@effect-agent/pr-review 0.1.0-beta.22 → 0.1.0-beta.23

package/dist/{github-BgtP7Rdv.mjs → github-BbwYzNrC.mjs}

@@ -1,5 +1,5 @@
 import { Context, DateTime, Effect, Encoding, Layer, Option, Redacted, Result, Schema } from "effect";
-import { Agent, AgentPolicy, Subagent, SubagentPolicy, SubagentRuntime, ToolExecutionClass, ToolResultBounds } from "effect-agent";
+import { Agent, AgentPolicy, AgentRuntime, ToolExecutionClass, ToolResultBounds } from "effect-agent";
 import { Tool, Toolkit } from "effect/unstable/ai";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 //#region src/internal/diff.ts
@@ -579,6 +579,228 @@ const PullRequestReviewer = Agent.define("pr-reviewer", {
 	}
 });
 //#endregion
+//#region src/internal/coverage.ts
+var FailedReviewUnit = class extends Schema.Class("@effect-agent/pr-review/FailedReviewUnit")({
+	unitId: Schema.NonEmptyString.check(Schema.isMaxLength(32)),
+	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+}) {};
+/**
+* Compatibility diagnostic retained for callers that consumed the original
+* `coverage` field. New UI and state decisions use ReviewInputCoverage and
+* ReviewAssurance directly.
+*/
+var ReviewCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewCoverage")({
+	status: Schema.Literals(["complete", "incomplete"]),
+	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	reviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	unreviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	failedUnits: Schema.Array(FailedReviewUnit).check(Schema.isMaxLength(8)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+}) {};
+var ReviewInputCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewInputCoverage")({
+	status: Schema.Literals(["complete", "incomplete"]),
+	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	assignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	/** Assigned paths whose model-visible diff was truncated by the evidence bound. */
+	partialPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	unassignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	/**
+	* Paths with neither a textual diff nor bounded base/head text (binaries,
+	* oversized files). Fail-closed: they keep the status incomplete for as
+	* long as they are part of the pull request — an unreviewable change must
+	* never authorize a green check. Exclude them deliberately with ignore
+	* globs when that is intended.
+	*/
+	undiffablePaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(20))
+}) {};
+var FailedReviewPass = class extends Schema.Class("@effect-agent/pr-review/FailedReviewPass")({
+	workId: Schema.NonEmptyString.check(Schema.isMaxLength(96)),
+	stage: Schema.Literals([
+		"discovery",
+		"specialist",
+		"verification"
+	]),
+	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+}) {};
+/**
+* Settlement of scheduled review work. `incomplete` means reviewer-side work
+* failed after its bounded retry — a machinery gap that is carried forward and
+* retried on the next run, never a statement about the code under review.
+* `unverified` is the flat reviewer's honest constant: one pass with no
+* independent verifier is neither settled assurance nor a failure.
+*/
+var ReviewAssurance = class extends Schema.Class("@effect-agent/pr-review/ReviewAssurance")({
+	status: Schema.Literals([
+		"settled",
+		"incomplete",
+		"unverified"
+	]),
+	requiredGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	discoveredCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	confirmedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	rejectedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	unsettledCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Discovery claims discarded for anchors/paths outside their assigned evidence. */
+	discardedInvalidFindings: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	failedPasses: Schema.Array(FailedReviewPass).check(Schema.isMaxLength(64)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+}) {};
+const toolTrace = (events) => {
+	const declared = /* @__PURE__ */ new Map();
+	const succeeded = /* @__PURE__ */ new Map();
+	const failed = /* @__PURE__ */ new Map();
+	for (const event of events) {
+		if (event._tag === "ToolCallDeclared") declared.set(event.toolCallId, event);
+		if (event._tag === "ToolCallSucceeded") succeeded.set(event.toolCallId, event);
+		if (event._tag === "ToolCallFailed") failed.set(event.toolCallId, event);
+	}
+	return {
+		declared,
+		succeeded,
+		failed
+	};
+};
+const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+/** Render a bounded, deterministic "label (n): a, b, … (+k more)" reason line. */
+const boundedListReason = (label, values) => {
+	const items = sortedUnique(values);
+	let rendered = `${label} (${items.length}): `;
+	for (let index = 0; index < items.length; index += 1) {
+		const item = items[index] ?? "";
+		const separator = index === 0 ? "" : ", ";
+		const omitted = items.length - index - 1;
+		const suffix = omitted === 0 ? "" : ` … (+${omitted} more)`;
+		if (`${rendered}${separator}${item}${suffix}`.length > 1e3) {
+			const omission = `… (+${items.length - index} more)`;
+			return `${rendered.slice(0, 1e3 - omission.length)}${omission}`;
+		}
+		rendered = `${rendered}${separator}${item}`;
+	}
+	return rendered;
+};
+const anchorSurfaceAdjusted = (inputCoverage, anchorFiles, totalAnchorFiles) => anchorFiles.length >= totalAnchorFiles ? inputCoverage : ReviewInputCoverage.make({
+	...inputCoverage,
+	status: "incomplete",
+	reasons: [...inputCoverage.reasons, `full pull-request anchor surface exposed ${anchorFiles.length} of ${totalAnchorFiles} required files`]
+});
+/** The flat reviewer's honest constant assurance: one pass, no verifier. */
+const flatAssurance = () => ReviewAssurance.make({
+	status: "unverified",
+	requiredGeneralDiscoveryPasses: 1,
+	completedGeneralDiscoveryPasses: 1,
+	requiredSpecialistPasses: 0,
+	completedSpecialistPasses: 0,
+	requiredVerificationPasses: 0,
+	completedVerificationPasses: 0,
+	discoveredCandidates: 0,
+	confirmedCandidates: 0,
+	rejectedCandidates: 0,
+	unsettledCandidates: 0,
+	discardedInvalidFindings: 0,
+	failedPasses: [],
+	reasons: ["flat review has no independent candidate-verification pass; use the fan-out pipeline for a settled assurance result"]
+});
+/**
+* Assess one settled flat run from its Run event trace: which required paths
+* received successful bounded diff evidence. This observes tool INPUT
+* assignment only — the host cannot know which evidence the model weighed.
+*/
+const assessFlatReview = (input) => {
+	const trace = toolTrace(input.events);
+	const requiredPaths = sortedUnique(input.files.map((file) => file.path));
+	const assigned = /* @__PURE__ */ new Set();
+	const partial = /* @__PURE__ */ new Set();
+	const failedPaths = /* @__PURE__ */ new Set();
+	for (const [toolCallId, declaration] of trace.declared) {
+		if (declaration.toolName !== "read_file_diff") continue;
+		const query = Schema.decodeUnknownOption(FileDiffQuery)(declaration.parameters);
+		if (Option.isNone(query)) continue;
+		const success = trace.succeeded.get(toolCallId);
+		if (success !== void 0) {
+			assigned.add(query.value.path);
+			const view = Schema.decodeUnknownOption(FileDiffView)(success.result);
+			if (Option.isSome(view) && view.value.truncated) partial.add(query.value.path);
+		}
+		if (trace.failed.has(toolCallId)) failedPaths.add(query.value.path);
+	}
+	const undiffable = new Set(input.files.filter((file) => !isReviewableFile(file)).map((file) => file.path));
+	const unassigned = requiredPaths.filter((path) => !undiffable.has(path) && (!assigned.has(path) || failedPaths.has(path)));
+	const reasons = [];
+	if (input.files.length < input.totalFiles) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (undiffable.size > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", undiffable));
+	if (failedPaths.size > 0) reasons.push(boundedListReason("diff reads failed", failedPaths));
+	if (partial.size > 0) reasons.push(boundedListReason("model-visible diff evidence was truncated", partial));
+	if (unassigned.length > 0) reasons.push(boundedListReason("required paths received no successful diff input", unassigned));
+	return {
+		inputCoverage: anchorSurfaceAdjusted(ReviewInputCoverage.make({
+			status: reasons.length === 0 ? "complete" : "incomplete",
+			requiredPaths,
+			assignedPaths: sortedUnique(assigned),
+			partialPaths: sortedUnique(partial),
+			unassignedPaths: sortedUnique(unassigned),
+			undiffablePaths: sortedUnique(undiffable),
+			reasons
+		}), input.anchorFiles, input.totalAnchorFiles),
+		assurance: flatAssurance(),
+		unreviewedPaths: sortedUnique([...unassigned, ...undiffable])
+	};
+};
+/**
+* Input coverage of one host-scheduled fan-out plan: which required paths the
+* bounded plan actually assigned complete evidence for. Capacity overflow and
+* undiffable paths are both real gaps; the pipeline carries them so the check
+* stays fail-closed until they are reviewed, removed, or explicitly ignored.
