@effect-agent/pr-review 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/{github-BbwYzNrC.mjs → github-NjgxGqwM.mjs}

@@ -1,4 +1,4 @@
-import { Context, DateTime, Effect, Encoding, Layer, Option, Redacted, Result, Schema } from "effect";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Option, Redacted, Result, Schema } from "effect";
 import { Agent, AgentPolicy, AgentRuntime, ToolExecutionClass, ToolResultBounds } from "effect-agent";
 import { Tool, Toolkit } from "effect/unstable/ai";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
@@ -169,18 +169,6 @@ const annotatePatch = (patch) => {
 	return output.join("\n");
 };
 //#endregion
-//#region src/internal/anchors.ts
-/** Why a finding cannot anchor to the current new-version diff, if any. */
-const anchorViolation = (finding, files) => {
-	const file = files.find((candidate) => candidate.path === finding.path);
-	if (file === void 0) return "path is not part of the changeset";
-	if (file.patch === void 0) return "file has no anchorable textual diff";
-	if (finding.endLine < finding.startLine) return "endLine precedes startLine";
-	if (finding.endLine - finding.startLine + 1 > 100) return "range is implausibly large";
-	const anchors = commentableLines(file.patch);
-	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!anchors.has(line)) return `line ${line} is not part of the diff`;
-};
-//#endregion
 //#region src/internal/source.ts
 /** Reading a file head version larger than this is refused, never truncated silently. */
 const MAX_FILE_CHARS = 2e5;
@@ -442,6 +430,8 @@ const ReviewToolkitLayer = ReviewToolkit.toLayer({
 	read_file_diff: readFileDiffHandler,
 	read_file: readFileHandler
 });
+/** Bounded prior-review context lines injected into reviewer instructions. */
+const ReviewContextLines = Schema.Array(Schema.String.check(Schema.isMaxLength(1200))).check(Schema.isMaxLength(20));
 var ReviewMission = class extends Schema.Class("@effect-agent/pr-review/ReviewMission")({
 	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
 	number: Schema.Int.check(Schema.isGreaterThan(0)),
@@ -449,7 +439,19 @@ var ReviewMission = class extends Schema.Class("@effect-agent/pr-review/ReviewMi
 	body: Schema.String.check(Schema.isMaxLength(2e4)),
 	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
 	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	changedFileCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+	changedFileCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/**
+	* Maintainer-adjudicated identities rendered as bounded context lines; the
+	* reviewer must not re-raise them without materially new evidence. Absent
+	* from fingerprint missions so an adjudication never invalidates the
+	* skip-unchanged authority.
+	*/
+	adjudicatedContext: Schema.optionalKey(ReviewContextLines),
+	/**
+	* Prior-round findings on re-reviewed scope, rendered as bounded context
+	* lines; each must be confirmed, declared fixed, or explicitly withdrawn.
+	*/
+	priorFindingContext: Schema.optionalKey(ReviewContextLines)
 }) {};
 const FindingSeverity = Schema.Literals([
 	"blocking",
@@ -494,10 +496,14 @@ const ReviewVerdict = Schema.Literals([
 * A concern with no diff line to anchor to: a missing deletion or cleanup,
 * rollout or migration sequencing, a coverage gap the diff implies but does
 * not add, or a scope question only the author can answer. Rendered as a
-* review-body section — never as an inline comment, so it needs no anchor and
-* is never demoted.
+* review-body section instead of an inline comment. `evidencePaths` binds the
+* concern to changed files so a later incremental review can invalidate and
+* recheck it when any supporting path changes. It remains optional only for
+* decoding review output and continuity state written before path binding was
+* introduced; a pathless concern cannot authorize incremental continuity.
 */
 var ReviewConcern = class extends Schema.Class("@effect-agent/pr-review/ReviewConcern")({
+	evidencePaths: Schema.optionalKey(Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))),
 	severity: FindingSeverity,
 	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
 	body: Schema.NonEmptyString.check(Schema.isMaxLength(2e3))
@@ -537,6 +543,8 @@ const makeReviewInstructions = (options = {}) => (mission) => {
 		`You are a senior code reviewer for pull request #${mission.number} ("${mission.title}") in ${mission.repository}, merging ${mission.headRef} into ${mission.baseRef}. It changes ${mission.changedFileCount} file(s).`,
 		mission.body.length > 0 ? `Author description:\n${mission.body}` : "The author provided no description.",
 		...resolveGuidance(options.guidance, mission),
+		...mission.adjudicatedContext === void 0 || mission.adjudicatedContext.length === 0 ? [] : ["A maintainer has adjudicated these previously raised review items (disposition, reason). Do not re-raise them unless you have materially new evidence, and if you do, say explicitly what changed since the adjudication:", ...mission.adjudicatedContext.map((line) => `- ${line}`)],
+		...mission.priorFindingContext === void 0 || mission.priorFindingContext.length === 0 ? [] : ["Your previous review raised these findings on the scope you are re-reviewing. For each, either confirm it still holds, state that it is fixed, or withdraw it; do not demand the opposite of your own prior guidance without explicitly acknowledging the reversal:", ...mission.priorFindingContext.map((line) => `- ${line}`)],
 		"Work in this order:",
 		"1. Call list_changed_files once to see the selected input scope. In incremental reviews it is deliberately a subset of the pull request's full diff (totalFiles counts the whole pull request); omitted paths belong to settled prior scope or explicit host exclusions, not to this run.",
 		"2. Call read_file_diff for every listed file. A normal diff marks new-version anchors as R<number>; only those numbers are valid startLine/endLine values. When GitHub omitted a diff, the tool may return bounded base/head content marked B/H instead. Review that content, but report its defects as non-anchored concerns because B/H lines cannot anchor GitHub comments. Never anchor a finding to a removed (-), B, or H line.",
@@ -545,9 +553,9 @@ const makeReviewInstructions = (options = {}) => (mission) => {
 		"When the diff adds or changes a test, check that it can actually fail: a test that would still pass with the bug present is theatre, not coverage. The usual tell is a loose assertion standing where an exact one belongs — >= or a truthiness check over an expected value, or a snapshot that absorbs whatever it is handed.",
 		"Go shallow only when the diff has no behavioral surface at all: doc typos, formatting, lockfile or generated-code regeneration, a mechanical rename. Line count is not the signal — a one-line change to auth, money, SQL, a comparison operator, or a config default is not trivial.",
 		"Drop bloat-shaped findings before reporting: defensive checks for cases that cannot happen, abstractions used once, comments restating obvious code, tests asserting tautologies, just-in-case guards. A finding must be sound, correct, and worth acting on; prefer an explicit keep over an invented finding.",
-		"5. After collecting anchored findings, deliberately scan for concerns with NO line to point at: deletion or cleanup plans for code the diff replaces, rollout or migration sequencing, coverage gaps the diff implies but does not add, scope questions only the author can answer. Report each as a \"concern\", never as a finding with an invented anchor; report none when none exist.",
