 0) return yield* skipCoveredReview({
+			if (options.skipUnchanged !== false && selection.mode === "incremental" && selection.files.length === 0 && selection.priorState !== void 0 && selection.priorState.settled) return yield* skipCoveredReview({
 				repository: target.repository,
 				pullRequestNumber: target.number,
 				reason: "no changed review scope since the last settled review head",
@@ -418,7 +427,6 @@ const reviewActionProgram = Effect.gen(function* () {
 	};
 	const harness = {
 		post: inputs.post,
-		failOn: inputs.failOn,
 		skipUnchanged: inputs.skipUnchanged,
 		reviewMode: inputs.reviewMode,
 		retireStaleReviews: inputs.retireStaleReviews,
@@ -456,6 +464,6 @@ const PrReviewAction = {
 	main
 };
 //#endregion
-export { FailOnPolicy, GuidanceFileUnreadable, InvalidMaxDurationInput, MAX_GUIDANCE_FILE_CHARS, PrReviewAction, ReviewCheckConclusion, ReviewGateFailed, concludeReviewOutcome, main, resolveActionInputs, resolveGuidance, reviewActionProgram, runReviewAction, writeActionOutputs, writeStepSummary };
+export { GuidanceFileUnreadable, InvalidMaxDurationInput, MAX_GUIDANCE_FILE_CHARS, PrReviewAction, ReviewCheckConclusion, ReviewGateFailed, concludeReviewOutcome, main, resolveActionInputs, resolveGuidance, reviewActionProgram, runReviewAction, writeActionOutputs, writeStepSummary };
 
 //# sourceMappingURL=action.mjs.map