+*/
+const fanOutInputCoverage = (input) => {
+	const plan = input.plan;
+	const assignedPaths = sortedUnique(plan.units.flatMap((unit) => unit.paths));
+	const unassignedPaths = sortedUnique(plan.unassignedPaths);
+	const reasons = [];
+	if (plan.truncated) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (plan.undiffablePaths.length > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", plan.undiffablePaths));
+	if (plan.partialEvidencePaths.length > 0) reasons.push(boundedListReason("fan-out capacity left some deterministic evidence shards unassigned", plan.partialEvidencePaths));
+	if (plan.unassignedEvidenceShardCount > 0) {
+		reasons.push(`${plan.unassignedEvidenceShardCount} deterministic evidence shard(s) exceeded fan-out capacity`);
+		reasons.push(boundedListReason(`unassigned evidence shard identifier sample (${plan.unassignedEvidenceShardIds.length} of ${plan.unassignedEvidenceShardCount})`, plan.unassignedEvidenceShardIds));
+	}
+	if (plan.unassignedPaths.length > 0) reasons.push(boundedListReason("fan-out capacity left paths unassigned", plan.unassignedPaths));
+	return anchorSurfaceAdjusted(ReviewInputCoverage.make({
+		status: reasons.length === 0 ? "complete" : "incomplete",
+		requiredPaths: sortedUnique(input.files.map((file) => file.path)),
+		assignedPaths,
+		partialPaths: plan.partialEvidencePaths,
+		unassignedPaths,
+		undiffablePaths: sortedUnique(plan.undiffablePaths),
+		reasons
+	}), input.anchorFiles, input.totalAnchorFiles);
+};
+/** Compatibility aggregate over the two precise claims. */
+const compatibilityCoverage = (inputCoverage, assurance) => {
+	const assuranceIncomplete = assurance.status === "incomplete";
+	const failedUnits = /* @__PURE__ */ new Map();
+	for (const pass of assurance.failedPasses) {
+		const unitId = pass.workId.slice(0, 8);
+		if (!failedUnits.has(unitId)) failedUnits.set(unitId, FailedReviewUnit.make({
+			unitId,
+			errorTag: `${pass.stage}:${pass.errorTag}`
+		}));
+	}
+	return ReviewCoverage.make({
+		status: inputCoverage.status === "complete" && !assuranceIncomplete ? "complete" : "incomplete",
+		requiredPaths: inputCoverage.requiredPaths,
+		reviewedPaths: inputCoverage.assignedPaths,
+		unreviewedPaths: sortedUnique([...inputCoverage.partialPaths, ...inputCoverage.unassignedPaths]),
+		failedUnits: [...failedUnits.values()].slice(0, 8),
+		reasons: [...inputCoverage.reasons, ...assuranceIncomplete ? assurance.reasons : []]
+	});
+};
+//#endregion
 //#region src/internal/review-units.ts
 /** The delegation fan-out bound: one parent Run spawns at most this many children. */
 const MAX_REVIEW_UNITS = 8;
@@ -928,6 +1150,20 @@ const rankAndDedupeFindings = (findings) => {
 		return left.startLine - right.startLine;
 	}).slice(0, 20);
 };
+/**
+* The concern analogue of `rankAndDedupeFindings`: dedupe by exact content
+* keeping the most severe duplicate, rank by severity, and cap at the
+* `CodeReview` concerns bound.
+*/
+const rankAndDedupeConcerns = (concerns) => {
+	const byContent = /* @__PURE__ */ new Map();
+	for (const concern of concerns) {
+		const key = `${concern.title}\u0000${concern.body}`;
+		const previous = byContent.get(key);
+		if (previous === void 0 || severityRank[concern.severity] < severityRank[previous.severity]) byContent.set(key, concern);
+	}
+	return [...byContent.values()].sort((left, right) => severityRank[left.severity] - severityRank[right.severity]).slice(0, 10);
+};
 //#endregion
 //#region src/internal/fan-out.ts
 /** One discovery pass returns at most this many anchored candidates. */
@@ -936,8 +1172,14 @@ const MAX_CHILD_FINDINGS = 6;
 const MAX_CHILD_CONCERNS = 3;
 /** Every unit receives independent general and specialist discovery passes. */
 const MAX_UNIT_CANDIDATES = 18;
-/** General + specialist discovery for every unit, then one verifier per unit. */
+/**
+* General + specialist discovery for every unit, then one verifier per unit.
+* The one-retry budget doubles the worst-case child Run count, but the
+* schedule itself never exceeds this bound.
+*/
 const MAX_REVIEW_CHILDREN = 24;
+/** Bounded structured concurrency across units; passes inside a unit are sequential. */
+const REVIEW_UNIT_CONCURRENCY = 4;
 /** Structural minimum for a child that exposes no tools. */
 const MAX_FILE_REVIEW_TOOL_CALLS = 1;
 const ReviewWorkPhase = Schema.Literals(["discovery", "verification"]);
@@ -978,8 +1220,8 @@ var CandidateAssessment = class extends Schema.Class("@effect-agent/pr-review/Ca
 }) {};
 /**
 * Exact suggestion settlement shape: a carried suggestion must be settled and
-* nothing else may be. Enforced identically by the live delegation projection
-* and the independent host coverage fold.
+* nothing else may be. A verification report that violates it is treated as a
+* misbehaving pass and retried within the pass budget.
 */
 const assessmentSettlesSuggestionExactly = (assessment, candidate) => candidate._tag === "FindingCandidate" && candidate.finding.suggestion !== void 0 ? assessment.suggestion !== void 0 : assessment.suggestion === void 0;
 /**
@@ -1007,18 +1249,6 @@ const UnitPaths = Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(S
 const RiskCategories = Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6));
 const Candidates = Schema.Array(ReviewCandidate).check(Schema.isMaxLength(18));
 const EvidenceShardIds = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-/** Strict-object coordinator request for either discovery or verification. */
-var FileReviewRequest = class extends Schema.Class("@effect-agent/pr-review/FileReviewRequest")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	paths: UnitPaths,
-	evidenceShardIds: EvidenceShardIds,
-	perspective: ReviewWorkPerspective,
-	riskCategories: RiskCategories,
-	/** Empty for discovery; the exact discovered set for unit verification. */
-	candidates: Candidates
-}) {};
 /** One complete host-selected evidence shard supplied to a review child. */
 var FileReviewEvidence = class extends Schema.Class("@effect-agent/pr-review/FileReviewEvidence")({
 	shardId: ReviewEvidenceShardId,
@@ -1042,6 +1272,7 @@ var FileReviewBrief = class extends Schema.Class("@effect-agent/pr-review/FileRe
 	evidenceShardIds: EvidenceShardIds,
 	perspective: ReviewWorkPerspective,
 	riskCategories: RiskCategories,
+	/** Empty for discovery; the exact discovered set for unit verification. */
 	candidates: Candidates,
 	evidence: Schema.Array(FileReviewEvidence).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
 }) {};
@@ -1055,24 +1286,16 @@ var FileReviewReport = class extends Schema.Class("@effect-agent/pr-review/FileR
 	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
 	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
 }) {};
-/** Bounded coordinator-visible result with host-assigned candidate IDs. */
-var FileReviewUnitResult = class extends Schema.Class("@effect-agent/pr-review/FileReviewUnitResult")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	candidates: Candidates,
-	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
-	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
-}) {};
-var FileReviewUnitFailed = class extends Schema.TaggedError()("FileReviewUnitFailed", {
-	childErrorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
-	message: Schema.String.check(Schema.isMaxLength(400))
-}) {};
-var FileReviewWorkRejected = class extends Schema.TaggedError()("FileReviewWorkRejected", {
+/**
+* A structurally valid child report that does not answer the scheduled pass:
+* wrong identity, phase-inapplicable fields, or an inexact assessment set.