+		"5. After collecting anchored findings, deliberately scan for concerns with NO line to point at: deletion or cleanup plans for code the diff replaces, rollout or migration sequencing, coverage gaps the diff implies but does not add, scope questions only the author can answer. Report each as a \"concern\", never as a finding with an invented anchor. Every concern must list 1-3 exact changed evidencePaths that support it so later incremental reviews can recheck it when those files change. Report none when none exist, and never split one root concern into differently worded restatements.",
 		`6. Write a walkthrough: for every file whose evidence you examined, one factual sentence (<= 240 chars) describing what changed in that file — written for a reader scanning the pull request, never restating the diff line by line. Use only paths from list_changed_files; invented paths are dropped.`,
-		"7. Then return ONLY a JSON object — no Markdown fences, no prose before or after — exactly this shape: {\"summary\": <string, 1-3 paragraphs of overall assessment>, \"verdict\": <\"approve\" | \"comment\" | \"request-changes\">, \"findings\": [{\"path\": <string, a changed file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL: \"correctness\" | \"security\" | \"concurrency\" | \"performance\" | \"resources\" | \"error-handling\" | \"testing\" | \"maintainability\" | \"style\" | \"docs\">, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement text for exactly lines startLine..endLine, ready to commit>}], \"concerns\": <array, OPTIONAL: [{\"severity\": <\"blocking\" | \"important\" | \"nit\">, \"title\": <string, <= 120 chars>, \"body\": <string>}], only for step-5 concerns with no valid anchor — never duplicate a finding here>, \"walkthrough\": <array, OPTIONAL: [{\"path\": <string, a changed file path>, \"summary\": <string, the step-6 sentence>}], one entry per reviewed file>}.",
+		"7. Then return ONLY a JSON object — no Markdown fences, no prose before or after — exactly this shape: {\"summary\": <string, 1-3 paragraphs of overall assessment>, \"verdict\": <\"approve\" | \"comment\" | \"request-changes\">, \"findings\": [{\"path\": <string, a changed file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL: \"correctness\" | \"security\" | \"concurrency\" | \"performance\" | \"resources\" | \"error-handling\" | \"testing\" | \"maintainability\" | \"style\" | \"docs\">, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement text for exactly lines startLine..endLine, ready to commit>}], \"concerns\": <array, OPTIONAL: [{\"evidencePaths\": <array of 1-3 exact changed file paths>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"title\": <string, <= 120 chars>, \"body\": <string>}], only for step-5 concerns with no valid anchor — never duplicate a finding here>, \"walkthrough\": <array, OPTIONAL: [{\"path\": <string, a changed file path>, \"summary\": <string, the step-6 sentence>}], one entry per reviewed file>}.",
 		`Report at most ${maxFindings} findings and at most 10 concerns; prefer the most important ones. An empty findings array with verdict "approve" is a valid review. Include "suggestion" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement for every line in the range and nothing else.`,
 		"Use verdict \"request-changes\" only when at least one finding or concern is \"blocking\". Line anchors you invent will be discarded, so copy R-numbers from read_file_diff output."
 	].join("\n");
@@ -579,1612 +587,2108 @@ const PullRequestReviewer = Agent.define("pr-reviewer", {
 	}
 });
 //#endregion
-//#region src/internal/coverage.ts
-var FailedReviewUnit = class extends Schema.Class("@effect-agent/pr-review/FailedReviewUnit")({
-	unitId: Schema.NonEmptyString.check(Schema.isMaxLength(32)),
-	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+//#region src/internal/review-state.ts
+const ReviewMode = Schema.Literals(["incremental", "final"]);
+const ReviewScopeMode = Schema.Literals(["incremental", "full"]);
+const GitCommitSha = Schema.NonEmptyString.check(Schema.isMaxLength(64), Schema.isPattern(/^[0-9a-f]{40,64}$/));
+const Fingerprint = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+const StoredText = Schema.NonEmptyString.check(Schema.isMaxLength(800));
+/** A compact unresolved finding suitable for the bounded review-body marker. */
+var StoredReviewFinding = class extends Schema.Class("@effect-agent/pr-review/StoredReviewFinding")({
+	path: ChangedPath,
+	startLine: Schema.Int.check(Schema.isGreaterThan(0)),
+	endLine: Schema.Int.check(Schema.isGreaterThan(0)),
+	severity: FindingSeverity,
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	body: StoredText
 }) {};
+/** A compact unresolved non-anchored concern with its invalidation paths. */
+var StoredReviewConcern = class extends Schema.Class("@effect-agent/pr-review/StoredReviewConcern")({
+	/** Absent only on legacy state written before concern path binding. */
+	evidencePaths: Schema.optionalKey(Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))),
+	severity: FindingSeverity,
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	body: StoredText
+}) {};
+/** How a maintainer settled a previously raised finding or concern. */
+const AdjudicationDisposition = Schema.Literals([
+	"accepted-risk",
+	"refuted",
+	"obsolete"
+]);
+/** The adjudications bound carried by the ReviewState schema. */
+const MAX_STORED_ADJUDICATIONS = 20;
 /**
-* Compatibility diagnostic retained for callers that consumed the original
-* `coverage` field. New UI and state decisions use ReviewInputCoverage and
-* ReviewAssurance directly.
+* One maintainer adjudication of a finding or concern identity. Anchored
+* findings carry their full location identity; unanchored concerns are
+* identified by title alone, so the location fields stay absent.
 */
-var ReviewCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewCoverage")({
-	status: Schema.Literals(["complete", "incomplete"]),
-	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	reviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	unreviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	failedUnits: Schema.Array(FailedReviewUnit).check(Schema.isMaxLength(8)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+const StoredAdjudicationFields = Schema.Struct({
+	path: Schema.optionalKey(ChangedPath),
+	startLine: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0))),
+	endLine: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0))),
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	disposition: AdjudicationDisposition,
+	reason: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(300))),
+	/** GitHub login of the maintainer whose comment adjudicated the identity. */
+	actor: Schema.NonEmptyString.check(Schema.isMaxLength(100))
+}).check(Schema.makeFilter((adjudication) => {
+	const locationParts = [
+		adjudication.path,
+		adjudication.startLine,
+		adjudication.endLine
+	].filter((part) => part !== void 0).length;
+	return locationParts === 0 || locationParts === 3 ? void 0 : "path, startLine, and endLine must be either all present or all absent";
+}, { title: "adjudication locations are complete or unanchored" }));
+var StoredAdjudication = class extends Schema.Class("@effect-agent/pr-review/StoredAdjudication")(StoredAdjudicationFields) {};
+/**
+* The one finding-identity composition shared by retirement, adjudication,
+* and settlement. A tagged JSON tuple keeps anchored findings in a namespace
+* disjoint from title-only concerns and remains unambiguous even when
+* untrusted path or title text contains delimiter characters.