+* Retried once like any other pass fault, because it is model misbehavior,
+* not evidence about the code under review.
+*/
+var ReviewPassMisbehaved = class extends Schema.TaggedError()("ReviewPassMisbehaved", {
 	workId: ReviewPassId,
 	reason: Schema.NonEmptyString.check(Schema.isMaxLength(600))
 }) {};
-const FileReviewFailure = Schema.Union([FileReviewUnitFailed, FileReviewWorkRejected]);
 const staticGuidanceLines = (guidance) => {
 	if (guidance === void 0) return [];
 	return (typeof guidance === "string" ? [guidance] : guidance).filter((line) => line.length > 0);
@@ -1110,8 +1333,6 @@ const makeFileReviewerInstructions = (options = {}) => (brief) => {
 };
 const fileReviewerInstructions = makeFileReviewerInstructions();
 const FileReviewToolkit = Toolkit.empty;
-/** Compatibility export: the evidence-only child has no handler requirements. */
-const FileReviewToolkitLayer = Layer.empty;
 const defaultFileReviewerPolicy = AgentPolicy.make({
 	maxTurns: 6,
 	maxToolCalls: 1,
@@ -1123,54 +1344,29 @@ const defaultFileReviewerPolicy = AgentPolicy.make({
 	toolResultBounds: ToolResultBounds.make({ maxBytes: REVIEW_TOOL_RESULT_MAX_BYTES }),
 	onExhaustion: "fail"
 });
-const fileReviewPolicy = SubagentPolicy.make({
-	maxChildren: MAX_REVIEW_CHILDREN,
-	maxConcurrency: 4,
-	maxTurns: 6,
-	maxToolCalls: 1,
-	maxDuration: "6 minutes",
-	maxResultBytes: 256 * 1024
-});
-const mapFileReviewChildFailure = (failure) => FileReviewUnitFailed.make({
-	childErrorTag: failure._tag,
-	message: (failure.message ?? "").slice(0, 400)
-});
-const sameStrings = (left, right) => left.length === right.length && left.every((value, index) => value === right[index]);
-const rejectWork = (workId, reason) => FileReviewWorkRejected.make({
-	workId,
-	reason
-});
-/** Validate coordinator scheduling against the current deterministic plan. */
-const prepareReviewBrief = (request) => Effect.gen(function* () {
-	const source = yield* PullRequestSource;
-	const mapSourceFailure = (failure) => rejectWork(request.workId, `pull-request source ${failure.operation} failed: ${failure.reason}`.slice(0, 600));
-	const files = yield* source.changedFiles.pipe(Effect.mapError(mapSourceFailure));
-	const plan = planReviewUnits(files, { totalChangedFiles: (yield* source.metadata.pipe(Effect.mapError(mapSourceFailure))).totalChangedFiles });
-	const unit = plan.units.find((candidate) => candidate.unitId === request.unitId);
-	if (unit === void 0 || !sameStrings(request.paths, unit.paths) || !sameStrings(request.evidenceShardIds, unit.evidenceShards.map((shard) => shard.shardId))) return yield* rejectWork(request.workId, "request does not match a host-planned unit");
-	if (request.phase === "discovery") {
-		const pass = plan.discoveryPasses.find((candidate) => candidate.passId === request.workId);
-		if (pass === void 0 || pass.unitId !== request.unitId || !sameStrings(pass.paths, request.paths) || !sameStrings(pass.evidenceShardIds, request.evidenceShardIds) || pass.perspective !== request.perspective || !sameStrings(pass.riskCategories, request.riskCategories) || request.candidates.length !== 0) return yield* rejectWork(request.workId, "discovery request does not match the host plan");
-	} else {
-		if (request.workId !== `${request.unitId}-verification` || request.perspective !== "candidate-verification" || !sameStrings(request.riskCategories, unit.riskCategories) || request.candidates.length === 0) return yield* rejectWork(request.workId, "verification request does not match the host-planned unit");
-		const candidateIds = /* @__PURE__ */ new Set();
-		const candidateSubjects = /* @__PURE__ */ new Set();
-		const allowed = new Set(unit.paths);
-		for (const candidate of request.candidates) {
-			const subjectKey = reviewCandidateSubjectKey(candidate);
-			if (candidateIds.has(candidate.candidateId) || candidateSubjects.has(subjectKey) || candidate.unitId !== unit.unitId || candidate.evidencePaths.some((path) => !allowed.has(path)) || candidate._tag === "FindingCandidate" && !allowed.has(candidate.finding.path)) return yield* rejectWork(request.workId, "verification candidates are duplicated or outside the planned unit");
-			candidateIds.add(candidate.candidateId);
-			candidateSubjects.add(subjectKey);
-		}
+const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
+	input: FileReviewBrief,
+	output: FileReviewReport,
+	instructions: makeFileReviewerInstructions(options),
+	toolkit: FileReviewToolkit,
+	policy: defaultFileReviewerPolicy,
+	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
+	metadata: {
+		deploymentClass: "E",
+		surface: "read-only",
+		stage: "discovery-verification"
 	}
+});
+const FileReviewer = makeFileReviewerDefinition();
+const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
+/** Rebuild one unit's complete evidence from the same snapshot the plan used. */
+const unitEvidence = (unit, files) => Effect.gen(function* () {
 	const byPath = new Map(files.map((file) => [file.path, file]));
 	const evidence = [];
 	for (const shard of unit.evidenceShards) {
 		const file = byPath.get(shard.path);
-		if (file === void 0) return yield* rejectWork(request.workId, `planned evidence path is unavailable: ${shard.path}`);
-		const chunks = fileReviewEvidenceChunks(file);
-		const chunk = chunks[shard.ordinal - 1];
-		if (chunk === void 0 || chunks.length !== shard.total || chunk.annotatedPatch.length !== shard.evidenceChars) return yield* rejectWork(request.workId, `planned evidence shard no longer matches source: ${shard.shardId}`);
+		const chunk = file === void 0 ? void 0 : fileReviewEvidenceChunks(file)[shard.ordinal - 1];
+		if (file === void 0 || chunk === void 0) return yield* Effect.die(/* @__PURE__ */ new Error(`planned evidence shard has no source: ${shard.shardId} (${shard.path})`));
 		evidence.push(FileReviewEvidence.make({
 			shardId: shard.shardId,
 			path: shard.path,
@@ -1181,171 +1377,274 @@ const prepareReviewBrief = (request) => Effect.gen(function* () {
 			annotatedPatch: chunk.annotatedPatch
 		}));
 	}
-	return FileReviewBrief.make({
-		...request,
-		evidence
-	});
+	return evidence;
 });
-const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
-const projectReviewResult = (report, context, request) => {
-	if (context.budgetExhausted) return Effect.fail(rejectWork(report.workId, "review work exhausted its budget before exact settlement"));
-	if (report.phase !== request.phase || report.workId !== request.workId || report.unitId !== request.unitId) return Effect.fail(rejectWork(request.workId, "review output identity does not match the scheduled request"));
-	if (report.phase === "verification") {
-		if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return Effect.fail(rejectWork(report.workId, "verification output contained discovery-only fields"));
-		const expectedById = new Map(request.candidates.map((candidate) => [candidate.candidateId, candidate]));
-		const assessedIds = /* @__PURE__ */ new Set();
-		for (const assessment of report.assessments) {
-			const candidate = expectedById.get(assessment.candidateId);
-			if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return Effect.fail(rejectWork(report.workId, "verification output did not assess the exact candidate set"));
-			if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return Effect.fail(rejectWork(report.workId, "verification output did not settle suggestion publication exactly"));
-			assessedIds.add(assessment.candidateId);
+const misbehaved = (workId, reason) => ReviewPassMisbehaved.make({
+	workId,
+	reason: reason.slice(0, 600)
+});
+/** Validate that a verification report assesses exactly the scheduled candidates. */
+const validateVerificationReport = (brief, report) => {
+	if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return misbehaved(brief.workId, "verification output contained discovery-only fields");
+	const expectedById = new Map(brief.candidates.map((candidate) => [candidate.candidateId, candidate]));
+	const assessedIds = /* @__PURE__ */ new Set();
+	for (const assessment of report.assessments) {
+		const candidate = expectedById.get(assessment.candidateId);
+		if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+		if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return misbehaved(brief.workId, "verification output did not settle suggestion publication exactly");
+		assessedIds.add(assessment.candidateId);
+	}
+	if (assessedIds.size !== expectedById.size) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+};
+/**
+* Run one scheduled pass: execute the child, decode its report, and enforce
+* the pass contract. Any typed fault — child failure, malformed or misdirected
+* output — is retried once; budget exhaustion is terminal because a retry
+* would fail the same way. The settled outcome is a value either way, so one
+* flaky pass can never fail the whole pipeline.
+*/
+const runReviewPass = (binding, brief, budget) => Effect.gen(function* () {
+	const result = yield* AgentRuntime.run(binding, brief, {
+		...budget === void 0 ? {} : { budget },
+		estimateCostMicrousd: () => Effect.succeed(500)
+	});
+	const report = yield* Schema.decodeUnknownEffect(FileReviewReport)(result.output).pipe(Effect.mapError((error) => misbehaved(brief.workId, `child report failed to decode: ${error.message}`)));
+	if (report.phase !== brief.phase || report.workId !== brief.workId || report.unitId !== brief.unitId) return yield* misbehaved(brief.workId, "child report identity does not match the scheduled pass");
+	if (brief.phase === "verification") {
+		const violation = validateVerificationReport(brief, report);
+		if (violation !== void 0) return yield* violation;
+	} else if (report.assessments.length > 0) return yield* misbehaved(brief.workId, "discovery output contained verification-only assessments");
+	return {
+		report,
+		turns: result.turns
+	};
+}).pipe(Effect.scoped, Effect.retry({
+	times: 1,
+	while: (error) => error._tag !== "BudgetExceeded"
+}), Effect.map((settled) => ({
+	_tag: "settled",
+	...settled
+})), Effect.catch((error) => Effect.succeed({
+	_tag: "failed",
+	errorTag: String(error._tag).slice(0, 256)
+})));
+/**
+* Keep only findings anchored inside the pass's exact assigned evidence and
+* concerns bound to unit paths. Everything else is discarded and counted —
+* an invalid anchor invalidates one claim, never the pass that produced it.
+*/
+const harvestDiscovery = (pass, unit, files, anchorFiles, report) => {
+	const allowed = new Set(pass.paths);
+	let discarded = 0;
+	const keptFindings = [];
+	for (const finding of report.findings) {
+		if (!allowed.has(finding.path) || anchorViolation(finding, anchorFiles) !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) {
+			discarded += 1;
+			continue;
 		}
-		if (assessedIds.size !== expectedById.size) return Effect.fail(rejectWork(report.workId, "verification output did not assess the exact candidate set"));
-		return Effect.succeed(FileReviewUnitResult.make({
-			phase: report.phase,
-			workId: report.workId,
-			unitId: report.unitId,
-			candidates: [],
-			fileSummaries: [],
-			assessments: report.assessments
-		}));
+		keptFindings.push(finding);
 	}
-	if (report.assessments.length > 0) return Effect.fail(rejectWork(report.workId, "discovery output contained verification-only assessments"));
-	const allowed = new Set(request.paths);
-	if (report.findings.some((finding) => !allowed.has(finding.path)) || report.concerns.some((candidate) => candidate.evidencePaths.some((path) => !allowed.has(path))) || report.fileSummaries.some((entry) => !allowed.has(entry.path))) return Effect.fail(rejectWork(report.workId, "discovery output referenced evidence outside the scheduled unit"));
-	return Effect.gen(function* () {
-		const source = yield* PullRequestSource;
-		const mapSourceFailure = (failure) => rejectWork(request.workId, `pull-request source ${failure.operation} failed: ${failure.reason}`.slice(0, 600));
-		const files = yield* source.changedFiles.pipe(Effect.mapError(mapSourceFailure));
-		const metadata = yield* source.metadata.pipe(Effect.mapError(mapSourceFailure));
-		const anchorFiles = yield* source.anchorFiles.pipe(Effect.mapError(mapSourceFailure));
-		const unit = planReviewUnits(files, { totalChangedFiles: metadata.totalChangedFiles }).units.find((candidate) => candidate.unitId === request.unitId);
-		if (unit === void 0) return yield* rejectWork(request.workId, "scheduled review unit is no longer available");
-		for (const finding of report.findings) {
-			const violation = anchorViolation(finding, anchorFiles);
-			if (violation !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) return yield* rejectWork(request.workId, `discovery finding has no valid anchor in its assigned evidence: ${violation ?? finding.path}`);
+	const keptConcerns = [];
+	for (const candidate of report.concerns) {
+		if (candidate.evidencePaths.some((path) => !allowed.has(path))) {
+			discarded += 1;
+			continue;
 		}
-		const findingCandidates = report.findings.map((finding, index) => FindingCandidate.make({
-			candidateId: `${request.workId}:finding:${candidateOrdinal(index)}`,
-			workId: request.workId,
-			unitId: request.unitId,
+		keptConcerns.push(candidate);
+	}
+	return {
+		candidates: [...keptFindings.map((finding, index) => FindingCandidate.make({
+			candidateId: `${pass.passId}:finding:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
 			finding,
 			evidencePaths: [finding.path]
-		}));
-		const concernCandidates = report.concerns.map((candidate, index) => ConcernCandidate.make({
-			candidateId: `${request.workId}:concern:${candidateOrdinal(index)}`,
-			workId: request.workId,
-			unitId: request.unitId,
+		})), ...keptConcerns.map((candidate, index) => ConcernCandidate.make({
+			candidateId: `${pass.passId}:concern:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
 			concern: candidate.concern,
 			evidencePaths: candidate.evidencePaths
-		}));
-		return FileReviewUnitResult.make({
-			phase: report.phase,
-			workId: report.workId,
-			unitId: report.unitId,
-			candidates: [...findingCandidates, ...concernCandidates],
-			fileSummaries: report.fileSummaries,
-			assessments: []
-		});
-	});
-};
-const delegationDescription = "Run exactly one host-planned discovery or candidate-verification child. Copy every plan field and candidate verbatim; never retry failed work.";
-const makeFileReviewDelegation = (child) => Subagent.define("delegate_file_review", {
-	description: delegationDescription,
-	target: child,
-	parameters: FileReviewRequest,
-	success: FileReviewUnitResult,
-	failure: FileReviewFailure,
-	failureMode: "return",
-	prepareInput: prepareReviewBrief,
-	projectResult: projectReviewResult,
-	policy: fileReviewPolicy
-});
-var ListReviewUnitsQuery = class extends Schema.Class("@effect-agent/pr-review/ListReviewUnitsQuery")({ scope: Schema.Literal("all") }) {};
-const ListReviewUnits = Tool.make("list_review_units", {
-	description: "List deterministic bounded review units, explicit risk categories, every required discovery pass, and paths the pipeline cannot cover.",
-	parameters: ListReviewUnitsQuery,
-	success: ReviewUnitPlan,
-	failure: PullRequestSourceFailure,
-	failureMode: "error",
-	dependencies: [PullRequestSource]
-}).annotate(ToolExecutionClass, "readonly");
-const FanOutCoordinatorToolkit = Toolkit.make(ListReviewUnits);
-const FanOutCoordinatorToolkitLayer = FanOutCoordinatorToolkit.toLayer({ list_review_units: () => Effect.gen(function* () {
-	const source = yield* PullRequestSource;
-	return planReviewUnits(yield* source.changedFiles, { totalChangedFiles: (yield* source.metadata).totalChangedFiles });
-}) });
-const makeFanOutReviewInstructions = (options = {}) => (mission) => {
-	const maxFindings = clampMaxFindings(options.maxFindings);
-	return [
-		`You coordinate the bounded multi-pass review of pull request #${mission.number} ("${mission.title}") in ${mission.repository}.`,
-		mission.body.length > 0 ? `Author description:\n${mission.body}` : "No author description.",
-		...staticGuidanceLines(options.guidance),
-		"1. Call list_review_units exactly once.",
-		"2. For EVERY discoveryPass, call delegate_file_review exactly once with phase \"discovery\", workId=passId, and the pass unitId/paths/evidenceShardIds/perspective/riskCategories verbatim; candidates must be []. Prefer one bounded parallel batch. Never retry.",
-		"3. Group candidates returned by all successful discovery passes by unit. Deterministically deduplicate byte-identical finding or concern payloads, retaining the first candidate in discoveryPass plan order. For every unit with at least one retained candidate, call delegate_file_review exactly once with phase \"verification\", workId \"<unitId>-verification\", perspective \"candidate-verification\", the unit paths/evidenceShardIds/riskCategories, and EVERY retained candidate copied byte-for-byte. Prefer one bounded parallel batch. Never retry.",
-		"4. Verification is authoritative: rejected candidates must not be reported. The host independently reconstructs publishable findings from exact confirmed assessments, so do not select, rewrite, downgrade, or invent findings.",
-		`5. Return ONLY CodeReview JSON. Write a concise summary of completed and failed stages. Set findings=[] and concerns=[]; the host injects exact confirmed candidates. Copy factual fileSummaries into walkthrough without invention. The host publication cap is ${maxFindings}.`,
-		"No configured pipeline can prove absence of defects. Describe settled work, never an exhaustive or defect-free review."