+*/
+const findingIdentity = (finding) => JSON.stringify([
+	"finding",
+	finding.path,
+	finding.startLine,
+	finding.endLine,
+	finding.title
+]);
+/** The disjoint title-only identity namespace for unanchored concerns. */
+const concernIdentity = (concern) => JSON.stringify(["concern", concern.title]);
+/**
+* An adjudication's identity: the shared finding identity when anchored, the
+* disjoint concern identity when unanchored.
+*/
+const adjudicationIdentity = (adjudication) => adjudication.path !== void 0 && adjudication.startLine !== void 0 && adjudication.endLine !== void 0 ? findingIdentity({
+	path: adjudication.path,
+	startLine: adjudication.startLine,
+	endLine: adjudication.endLine,
+	title: adjudication.title
+}) : concernIdentity(adjudication);
+/** The carried-scope bound; a run that cannot fit its leftovers publishes no state. */
+const MAX_STORED_UNREVIEWED_PATHS = 100;
+/** Failed-pass records stored beside the leftover paths; one per unit stage. */
+const MAX_STORED_UNREVIEWED_PASSES = 24;
+/** Stages a leftover path may need retried without a second general discovery. */
+const UnreviewedStage = Schema.Literals([
+	"discovery",
+	"specialist",
+	"verification"
+]);
+/** One failed fan-out pass whose paths should be retried, not rediscovered. */
+var StoredUnreviewedPass = class extends Schema.Class("@effect-agent/pr-review/StoredUnreviewedPass")({
+	stage: UnreviewedStage,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
 }) {};
-var ReviewInputCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewInputCoverage")({
-	status: Schema.Literals(["complete", "incomplete"]),
-	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	assignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	/** Assigned paths whose model-visible diff was truncated by the evidence bound. */
-	partialPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	unassignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+/**
+* Versioned state embedded after EVERY completed run that can be signed. The
+* head plus full-scope fingerprint forms an incremental baseline; an absent
+* unresolved item never means the path is defect-free. `unreviewedPaths`
+* carries retryable review gaps (failed passes) forward so the next
+* incremental run re-reviews exactly them plus the new delta — the baseline
+* advances monotonically instead of freezing on one flaky pass and reopening
+* the whole post-baseline scope. Storing hundreds of path strings separately
+* would not fit GitHub's bounded review body in the worst case.
+*/
+var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewState")({
+	version: Schema.Literal(1),
+	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
+	pullRequestNumber: Schema.Int.check(Schema.isGreaterThan(0)),
+	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
+	baseSha: GitCommitSha,
+	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
+	reviewedHeadSha: GitCommitSha,
+	profileFingerprint: Fingerprint,
+	settledScopeFingerprint: Fingerprint,
+	reviewedPathCount: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 300
+	})),
+	unresolvedFindings: Schema.Array(StoredReviewFinding).check(Schema.isMaxLength(20)),
+	unresolvedConcerns: Schema.Array(StoredReviewConcern).check(Schema.isMaxLength(10)),
+	/** Retryable review gaps carried into the next incremental run's scope. */
+	unreviewedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(100)),
+	/** Which failed pass produced those leftovers. */
+	unreviewedPasses: Schema.Array(StoredUnreviewedPass).check(Schema.isMaxLength(24)),
 	/**
-	* Paths with neither a textual diff nor bounded base/head text (binaries,
-	* oversized files). Fail-closed: they keep the status incomplete for as
-	* long as they are part of the pull request — an unreviewable change must
-	* never authorize a green check. Exclude them deliberately with ignore
-	* globs when that is intended.
+	* True only when the producing run had complete input coverage, no
+	* unsettled pass, and nothing carried. Skip-unchanged authority: an
+	* unchanged patch may skip re-review only over a settled state.
 	*/
-	undiffablePaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(20))
+	settled: Schema.Boolean,
+	lastReviewMode: ReviewScopeMode,
+	/**
+	* Maintainer adjudications standing against this pull request. optionalKey
+	* so state markers signed before the field existed still decode.
+	*/
+	adjudications: Schema.optionalKey(Schema.Array(StoredAdjudication).check(Schema.isMaxLength(20)))
 }) {};
-var FailedReviewPass = class extends Schema.Class("@effect-agent/pr-review/FailedReviewPass")({
-	workId: Schema.NonEmptyString.check(Schema.isMaxLength(96)),
-	stage: Schema.Literals([
-		"discovery",
-		"specialist",
-		"verification"
-	]),
-	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+const toStoredFinding = (finding) => StoredReviewFinding.make({
+	path: finding.path,
+	startLine: finding.startLine,
+	endLine: finding.endLine,
+	severity: finding.severity,
+	title: finding.title,
+	body: finding.body.slice(0, 800)
+});
+const fromStoredFinding = (finding) => ReviewFinding.make({
+	path: finding.path,
+	startLine: finding.startLine,
+	endLine: finding.endLine,
+	severity: finding.severity,
+	title: finding.title,
+	body: finding.body
+});
+const toStoredConcern = (concern) => StoredReviewConcern.make({
+	...concern.evidencePaths === void 0 ? {} : { evidencePaths: concern.evidencePaths },
+	severity: concern.severity,
+	title: concern.title,
+	body: concern.body.slice(0, 800)
+});
+const fromStoredConcern = (concern) => ReviewConcern.make({
+	...concern.evidencePaths === void 0 ? {} : { evidencePaths: concern.evidencePaths },
+	severity: concern.severity,
+	title: concern.title,
+	body: concern.body
+});
+const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v1:";
+const STATE_MARKER_SUFFIX = " -->";
+const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v1:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
+const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v1\0";
+const MAX_REVIEW_STATE_MARKER_CHARS = 24e3;
+const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
+var ReviewStateAuthenticationFailure = class extends Schema.TaggedError()("ReviewStateAuthenticationFailure", {
+	operation: Schema.Literals(["sign", "verify"]),
+	reason: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
 }) {};
-/**
-* Settlement of scheduled review work. `incomplete` means reviewer-side work
-* failed after its bounded retry — a machinery gap that is carried forward and
-* retried on the next run, never a statement about the code under review.
-* `unverified` is the flat reviewer's honest constant: one pass with no
-* independent verifier is neither settled assurance nor a failure.