-	].join("\n");
+		}))],
+		fileSummaries: report.fileSummaries.filter((entry) => allowed.has(entry.path)),
+		discarded
+	};
 };
-const fanOutReviewInstructions = makeFanOutReviewInstructions();
-const defaultFanOutPolicy = AgentPolicy.make({
-	maxTurns: 7,
-	maxToolCalls: 25,
-	maxDuration: "20 minutes",
-	toolConcurrency: 4,
-	repeatedFailureLimit: 3,
-	tokenBudget: 4e5,
-	contextTokenLimit: 15e4,
-	onExhaustion: "final-answer"
-});
-const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
-	input: FileReviewBrief,
-	output: FileReviewReport,
-	instructions: makeFileReviewerInstructions(options),
-	toolkit: FileReviewToolkit,
-	policy: defaultFileReviewerPolicy,
-	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
-	metadata: {
-		deploymentClass: "E",
-		surface: "read-only",
-		stage: "discovery-verification"
+const reviewUnit = (binding, unit, passes, input) => Effect.gen(function* () {
+	const evidence = yield* unitEvidence(unit, input.files);
+	const failedPasses = [];
+	const candidates = [];
+	const subjects = /* @__PURE__ */ new Set();
+	const walkthrough = [];
+	let discardedFindings = 0;
+	let turns = 0;
+	let completedGeneralPasses = 0;
+	let completedSpecialistPasses = 0;
+	for (const pass of passes) {
+		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
+		const brief = FileReviewBrief.make({
+			phase: "discovery",
+			workId: pass.passId,
+			unitId: pass.unitId,
+			paths: pass.paths,
+			evidenceShardIds: pass.evidenceShardIds,
+			perspective: pass.perspective,
+			riskCategories: pass.riskCategories,
+			candidates: [],
+			evidence
+		});
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			failedPasses.push(FailedReviewPass.make({
+				workId: pass.passId,
+				stage,
+				errorTag: outcome.errorTag
+			}));
+			continue;
+		}
+		turns += outcome.turns;
+		if (stage === "specialist") completedSpecialistPasses += 1;
+		else completedGeneralPasses += 1;
+		const harvest = harvestDiscovery(pass, unit, input.files, input.anchorFiles, outcome.report);
+		discardedFindings += harvest.discarded;
+		if (pass.perspective === "general") walkthrough.push(...harvest.fileSummaries);
+		for (const candidate of harvest.candidates) {
+			const subject = reviewCandidateSubjectKey(candidate);
+			if (subjects.has(subject)) continue;
+			subjects.add(subject);
+			candidates.push(candidate);
+		}
 	}
-});
-const delegationToolFor = (delegation) => delegation.tool.annotate(ToolExecutionClass, "readonly");
-const makeFanOutReviewerDefinition = (options, delegation) => Agent.define("pr-fanout-reviewer", {
-	input: ReviewMission,
-	output: CodeReview,
-	instructions: makeFanOutReviewInstructions(options),
-	toolkit: Toolkit.make(ListReviewUnits, delegationToolFor(delegation)),
-	policy: defaultFanOutPolicy,
-	description: "Coordinate deterministic general/specialist discovery and independent candidate verification over bounded review units.",
-	metadata: {
-		deploymentClass: "E",
-		surface: "read-only",
-		delegation: "S1-attached",
-		assurance: "multi-pass"
+	const confirmed = [];
+	let rejectedCandidates = 0;
+	let unsettledCandidates = 0;
+	let completedVerificationPasses = 0;
+	const requiredVerificationPasses = candidates.length > 0 ? 1 : 0;
+	if (candidates.length > 0) {
+		const workId = `${unit.unitId}-verification`;
+		const brief = FileReviewBrief.make({
+			phase: "verification",
+			workId,
+			unitId: unit.unitId,
+			paths: unit.paths,
+			evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+			perspective: "candidate-verification",
+			riskCategories: unit.riskCategories,
+			candidates,
+			evidence
+		});
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			unsettledCandidates = candidates.length;
+			failedPasses.push(FailedReviewPass.make({
+				workId,
+				stage: "verification",
+				errorTag: outcome.errorTag
+			}));
+		} else {
+			turns += outcome.turns;
+			completedVerificationPasses = 1;
+			const byId = new Map(candidates.map((candidate) => [candidate.candidateId, candidate]));
+			for (const assessment of outcome.report.assessments) {
+				const candidate = byId.get(assessment.candidateId);
+				if (candidate === void 0) continue;
+				if (assessment.disposition === "confirmed") confirmed.push({
+					assessment,
+					candidate
+				});
+				else rejectedCandidates += 1;
+			}
+		}
 	}
-});
-const makeFanOutReviewSuite = (options = {}) => {
-	const child = makeFileReviewerDefinition({ guidance: options.guidance });
-	const delegation = makeFileReviewDelegation(child);
 	return {
-		child,
-		parent: makeFanOutReviewerDefinition(options, delegation),
-		delegation
+		failedPasses,
+		discoveredCandidates: candidates.length,
+		confirmed,
+		rejectedCandidates,
+		unsettledCandidates,
+		discardedFindings,
+		walkthrough,
+		turns,
+		completedGeneralPasses,
+		completedSpecialistPasses,
+		requiredVerificationPasses,
+		completedVerificationPasses,
+		unreviewedPaths: failedPasses.length > 0 ? unit.paths : []
 	};
+});
+const countNoun = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+const composeSummary = (plan, assurance) => {
+	const requiredDiscovery = assurance.requiredGeneralDiscoveryPasses + assurance.requiredSpecialistPasses;
+	const completedDiscovery = assurance.completedGeneralDiscoveryPasses + assurance.completedSpecialistPasses;
+	const parts = [`Reviewed ${countNoun(plan.totalFiles, "changed file")} across ${countNoun(plan.units.length, "bounded unit")}: ${completedDiscovery}/${requiredDiscovery} discovery and ${assurance.completedVerificationPasses}/${assurance.requiredVerificationPasses} verification pass(es) settled; ${assurance.confirmedCandidates} of ${countNoun(assurance.discoveredCandidates, "discovered candidate")} confirmed by independent verification.`];
+	if (assurance.failedPasses.length > 0) parts.push(`${countNoun(assurance.failedPasses.length, "pass")} did not settle; the affected paths are carried forward and retried on the next run. This is a reviewer-side gap, not a code defect.`);
+	if (assurance.discardedInvalidFindings > 0) parts.push(`${countNoun(assurance.discardedInvalidFindings, "candidate")} discarded for anchors or paths outside the assigned evidence.`);
+	if (plan.undiffablePaths.length > 0) parts.push(`${countNoun(plan.undiffablePaths.length, "path")} had no reviewable textual evidence and keep input coverage incomplete; exclude such paths with ignore globs when that is intended.`);
+	if (plan.unassignedPaths.length > 0 || plan.unassignedEvidenceShardCount > 0) parts.push("The changeset exceeded the bounded fan-out capacity; unassigned scope is reported under input coverage.");
+	parts.push("No configured pipeline can prove absence of defects; this describes settled work only.");
+	return parts.join(" ").slice(0, 4e3);
 };
-const defaultSuite = makeFanOutReviewSuite();
-const FileReviewer = defaultSuite.child;
-const FanOutReviewer = defaultSuite.parent;
-const fileReviewDelegation = defaultSuite.delegation;
-const DelegateFileReview = delegationToolFor(fileReviewDelegation);
-const FanOutReviewToolkit = FanOutReviewer.toolkit;
-const FileReviewDelegationFailure = fileReviewDelegation.containedFailure;
-const fanOutHandlersLayerFor = (delegation) => (childBinding) => SubagentRuntime.layer(delegation, childBinding, { mapChildFailure: mapFileReviewChildFailure });
-const fanOutHandlersLayer = fanOutHandlersLayerFor(fileReviewDelegation);
+/**
+* Run the complete host-scheduled fan-out pipeline over one selected
+* changeset snapshot: plan, independent discovery, exact verification, and a
+* deterministic host-composed CodeReview from verifier-confirmed candidates
+* only. The verdict is derived from confirmed severities, never model prose.