-*/
-var ReviewAssurance = class extends Schema.Class("@effect-agent/pr-review/ReviewAssurance")({
-	status: Schema.Literals([
-		"settled",
-		"incomplete",
-		"unverified"
-	]),
-	requiredGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	requiredSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	requiredVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	discoveredCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	confirmedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	rejectedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	unsettledCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Discovery claims discarded for anchors/paths outside their assigned evidence. */
-	discardedInvalidFindings: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	failedPasses: Schema.Array(FailedReviewPass).check(Schema.isMaxLength(64)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+var ReviewStateMarkerTooLarge = class extends Schema.TaggedError()("ReviewStateMarkerTooLarge", {
+	observedChars: Schema.Int.check(Schema.isGreaterThan(0)),
+	maximumChars: Schema.Int.check(Schema.isGreaterThan(0))
 }) {};
-const toolTrace = (events) => {
-	const declared = /* @__PURE__ */ new Map();
-	const succeeded = /* @__PURE__ */ new Map();
-	const failed = /* @__PURE__ */ new Map();
-	for (const event of events) {
-		if (event._tag === "ToolCallDeclared") declared.set(event.toolCallId, event);
-		if (event._tag === "ToolCallSucceeded") succeeded.set(event.toolCallId, event);
-		if (event._tag === "ToolCallFailed") failed.set(event.toolCallId, event);
-	}
-	return {
-		declared,
-		succeeded,
-		failed
-	};
-};
-const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
-/** Render a bounded, deterministic "label (n): a, b, … (+k more)" reason line. */
-const boundedListReason = (label, values) => {
-	const items = sortedUnique(values);
-	let rendered = `${label} (${items.length}): `;
-	for (let index = 0; index < items.length; index += 1) {
-		const item = items[index] ?? "";
-		const separator = index === 0 ? "" : ", ";
-		const omitted = items.length - index - 1;
-		const suffix = omitted === 0 ? "" : ` … (+${omitted} more)`;
-		if (`${rendered}${separator}${item}${suffix}`.length > 1e3) {
-			const omission = `… (+${items.length - index} more)`;
-			return `${rendered.slice(0, 1e3 - omission.length)}${omission}`;
-		}
-		rendered = `${rendered}${separator}${item}`;
-	}
-	return rendered;
-};
-const anchorSurfaceAdjusted = (inputCoverage, anchorFiles, totalAnchorFiles) => anchorFiles.length >= totalAnchorFiles ? inputCoverage : ReviewInputCoverage.make({
-	...inputCoverage,
-	status: "incomplete",
-	reasons: [...inputCoverage.reasons, `full pull-request anchor surface exposed ${anchorFiles.length} of ${totalAnchorFiles} required files`]
+var ReviewStateAuthenticator = class extends Context.Service()("@effect-agent/pr-review/ReviewStateAuthenticator") {};
+const authenticationFailure = (operation, cause) => ReviewStateAuthenticationFailure.make({
+	operation,
+	reason: String(cause).slice(0, 2048)
 });
-/** The flat reviewer's honest constant assurance: one pass, no verifier. */
-const flatAssurance = () => ReviewAssurance.make({
-	status: "unverified",
-	requiredGeneralDiscoveryPasses: 1,
-	completedGeneralDiscoveryPasses: 1,
-	requiredSpecialistPasses: 0,
-	completedSpecialistPasses: 0,
-	requiredVerificationPasses: 0,
-	completedVerificationPasses: 0,
-	discoveredCandidates: 0,
-	confirmedCandidates: 0,
-	rejectedCandidates: 0,
-	unsettledCandidates: 0,
-	discardedInvalidFindings: 0,
-	failedPasses: [],
-	reasons: ["flat review has no independent candidate-verification pass; use the fan-out pipeline for a settled assurance result"]
+const hmacKey = (secret, operation) => Effect.tryPromise({
+	try: () => globalThis.crypto.subtle.importKey("raw", new TextEncoder().encode(Redacted.value(secret)), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]),
+	catch: (cause) => authenticationFailure(operation, cause)
 });
-/**
-* Assess one settled flat run from its Run event trace: which required paths
-* received successful bounded diff evidence. This observes tool INPUT
-* assignment only — the host cannot know which evidence the model weighed.
-*/
-const assessFlatReview = (input) => {
-	const trace = toolTrace(input.events);
-	const requiredPaths = sortedUnique(input.files.map((file) => file.path));
-	const assigned = /* @__PURE__ */ new Set();
-	const partial = /* @__PURE__ */ new Set();
-	const failedPaths = /* @__PURE__ */ new Set();
-	for (const [toolCallId, declaration] of trace.declared) {
-		if (declaration.toolName !== "read_file_diff") continue;
-		const query = Schema.decodeUnknownOption(FileDiffQuery)(declaration.parameters);
-		if (Option.isNone(query)) continue;
-		const success = trace.succeeded.get(toolCallId);
-		if (success !== void 0) {
-			assigned.add(query.value.path);
-			const view = Schema.decodeUnknownOption(FileDiffView)(success.result);
-			if (Option.isSome(view) && view.value.truncated) partial.add(query.value.path);
-		}
-		if (trace.failed.has(toolCallId)) failedPaths.add(query.value.path);
-	}
-	const undiffable = new Set(input.files.filter((file) => !isReviewableFile(file)).map((file) => file.path));
-	const unassigned = requiredPaths.filter((path) => !undiffable.has(path) && (!assigned.has(path) || failedPaths.has(path)));
-	const reasons = [];
-	if (input.files.length < input.totalFiles) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
-	if (undiffable.size > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", undiffable));
-	if (failedPaths.size > 0) reasons.push(boundedListReason("diff reads failed", failedPaths));
-	if (partial.size > 0) reasons.push(boundedListReason("model-visible diff evidence was truncated", partial));
-	if (unassigned.length > 0) reasons.push(boundedListReason("required paths received no successful diff input", unassigned));
-	return {
-		inputCoverage: anchorSurfaceAdjusted(ReviewInputCoverage.make({
-			status: reasons.length === 0 ? "complete" : "incomplete",
-			requiredPaths,
-			assignedPaths: sortedUnique(assigned),
-			partialPaths: sortedUnique(partial),
-			unassignedPaths: sortedUnique(unassigned),
-			undiffablePaths: sortedUnique(undiffable),
-			reasons
-		}), input.anchorFiles, input.totalAnchorFiles),
-		assurance: flatAssurance(),
-		unreviewedPaths: sortedUnique([...unassigned, ...undiffable])
-	};
+const signatureBytes = (signature) => {
+	const pairs = signature.match(/../g) ?? [];
+	const buffer = new ArrayBuffer(pairs.length);
+	const bytes = new Uint8Array(buffer);
+	for (let index = 0; index < pairs.length; index += 1) bytes[index] = Number.parseInt(pairs[index] ?? "", 16);
+	return buffer;
+};
+/** Validated WebCrypto adapter selected at the Action composition root. */
+const webCryptoReviewStateAuthenticatorLayer = (secret) => Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
+	status: "available",
+	unavailableReason: void 0,
+	render: (state) => Effect.gen(function* () {
+		const json = yield* Schema.encodeUnknownEffect(Schema.fromJsonString(ReviewState))(state).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
+		const payload = Encoding.encodeBase64(json);
+		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
+		const key = yield* hmacKey(secret, "sign");
+		const signature = yield* Effect.tryPromise({
+			try: () => globalThis.crypto.subtle.sign("HMAC", key, message),
+			catch: (cause) => authenticationFailure("sign", cause)
+		});
+		const hex = Array.from(new Uint8Array(signature)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+		const marker = `${STATE_MARKER_PREFIX}${payload}.${hex}${STATE_MARKER_SUFFIX}`;
+		if (marker.length > 24e3) return yield* ReviewStateMarkerTooLarge.make({
+			observedChars: marker.length,
+			maximumChars: MAX_REVIEW_STATE_MARKER_CHARS
+		});
+		return yield* Schema.decodeUnknownEffect(ReviewStateMarker)(marker).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
+	}),
+	extract: (body) => {
+		if (body.length > 6e4) return Effect.succeed(Option.none());
+		const match = STATE_MARKER_PATTERN.exec(body);
+		const payload = match?.[1];
+		const signature = match?.[2];
+		if (payload === void 0 || signature === void 0) return Effect.succeed(Option.none());
+		const marker = `${STATE_MARKER_PREFIX}${payload}.${signature}${STATE_MARKER_SUFFIX}`;
+		if (!Schema.is(ReviewStateMarker)(marker)) return Effect.succeed(Option.none());
+		const json = Result.getOrUndefined(Encoding.decodeBase64String(payload));
+		if (json === void 0) return Effect.succeed(Option.none());
+		const decoded = Schema.decodeUnknownOption(Schema.fromJsonString(ReviewState))(json);
+		if (Option.isNone(decoded)) return Effect.succeed(Option.none());
+		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
+		return Effect.gen(function* () {
+			const key = yield* hmacKey(secret, "verify");
+			return (yield* Effect.tryPromise({
+				try: () => globalThis.crypto.subtle.verify("HMAC", key, signatureBytes(signature), message),
+				catch: (cause) => authenticationFailure("verify", cause)
+			})) ? Option.some(decoded.value) : Option.none();
+		});
+	}
+}));
+/** Explicit no-state implementation for hosts without a stable authentication secret. */
+const unavailableReviewStateAuthenticatorLayer = (reason) => {
+	const safeReason = reason === "" ? "review-state authentication is unavailable" : reason;
+	return Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
+		status: "unavailable",
+		unavailableReason: safeReason.slice(0, 1e3),
+		render: () => Effect.fail(ReviewStateAuthenticationFailure.make({
+			operation: "sign",
+			reason: safeReason.slice(0, 2048)
+		})),
+		extract: () => Effect.succeed(Option.none())
+	}));
 };
+/** The bounded result of GitHub's previous-head...current-head comparison. */
+var ReviewHeadComparison = class extends Schema.Class("@effect-agent/pr-review/ReviewHeadComparison")({
+	status: Schema.Literals([
+		"ahead",
+		"behind",
+		"diverged",
+		"identical"
+	]),
+	baseSha: GitCommitSha,
+	headSha: GitCommitSha,
+	mergeBaseSha: GitCommitSha,
+	files: Schema.Array(ChangedFile).check(Schema.isMaxLength(300)),
+	/** GitHub caps compare-file payloads at 300; equality is conservatively truncated. */
+	truncated: Schema.Boolean
+}) {};
+const fullReviewSelection = (input) => ({
+	mode: "full",
+	reason: input.reason,
+	files: input.files,
+	affectedPaths: input.files.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]),
+	retryPaths: [],
+	retryStages: [],
+	totalFiles: input.totalFiles,
+	baselineSha: void 0,
+	priorState: void 0,
+	profileFingerprint: input.profileFingerprint
+});
+/** Three-dot lineage from the reviewed head to the current head is usable. */
+const isLineageAncestor = (comparison, priorState, currentHeadSha) => comparison.baseSha === priorState.reviewedHeadSha && comparison.headSha === currentHeadSha && comparison.mergeBaseSha === priorState.reviewedHeadSha && !comparison.truncated && (comparison.status === "ahead" || comparison.status === "identical");
 /**
-* Input coverage of one host-scheduled fan-out plan: which required paths the
-* bounded plan actually assigned complete evidence for. Capacity overflow and
-* undiffable paths are both real gaps; the pipeline carries them so the check
-* stays fail-closed until they are reviewed, removed, or explicitly ignored.
+* Validate that persisted state belongs to this exact PR/base lineage and the
+* same review profile. A mismatch is a full-review reason, never an error that
+* silently suppresses review work.