+*/
+const runFanOutReview = (binding, input) => Effect.gen(function* () {
+	const plan = planReviewUnits(input.files, { totalChangedFiles: input.totalChangedFiles });
+	const passesByUnit = /* @__PURE__ */ new Map();
+	for (const pass of plan.discoveryPasses) {
+		const passes = passesByUnit.get(pass.unitId) ?? [];
+		passes.push(pass);
+		passesByUnit.set(pass.unitId, passes);
+	}
+	const outcomes = yield* Effect.forEach(plan.units, (unit) => reviewUnit(binding, unit, passesByUnit.get(unit.unitId) ?? [], input), { concurrency: 4 });
+	const failedPasses = outcomes.flatMap((outcome) => outcome.failedPasses);
+	const unsettledCandidates = outcomes.reduce((total, outcome) => total + outcome.unsettledCandidates, 0);
+	const reasons = [];
+	if (failedPasses.length > 0) reasons.push(boundedListReason("configured review passes did not settle", failedPasses.map((pass) => `${pass.workId} (${pass.errorTag})`)));
+	if (unsettledCandidates > 0) reasons.push(`${unsettledCandidates} discovered candidate(s) did not receive exact verification`);
+	const requiredSpecialistPasses = plan.discoveryPasses.filter((pass) => pass.perspective === "risk-specialist").length;
+	const confirmed = outcomes.flatMap((outcome) => outcome.confirmed);
+	const assurance = ReviewAssurance.make({
+		status: reasons.length === 0 ? "settled" : "incomplete",
+		requiredGeneralDiscoveryPasses: plan.discoveryPasses.length - requiredSpecialistPasses,
+		completedGeneralDiscoveryPasses: outcomes.reduce((total, outcome) => total + outcome.completedGeneralPasses, 0),
+		requiredSpecialistPasses,
+		completedSpecialistPasses: outcomes.reduce((total, outcome) => total + outcome.completedSpecialistPasses, 0),
+		requiredVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.requiredVerificationPasses, 0),
+		completedVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.completedVerificationPasses, 0),
+		discoveredCandidates: outcomes.reduce((total, outcome) => total + outcome.discoveredCandidates, 0),
+		confirmedCandidates: confirmed.length,
+		rejectedCandidates: outcomes.reduce((total, outcome) => total + outcome.rejectedCandidates, 0),
+		unsettledCandidates,
+		discardedInvalidFindings: outcomes.reduce((total, outcome) => total + outcome.discardedFindings, 0),
+		failedPasses,
+		reasons
+	});
+	const findings = rankAndDedupeFindings(confirmed.flatMap(({ assessment, candidate }) => candidate._tag === "FindingCandidate" ? [confirmedFindingForPublication(assessment, candidate)] : []));
+	const concerns = rankAndDedupeConcerns(confirmed.flatMap(({ candidate }) => candidate._tag === "ConcernCandidate" ? [candidate.concern] : []));
+	const walkthrough = outcomes.flatMap((outcome) => outcome.walkthrough);
+	const blocking = findings.some((finding) => finding.severity === "blocking") || concerns.some((concern) => concern.severity === "blocking");
+	return {
+		review: CodeReview.make({
+			summary: composeSummary(plan, assurance),
+			verdict: blocking ? "request-changes" : findings.length > 0 || concerns.length > 0 ? "comment" : "approve",
+			findings,
+			...concerns.length === 0 ? {} : { concerns },
+			...walkthrough.length === 0 ? {} : { walkthrough }
+		}),
+		assurance,
+		plan,
+		unreviewedPaths: [.../* @__PURE__ */ new Set([
+			...outcomes.flatMap((outcome) => outcome.unreviewedPaths),
+			...plan.unassignedPaths,
+			...plan.partialEvidencePaths,
+			...plan.undiffablePaths
+		])].sort(),
+		turns: outcomes.reduce((total, outcome) => total + outcome.turns, 0)
+	};
+});
 //#endregion
 //#region src/internal/fingerprint.ts
 const MARKER_PREFIX = "<!-- effect-agent-pr-review fingerprint=sha256:";
@@ -1410,16 +1709,21 @@ var StoredReviewConcern = class extends Schema.Class("@effect-agent/pr-review/St
 	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
 	body: StoredText
 }) {};
+/** The carried-scope bound; a run that cannot fit its leftovers publishes no state. */
+const MAX_STORED_UNREVIEWED_PATHS = 100;
 /**
-* Versioned state embedded only after complete input assignment and settled
-* configured review assurance. The head plus full-scope fingerprint forms an
-* incremental baseline; an absent unresolved item never means the path is
-* defect-free. The `acceptedScopeFingerprint` name is retained for wire
-* compatibility. Storing hundreds of path strings separately would not fit
-* GitHub's bounded review body in the worst case.
+* Versioned state embedded after EVERY completed run that can be signed. The
+* head plus full-scope fingerprint forms an incremental baseline; an absent
+* unresolved item never means the path is defect-free. `unreviewedPaths`
+* carries retryable review gaps (failed passes) forward so the next
+* incremental run re-reviews exactly them plus the new delta — the baseline
+* advances monotonically instead of freezing on one flaky pass and reopening
+* the whole post-baseline scope. The `acceptedScopeFingerprint` name is
+* retained for wire compatibility. Storing hundreds of path strings
+* separately would not fit GitHub's bounded review body in the worst case.
 */
 var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewState")({
-	version: Schema.Literal(1),
+	version: Schema.Literal(2),
 	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
 	pullRequestNumber: Schema.Int.check(Schema.isGreaterThan(0)),
 	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
@@ -1434,6 +1738,14 @@ var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewStat
 	})),
 	unresolvedFindings: Schema.Array(StoredReviewFinding).check(Schema.isMaxLength(20)),
 	unresolvedConcerns: Schema.Array(StoredReviewConcern).check(Schema.isMaxLength(10)),
+	/** Retryable review gaps carried into the next incremental run's scope. */
+	unreviewedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(100)),
+	/**
+	* True only when the producing run had complete input coverage, no
+	* unsettled pass, and nothing carried. Skip-unchanged authority: an
+	* unchanged patch may skip re-review only over a settled state.