 */
-const fanOutInputCoverage = (input) => {
-	const plan = input.plan;
-	const assignedPaths = sortedUnique(plan.units.flatMap((unit) => unit.paths));
-	const unassignedPaths = sortedUnique(plan.unassignedPaths);
-	const reasons = [];
-	if (plan.truncated) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
-	if (plan.undiffablePaths.length > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", plan.undiffablePaths));
-	if (plan.partialEvidencePaths.length > 0) reasons.push(boundedListReason("fan-out capacity left some deterministic evidence shards unassigned", plan.partialEvidencePaths));
-	if (plan.unassignedEvidenceShardCount > 0) {
-		reasons.push(`${plan.unassignedEvidenceShardCount} deterministic evidence shard(s) exceeded fan-out capacity`);
-		reasons.push(boundedListReason(`unassigned evidence shard identifier sample (${plan.unassignedEvidenceShardIds.length} of ${plan.unassignedEvidenceShardCount})`, plan.unassignedEvidenceShardIds));
+const validateReviewState = (state, current, profileFingerprint) => {
+	if (state.repository !== current.repository || state.pullRequestNumber !== current.number) return "stored state belongs to a different pull request";
+	if (current.baseSha === void 0) return "the current base commit is unavailable";
+	if (state.baseRef !== current.baseRef) return "the pull request base ref changed";
+	if (state.headRef !== current.headRef) return "the pull request head ref changed";
+	if (state.profileFingerprint !== profileFingerprint) return "the reviewer profile or model configuration changed";
+	if (state.unresolvedConcerns.some((concern) => concern.evidencePaths === void 0)) return "stored concerns predate affected-path tracking";
+};
+const filePaths = (file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath];
+const incrementalFromDelta = (input) => {
+	const currentPaths = new Set(input.fullFiles.flatMap(filePaths));
+	const affectedPaths = /* @__PURE__ */ new Set([...input.deltaFiles.flatMap(filePaths), ...input.extraAffectedPaths ?? []]);
+	const initialAffectedCount = affectedPaths.size;
+	let expanded = true;
+	while (expanded) {
+		expanded = false;
+		for (const concern of input.priorState.unresolvedConcerns) {
+			const paths = concern.evidencePaths ?? [];
+			if (!paths.some((path) => affectedPaths.has(path))) continue;
+			for (const path of paths) if (!affectedPaths.has(path)) {
+				affectedPaths.add(path);
+				expanded = true;
+			}
+		}
 	}
-	if (plan.unassignedPaths.length > 0) reasons.push(boundedListReason("fan-out capacity left paths unassigned", plan.unassignedPaths));
-	return anchorSurfaceAdjusted(ReviewInputCoverage.make({
-		status: reasons.length === 0 ? "complete" : "incomplete",
-		requiredPaths: sortedUnique(input.files.map((file) => file.path)),
-		assignedPaths,
-		partialPaths: plan.partialEvidencePaths,
-		unassignedPaths,
-		undiffablePaths: sortedUnique(plan.undiffablePaths),
-		reasons
-	}), input.anchorFiles, input.totalAnchorFiles);
+	const selectedByPath = /* @__PURE__ */ new Map();
+	for (const file of input.deltaFiles) if (currentPaths.has(file.path) || file.previousPath !== void 0 && currentPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const carriedPaths = input.priorState.unreviewedPaths.filter((path) => currentPaths.has(path));
+	const retryOnly = /* @__PURE__ */ new Set();
+	const retryStages = /* @__PURE__ */ new Set();
+	for (const path of carriedPaths) {
+		if (affectedPaths.has(path)) continue;
+		retryOnly.add(path);
+		for (const pass of input.priorState.unreviewedPasses) if (pass.paths.includes(path)) retryStages.add(pass.stage);
+	}
+	if (retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) {
+		retryStages.add("discovery");
+		retryStages.add("specialist");
+	}
+	if (retryOnly.size > 0 && retryStages.size === 0) {
+		for (const path of retryOnly) affectedPaths.add(path);
+		retryStages.add("discovery");
+		retryStages.add("specialist");
+		retryStages.add("verification");
+	}
+	for (const file of input.fullFiles) if (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath) || retryOnly.has(file.path) || file.previousPath !== void 0 && retryOnly.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const selectedFiles = [...selectedByPath.values()].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+	const leftoverCount = [...retryOnly].filter((path) => !affectedPaths.has(path)).length;
+	const carriedReason = leftoverCount > 0 ? `; retrying ${leftoverCount} unchanged leftover path(s) without rediscovery` : carriedPaths.length > 0 ? `; retrying ${carriedPaths.length} carried unreviewed path(s)` : "";
+	const concernPathCount = affectedPaths.size - initialAffectedCount;
+	const concernReason = concernPathCount === 0 ? "" : `; reopening ${concernPathCount} related concern path(s) for context`;
+	return {
+		mode: "incremental",
+		reason: `${input.reason}${carriedReason}${concernReason}`,
+		files: selectedFiles,
+		affectedPaths: [...affectedPaths].sort(),
+		retryPaths: [...retryOnly].filter((path) => !affectedPaths.has(path)).sort(),
+		retryStages: [...retryStages].sort(),
+		totalFiles: selectedFiles.length,
+		baselineSha: input.priorState.reviewedHeadSha,
+		priorState: input.priorState,
+		profileFingerprint: input.profileFingerprint
+	};
 };
-/** Compatibility aggregate over the two precise claims. */
-const compatibilityCoverage = (inputCoverage, assurance) => {
-	const assuranceIncomplete = assurance.status === "incomplete";
-	const failedUnits = /* @__PURE__ */ new Map();
-	for (const pass of assurance.failedPasses) {
-		const unitId = pass.workId.slice(0, 8);
-		if (!failedUnits.has(unitId)) failedUnits.set(unitId, FailedReviewUnit.make({
-			unitId,
-			errorTag: `${pass.stage}:${pass.errorTag}`
-		}));
+/** Pure, deterministic range selection with conservative full-review fallbacks. */
+const selectReviewRange = (input) => {
+	const full = (reason) => fullReviewSelection({
+		reason,
+		files: input.fullFiles,
+		totalFiles: input.current.totalChangedFiles,
+		profileFingerprint: input.profileFingerprint
+	});
+	if (input.requestedMode === "final") return full("explicit final full-diff audit requested");
+	if (input.lookupFailure !== void 0) return full(`stored review state could not be recovered: ${input.lookupFailure}`);
+	if (input.priorState === void 0) return full("no compatible stored review state was found");
+	const invalid = validateReviewState(input.priorState, input.current, input.profileFingerprint);
+	if (invalid !== void 0) return full(invalid);
+	const comparison = input.comparison;
+	if (comparison !== void 0 && isLineageAncestor(comparison, input.priorState, input.current.headSha)) {
+		const extraAffected = [];
+		let baseReason = "";
+		if (input.priorState.baseSha !== input.current.baseSha) {
+			const baseComparison = input.baseComparison;
+			if (baseComparison === void 0) return full("the pull request base changed and its lineage comparison was unavailable");
+			if (baseComparison.baseSha !== input.priorState.baseSha || baseComparison.headSha !== input.current.baseSha || baseComparison.mergeBaseSha !== input.priorState.baseSha || baseComparison.status !== "ahead" && baseComparison.status !== "identical" || baseComparison.truncated) return full("the pull request base changed materially or exceeded the comparison bound");
+			for (const file of baseComparison.files) extraAffected.push(...filePaths(file));
+			baseReason = `; base advanced from ${input.priorState.baseSha.slice(0, 7)} and overlapping PR paths were included`;
+		}
+		return incrementalFromDelta({
+			current: input.current,
+			fullFiles: input.fullFiles,
+			profileFingerprint: input.profileFingerprint,
+			priorState: input.priorState,
+			deltaFiles: comparison.files,
+			extraAffectedPaths: extraAffected,
+			reason: `changes since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}`
+		});
 	}
-	return ReviewCoverage.make({
-		status: inputCoverage.status === "complete" && !assuranceIncomplete ? "complete" : "incomplete",
-		requiredPaths: inputCoverage.requiredPaths,
-		reviewedPaths: inputCoverage.assignedPaths,
-		unreviewedPaths: sortedUnique([...inputCoverage.partialPaths, ...inputCoverage.unassignedPaths]),
-		failedUnits: [...failedUnits.values()].slice(0, 8),
-		reasons: [...inputCoverage.reasons, ...assuranceIncomplete ? assurance.reasons : []]
+	const contentComparison = input.contentComparison;
+	if (contentComparison !== void 0 && !contentComparison.truncated) return incrementalFromDelta({
+		current: input.current,
+		fullFiles: input.fullFiles,
+		profileFingerprint: input.profileFingerprint,
+		priorState: input.priorState,
+		deltaFiles: contentComparison.files,
+		reason: `rewritten history; contents changed since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}`
 	});
+	if (comparison === void 0) return full("the incremental head comparison was unavailable");
+	if (comparison.truncated) return full("the incremental comparison exceeded GitHub's file bound");
+	return full("the prior reviewed head is not an ancestor of the current head");
 };
-//#endregion
-//#region src/internal/review-units.ts
-/** The delegation fan-out bound: one parent Run spawns at most this many children. */
-const MAX_REVIEW_UNITS = 8;
-/** A unit never carries more files than this, regardless of their size. */
-const MAX_UNIT_FILES = 12;
-/** Compatibility export; complete evidence chars now own unit packing. */
-const UNIT_CHANGED_LINE_BUDGET = 800;
+/** Per-run context consumed by orchestration and publication, not by the model. */
+var ReviewExecutionContext = class extends Context.Service()("@effect-agent/pr-review/ReviewExecutionContext") {};
 /**
-* Bound the complete model-visible evidence assigned to one child. This is a
-* character bound rather than a token estimate because it is deterministic,
-* provider-independent, and enforced before any model call.