+	*/
+	settled: Schema.Boolean,
 	lastReviewMode: ReviewScopeMode
 }) {};
 const toStoredFinding = (finding) => StoredReviewFinding.make({
@@ -1462,12 +1774,12 @@ const fromStoredConcern = (concern) => ReviewConcern.make({
 	title: concern.title,
 	body: concern.body
 });
-const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v1:";
+const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v2:";
 const STATE_MARKER_SUFFIX = " -->";
-const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v1:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
-const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v1\0";
+const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v2:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
+const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v2\0";
 const MAX_REVIEW_STATE_MARKER_CHARS = 24e3;
-const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
+const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v2:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
 var ReviewStateAuthenticationFailure = class extends Schema.TaggedError()("ReviewStateAuthenticationFailure", {
 	operation: Schema.Literals(["sign", "verify"]),
 	reason: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
@@ -1620,13 +1932,17 @@ const selectReviewRange = (input) => {
 	const currentPaths = new Set(input.fullFiles.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]));
 	const selectedByPath = /* @__PURE__ */ new Map();
 	for (const file of comparison.files) if (currentPaths.has(file.path) || file.previousPath !== void 0 && currentPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
-	if (input.priorState.baseSha !== input.current.baseSha) {
-		for (const file of input.fullFiles) if (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const carriedPaths = new Set(input.priorState.unreviewedPaths.filter((path) => currentPaths.has(path)));
+	for (const path of carriedPaths) affectedPaths.add(path);
+	const rescuePaths = input.priorState.baseSha !== input.current.baseSha;
+	if (rescuePaths || carriedPaths.size > 0) {
+		for (const file of input.fullFiles) if (rescuePaths && (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath)) || carriedPaths.has(file.path) || file.previousPath !== void 0 && carriedPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
 	}
 	const selectedFiles = [...selectedByPath.values()].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+	const carriedReason = carriedPaths.size === 0 ? "" : `; retrying ${carriedPaths.size} carried unreviewed path(s)`;
 	return {
 		mode: "incremental",
-		reason: `changes since settled review head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}`,
+		reason: `changes since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}${carriedReason}`,
 		files: selectedFiles,
 		affectedPaths: [...affectedPaths].sort(),
 		totalFiles: selectedFiles.length,
@@ -1725,7 +2041,7 @@ var ReviewRetirementReport = class extends Schema.Class("@effect-agent/pr-review
 const findingIdentity = (finding) => `${finding.path}\u0000${finding.startLine}\u0000${finding.endLine}\u0000${finding.title}`;
 const REVIEW_METADATA_PATTERN = /<!-- effect-agent-pr-review metadata\n[\s\S]*?\n-->/g;
 const FINGERPRINT_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:[0-9a-f]{64} -->/g;
-const STATE_PATTERN = /<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
+const STATE_PATTERN = /<!-- effect-agent-pr-review state-v\d+:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
 const RETIRED_ORIGINAL_PATTERN = /<!-- effect-agent-pr-review retired-original:start -->\n([\s\S]*?)\n<!-- effect-agent-pr-review retired-original:end -->/;
 const MACHINE_COMMENT_PATTERN = new RegExp(`${REVIEW_METADATA_PATTERN.source}|${FINGERPRINT_PATTERN.source}|${STATE_PATTERN.source}`, "g");
 const VERDICT_CALLOUT_PATTERN = /^(?:> \[!(?:CAUTION|IMPORTANT)\]\n> [^\n]*(?:\n> [^\n]*)*|> (?:ℹ️|✅)[^\n]*)\n*/;
@@ -2298,6 +2614,6 @@ const fingerprintUnchanged = (current) => Effect.gen(function* () {
 	return Option.isSome(latest) && latest.value === current;
 });
 //#endregion
-export { DiscoveredConcern as $, normalizeRepoRelativePath as $n, ReviewPassId as $t, ReviewStateAuthenticator as A, ReviewConcern as An, defaultFanOutPolicy as At, selectedPullRequestSourceLayer as B, fileReviewEvidenceChunks as Bn, makeFileReviewerInstructions as Bt, MAX_REVIEW_STATE_MARKER_CHARS as C, MAX_PATCH_CHARS as Cn, MAX_UNIT_CANDIDATES as Ct, ReviewScopeMode as D, REVIEW_TOOL_RESULT_MAX_BYTES as Dn, ReviewWorkPhase as Dt, ReviewMode as E, PullRequestReviewer as En, ReviewWorkPerspective as Et, buildProfileMission as F, ReviewVerdict as Fn, fileReviewDelegation as Ft, webCryptoReviewStateAuthenticatorLayer as G, resolveGuidance as Gn, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as Gt, toStoredFinding as H, makeReviewInstructions as Hn, reviewCandidateSubjectKey as Ht, computeProfileFingerprint as I, WalkthroughEntry as In, fileReviewPolicy as It, extractFingerprint as J, MAX_FILE_CHARS as Jn, MAX_UNIT_FILES as Jt, FINGERPRINT_MARKER_LENGTH as K, reviewInstructions as Kn, MAX_REVIEW_UNITS as Kt, fromStoredConcern as L, clampMaxFindings as Ln, fileReviewerInstructions as Lt, ReviewStateMarkerTooLarge as M, ReviewMission as Mn, fanOutHandlersLayer as Mt, StoredReviewConcern as N, ReviewToolkit as Nn, fanOutHandlersLayerFor as Nt, ReviewState as O, ReadFile as On, assessmentSettlesSuggestionExactly as Ot, StoredReviewFinding as P, ReviewToolkitLayer as Pn, fanOutReviewInstructions as Pt, DelegateFileReview as Q, ReviewInputViolation as Qn, ReviewEvidenceShardId as Qt, fromStoredFinding as R, defaultReviewPolicy as Rn, makeFanOutReviewInstructions as Rt, GitCommitSha as S, MAX_FINDINGS as Sn, MAX_REVIEW_CHILDREN as St, ReviewHeadComparison as T, MAX_WALKTHROUGH_SUMMARY_CHARS as Tn, ReviewCandidateId as Tt, unavailableReviewStateAuthenticatorLayer as U, readFileDiffHandler as Un, MAX_FILE_EVIDENCE_CHARS as Ut, toStoredConcern as V, listChangedFilesHandler as Vn, mapFileReviewChildFailure as Vt, validateReviewState as W, readFileHandler as Wn, MAX_MERGED_FINDINGS as Wt, CandidateAssessment as X, PullRequestSource as Xn, ReviewDiscoveryPerspective as Xt, renderFingerprintMarker as Y, PullRequestMetadata as Yn, ReviewDiscoveryPass as Yt, ConcernCandidate as Z, PullRequestSourceFailure as Zn, ReviewEvidenceShard as Zt, ReviewRetirementHost as _, FindingCategory as _n, ListReviewUnits as _t, PriorReviews as a, UNIT_EVIDENCE_CHAR_BUDGET as an, annotatePatch as ar, FileReviewDelegationFailure as at, hasReviewMetadataMarker as b, ListChangedFilesQuery as bn, MAX_CHILD_FINDINGS as bt, fingerprintUnchanged as c, planReviewUnits as cn, isReviewableFile as cr, FileReviewReport as ct, gitHubReviewPublisherLayer as d, ChangedFilesView as dn, FileReviewToolkitLayer as dt, ReviewRiskCategory as en, anchorViolation as er, FanOutCoordinatorToolkit as et, gitHubReviewRetirementHostLayer as f, CodeReview as fn, FileReviewUnitFailed as ft, ReviewRetirementFailure as g, FileSliceQuery as gn, FindingCandidate as gt, RetirableReviewComment as h, FileSlice as hn, FileReviewer as ht, PriorReviewLookupFailure as i, UNIT_CHANGED_LINE_BUDGET as in, MAX_REVIEW_CONTENT_CHARS as ir, FileReviewBrief as it, ReviewStateMarker as j, ReviewFinding as jn, defaultFileReviewerPolicy as jt, ReviewStateAuthenticationFailure as k, ReadFileDiff as kn, confirmedFindingForPublication as kt, gitHubPriorReviewsLayer as l, rankAndDedupeFindings as ln, parsePatch as lr, FileReviewRequest as lt, RetirableReview as m, FileDiffView as mn, FileReviewWorkRejected as mt, GitHubApiFailure as n, ReviewUnitId as nn, ChangedFileStatus as nr, FanOutReviewToolkit as nt, PublishedReview as o, classifyReviewRisks as on, commentableLines as or, FileReviewEvidence as ot, parseGitHubSubmittedAt as p, FileDiffQuery as pn, FileReviewUnitResult as pt, computeChangesetFingerprint as q, MAX_CHANGED_FILES as qn, MAX_UNIT_EVIDENCE_SHARDS as qt, GitHubReviewTarget as r, ReviewUnitPlan as rn, ChangedPath as rr, FanOutReviewer as rt, ReviewPublisher as s, findingAnchorInUnitEvidence as sn, hasReviewableContent as sr, FileReviewFailure as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, ReviewUnit as tn, ChangedFile as tr, FanOutCoordinatorToolkitLayer as tt, gitHubPullRequestSourceLayer as u, ChangedFileSummary as un, renderReviewContent as ur, FileReviewToolkit as ut, ReviewRetirementReport as v, FindingSeverity as vn, ListReviewUnitsQuery as vt, ReviewExecutionContext as w, MAX_WALKTHROUGH_ENTRIES as wn, ReviewCandidate as wt, retireStaleReviews as x, MAX_CONCERNS as xn, MAX_FILE_REVIEW_TOOL_CALLS as xt, decideReviewRetirement as y, ListChangedFiles as yn, MAX_CHILD_CONCERNS as yt, selectReviewRange as z, fileDiffView as zn, makeFanOutReviewSuite as zt };
+export { DiscoveredConcern as $, commentableLines as $n, boundedListReason as $t, ReviewStateAuthenticationFailure as A, clampMaxFindings as An, MAX_UNIT_FILES as At, selectReviewRange as B, MAX_CHANGED_FILES as Bn, UNIT_CHANGED_LINE_BUDGET as Bt, MAX_REVIEW_STATE_MARKER_CHARS as C, ReviewConcern as Cn, reviewCandidateSubjectKey as Ct, ReviewMode as D, ReviewToolkitLayer as Dn, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as Dt, ReviewHeadComparison as E, ReviewToolkit as En, MAX_MERGED_FINDINGS as Et, StoredReviewFinding as F, makeReviewInstructions as Fn, ReviewPassId as Ft, validateReviewState as G, ReviewInputViolation as Gn, rankAndDedupeConcerns as Gt, toStoredConcern as H, PullRequestMetadata as Hn, classifyReviewRisks as Ht, buildProfileMission as I, readFileDiffHandler as In, ReviewRiskCategory as It, computeChangesetFingerprint as J, ChangedFile as Jn, FailedReviewUnit as Jt, webCryptoReviewStateAuthenticatorLayer as K, normalizeRepoRelativePath as Kn, rankAndDedupeFindings as Kt, computeProfileFingerprint as L, readFileHandler as Ln, ReviewUnit as Lt, ReviewStateMarker as M, fileDiffView as Mn, ReviewDiscoveryPerspective as Mt, ReviewStateMarkerTooLarge as N, fileReviewEvidenceChunks as Nn, ReviewEvidenceShard as Nt, ReviewScopeMode as O, ReviewVerdict as On, MAX_REVIEW_UNITS as Ot, StoredReviewConcern as P, listChangedFilesHandler as Pn, ReviewEvidenceShardId as Pt, ConcernCandidate as Q, annotatePatch as Qn, assessFlatReview as Qt, fromStoredConcern as R, resolveGuidance as Rn, ReviewUnitId as Rt, GitCommitSha as S, ReadFileDiff as Sn, makeFileReviewerInstructions as St, ReviewExecutionContext as T, ReviewMission as Tn, MAX_FILE_EVIDENCE_CHARS as Tt, toStoredFinding as U, PullRequestSource as Un, findingAnchorInUnitEvidence as Ut, selectedPullRequestSourceLayer as V, MAX_FILE_CHARS as Vn, UNIT_EVIDENCE_CHAR_BUDGET as Vt, unavailableReviewStateAuthenticatorLayer as W, PullRequestSourceFailure as Wn, planReviewUnits as Wt, renderFingerprintMarker as X, ChangedPath as Xn, ReviewCoverage as Xt, extractFingerprint as Y, ChangedFileStatus as Yn, ReviewAssurance as Yt, CandidateAssessment as Z, MAX_REVIEW_CONTENT_CHARS as Zn, ReviewInputCoverage as Zt, ReviewRetirementHost as _, MAX_WALKTHROUGH_ENTRIES as _n, assessmentSettlesSuggestionExactly as _t, PriorReviews as a, CodeReview as an, FindingCandidate as at, hasReviewMetadataMarker as b, REVIEW_TOOL_RESULT_MAX_BYTES as bn, fileReviewerInstructions as bt, fingerprintUnchanged as c, FileSlice as cn, MAX_FILE_REVIEW_TOOL_CALLS as ct, gitHubReviewPublisherLayer as d, FindingSeverity as dn, REVIEW_UNIT_CONCURRENCY as dt, compatibilityCoverage as en, hasReviewableContent as er, FileReviewBrief as et, gitHubReviewRetirementHostLayer as f, ListChangedFiles as fn, ReviewCandidate as ft, ReviewRetirementFailure as g, MAX_PATCH_CHARS as gn, ReviewWorkPhase as gt, RetirableReviewComment as h, MAX_FINDINGS as hn, ReviewWorkPerspective as ht, PriorReviewLookupFailure as i, ChangedFilesView as in, FileReviewer as it, ReviewStateAuthenticator as j, defaultReviewPolicy as jn, ReviewDiscoveryPass as jt, ReviewState as k, WalkthroughEntry as kn, MAX_UNIT_EVIDENCE_SHARDS as kt, gitHubPriorReviewsLayer as l, FileSliceQuery as ln, MAX_REVIEW_CHILDREN as lt, RetirableReview as m, MAX_CONCERNS as mn, ReviewPassMisbehaved as mt, GitHubApiFailure as n, flatAssurance as nn, parsePatch as nr, FileReviewReport as nt, PublishedReview as o, FileDiffQuery as on, MAX_CHILD_CONCERNS as ot, parseGitHubSubmittedAt as p, ListChangedFilesQuery as pn, ReviewCandidateId as pt, FINGERPRINT_MARKER_LENGTH as q, anchorViolation as qn, FailedReviewPass as qt, GitHubReviewTarget as r, ChangedFileSummary as rn, renderReviewContent as rr, FileReviewToolkit as rt, ReviewPublisher as s, FileDiffView as sn, MAX_CHILD_FINDINGS as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, fanOutInputCoverage as tn, isReviewableFile as tr, FileReviewEvidence as tt, gitHubPullRequestSourceLayer as u, FindingCategory as un, MAX_UNIT_CANDIDATES as ut, ReviewRetirementReport as v, MAX_WALKTHROUGH_SUMMARY_CHARS as vn, confirmedFindingForPublication as vt, MAX_STORED_UNREVIEWED_PATHS as w, ReviewFinding as wn, runFanOutReview as wt, retireStaleReviews as x, ReadFile as xn, makeFileReviewerDefinition as xt, decideReviewRetirement as y, PullRequestReviewer as yn, defaultFileReviewerPolicy as yt, fromStoredFinding as z, reviewInstructions as zn, ReviewUnitPlan as zt };
 
-//# sourceMappingURL=github-BgtP7Rdv.mjs.map
+//# sourceMappingURL=github-BbwYzNrC.mjs.map