+* Explicit direct-run adapter for callers that intentionally review the full
+* source without authenticated incremental continuity.
 */
-const UNIT_EVIDENCE_CHAR_BUDGET = 24e4;
-/** Maximum complete evidence shards placed in one child brief. */
-const MAX_UNIT_EVIDENCE_SHARDS = 12;
+const fullReviewExecutionContextLayer = (reason) => Layer.effect(ReviewExecutionContext, Effect.gen(function* () {
+	const source = yield* PullRequestSource;
+	const [metadata, files] = yield* Effect.all([source.metadata, source.changedFiles]);
+	return fullReviewSelection({
+		reason,
+		files,
+		totalFiles: metadata.totalChangedFiles
+	});
+}));
 /**
-* Keep overflow diagnostics bounded to one plan's total assignment capacity.
-* The plan separately records the exact overflow count and every affected
-* path, so identifiers are a deterministic diagnostic sample rather than the
-* authority for whether input coverage is complete.
+* Decorate the full source with the selected review range. Full anchor files
+* remain available to host-side publication validation; model tools see only
+* the selected delta and may read head context only for that delta's paths.
 */
-const MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS = 96;
-/** @deprecated Use `MAX_PATCH_CHARS`; this is now the per-shard bound. */
-const MAX_FILE_EVIDENCE_CHARS = MAX_PATCH_CHARS;
-/** The merged review never exceeds the `CodeReview` findings bound. */
-const MAX_MERGED_FINDINGS = 20;
-const ReviewUnitId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
-/** High-risk surfaces that receive an explicit specialist focus label. */
-const ReviewRiskCategory = Schema.Literals([
-	"authentication-authorization",
-	"security-boundary",
-	"persistence-durability",
-	"concurrency",
-	"credential-handling",
-	"external-side-effects"
-]);
-const ReviewDiscoveryPerspective = Schema.Literals(["general", "risk-specialist"]);
-const ReviewPassId = Schema.NonEmptyString.check(Schema.isMaxLength(64));
-const ReviewEvidenceShardId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
-/** One complete bounded slice of a changed path's model-visible evidence. */
-var ReviewEvidenceShard = class extends Schema.Class("@effect-agent/pr-review/ReviewEvidenceShard")({
-	shardId: ReviewEvidenceShardId,
-	path: ChangedPath,
-	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(MAX_PATCH_CHARS))
-}) {};
-const EvidenceShardIds$1 = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-/** One required, independently scoped discovery attempt. */
-var ReviewDiscoveryPass = class extends Schema.Class("@effect-agent/pr-review/ReviewDiscoveryPass")({
-	passId: ReviewPassId,
-	unitId: ReviewUnitId,
-	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	evidenceShardIds: EvidenceShardIds$1,
-	perspective: ReviewDiscoveryPerspective,
-	/** Empty for the general pass; explicit deterministic focus for specialists. */
-	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
-}) {};
-/** One bounded slice of the changeset delegated to one child reviewer. */
-var ReviewUnit = class extends Schema.Class("@effect-agent/pr-review/ReviewUnit")({
-	unitId: ReviewUnitId,
-	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	evidenceShards: Schema.Array(ReviewEvidenceShard).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	/** additions + deletions across the unit's files, for honest sizing. */
-	changedLines: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Complete model-visible diff/content evidence assigned to each child. */
-	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(UNIT_EVIDENCE_CHAR_BUDGET)),
-	/** Host-classified focus labels for the unit's redundant specialist pass. */
-	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
-}) {};
-/** The complete deterministic fan-out plan over one changeset. */
-var ReviewUnitPlan = class extends Schema.Class("@effect-agent/pr-review/ReviewUnitPlan")({
-	totalFiles: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** True when the source returned fewer files than the pull request has. */
-	truncated: Schema.Boolean,
-	units: Schema.Array(ReviewUnit).check(Schema.isMaxLength(8)),
-	/** Exact discovery calls the coordinator must make. */
-	discoveryPasses: Schema.Array(ReviewDiscoveryPass).check(Schema.isMaxLength(16)),
-	/** Changed files with neither a textual diff nor bounded base/head text. */
-	undiffablePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
-	/** Assigned paths with one or more evidence shards beyond plan capacity. */
-	partialEvidencePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
-	/** Exact number of shards beyond the bounded unit capacity. */
-	unassignedEvidenceShardCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Bounded deterministic prefix of the unassigned shard identifiers. */
-	unassignedEvidenceShardIds: Schema.Array(ReviewEvidenceShardId).check(Schema.isMaxLength(96)),
-	/**
-	* Diffable files beyond the fan-out capacity (MAX_REVIEW_UNITS units of
-	* MAX_UNIT_FILES files). Never silently dropped: the coordinator must name
-	* them as unreviewed in its summary.
-	*/
-	unassignedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300))
+const selectedPullRequestSourceLayer = (selection) => Layer.effect(PullRequestSource)(Effect.gen(function* () {
+	const source = yield* PullRequestSource;
+	const selectedPaths = new Set(selection.files.map((file) => file.path));
+	const selectedFiles = source.changedFiles.pipe(Effect.map((fullFiles) => {
+		const fullByPath = new Map(fullFiles.map((file) => [file.path, file]));
+		return selection.files.map((file) => {
+			if (file.patch !== void 0) return file;
+			const full = fullByPath.get(file.path);
+			return full === void 0 ? file : ChangedFile.make({
+				...file,
+				...full.reviewBaseContent === void 0 ? {} : { reviewBaseContent: full.reviewBaseContent },
+				...full.reviewHeadContent === void 0 ? {} : { reviewHeadContent: full.reviewHeadContent }
+			});
+		});
+	}));
+	return PullRequestSource.of({
+		metadata: source.metadata,
+		changedFiles: selectedFiles,
+		anchorFiles: source.anchorFiles,
+		readFile: (path) => selectedPaths.has(path) ? source.readFile(path) : Effect.fail(ReviewInputViolation.make({
+			input: path,
+			reason: "Path is outside this incremental review range."
+		}))
+	});
+}));
+/** Build the full-surface mission used only to resolve profile guidance. */
+const buildProfileMission = (metadata, files) => ReviewMission.make({
+	repository: metadata.repository,
+	number: metadata.number,
+	title: metadata.title,
+	body: metadata.body,
+	baseRef: metadata.baseRef,
+	headRef: metadata.headRef,
+	changedFileCount: files.length
+});
+//#endregion
+//#region src/internal/retirement.ts
+const PositiveLine$1 = Schema.Int.check(Schema.isGreaterThan(0));
+/** One previously posted review as observed through the retirement host. */
+var RetirableReview = class extends Schema.Class("@effect-agent/pr-review/RetirableReview")({
+	reviewId: Schema.Int.check(Schema.isGreaterThan(0)),
+	body: Schema.String.check(Schema.isMaxLength(6e4)),
+	commitSha: Schema.NonEmptyString.check(Schema.isMaxLength(64)),
+	authorNodeId: Schema.NullOr(Schema.NonEmptyString.check(Schema.isMaxLength(200))),
+	submittedAt: Schema.NullOr(Schema.DateTimeUtc)
 }) {};
-const riskRules = [
-	{
-		category: "authentication-authorization",
-		patterns: [
-			/auth/,
-			/authoriz/,
-			/permission/,
-			/principal/,
-			/access[-_ ]?control/,
-			/role\b/
-		]
-	},
-	{
-		category: "security-boundary",
-		patterns: [
-			/security/,
-			/sandbox/,
-			/untrusted/,
-			/schema\.decode/,
-			/validation/,
-			/injection/,
-			/csrf/,
-			/xss/,
-			/path traversal/
-		]
-	},
-	{
-		category: "persistence-durability",
-		patterns: [
-			/durab/,
-			/persist/,
-			/storage/,
-			/database/,
-			/\bsql\b/,
-			/journal/,
-			/ledger/,
-			/checkpoint/,
-			/migration/,
-			/transaction/
-		]
-	},
-	{
-		category: "concurrency",
-		patterns: [
-			/concurr/,
-			/semaphore/,
-			/\bfiber/,
-			/race/,
-			/mutex/,
-			/\block\b/,
-			/queue/,
-			/parallel/,
-			/interrupt/
-		]
-	},
-	{
-		category: "credential-handling",
-		patterns: [
-			/credential/,
-			/secret/,
-			/password/,
-			/api[-_ ]?key/,
-			/bearer/,
-			/hmac/,
-			/signature/
-		]
-	},
-	{
-		category: "external-side-effects",
-		patterns: [
-			/publish/,
-			/webhook/,
-			/github/,
-			/fetch\(/,
-			/http/,
-			/send[-_ ]?(email|message)/,
-			/write[-_ ]?(file|record)/,
-			/delete/,
-			/mutation/,
-			/side[-_ ]?effect/,
-			/spawn/,
-			/exec/
-		]
+/** One inline comment attached to a previously posted review. */
+var RetirableReviewComment = class extends Schema.Class("@effect-agent/pr-review/RetirableReviewComment")({
+	nodeId: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
+	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
+	startLine: Schema.NullOr(PositiveLine$1),
+	endLine: Schema.NullOr(PositiveLine$1),
+	body: Schema.String.check(Schema.isMaxLength(65536))
+}) {};
+/** A GitHub retirement read or mutation failed. */
+var ReviewRetirementFailure = class extends Schema.TaggedError()("ReviewRetirementFailure", {
+	operation: Schema.String,
+	reason: Schema.String
+}) {
+	get message() {
+		return `Review retirement operation '${this.operation}' failed: ${this.reason}`;
 	}
-];
+};
 /**
-* Deterministic host policy for specialist assignment. It intentionally
-* favors false positives: an extra bounded pass costs work, while a missed
-* high-risk classification removes redundancy. This is not a claim that the
-* keyword policy recognizes every semantically risky change.
+* Host-side GitHub operations used by retirement. Domain code never reaches
+* into REST or GraphQL directly, and deterministic tests substitute this port.
 */
-const classifyReviewRisks = (file) => {
-	const text = [
-		file.path,
-		file.previousPath ?? "",
-		file.patch ?? "",
-		file.reviewBaseContent ?? "",
-		file.reviewHeadContent ?? ""
-	].join("\n").toLowerCase();
-	return riskRules.filter((rule) => rule.patterns.some((pattern) => pattern.test(text))).map((rule) => rule.category);
-};
+var ReviewRetirementHost = class extends Context.Service()("@effect-agent/pr-review/ReviewRetirementHost") {};
+/** Observable cosmetic work completed by one fail-open retirement pass. */
+var ReviewRetirementReport = class extends Schema.Class("@effect-agent/pr-review/ReviewRetirementReport")({
+	reviewsRetired: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	findingsResolved: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	commentsMinimized: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	failures: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+const REVIEW_METADATA_PATTERN = /<!-- effect-agent-pr-review metadata\n[\s\S]*?\n-->/g;
+const FINGERPRINT_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:[0-9a-f]{64} -->/g;
+const STATE_PATTERN = /<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
+const RETIRED_ORIGINAL_PATTERN = /<!-- effect-agent-pr-review retired-original:start -->\n([\s\S]*?)\n<!-- effect-agent-pr-review retired-original:end -->/;
+const MACHINE_COMMENT_PATTERN = new RegExp(`${REVIEW_METADATA_PATTERN.source}|${FINGERPRINT_PATTERN.source}|${STATE_PATTERN.source}`, "g");
+const VERDICT_CALLOUT_PATTERN = /^(?:> \[!(?:CAUTION|IMPORTANT)\]\n> [^\n]*(?:\n> [^\n]*)*|> (?:ℹ️|✅)[^\n]*)\n*/;
 /**
-* Whether every claimed finding anchor was present in the exact bounded
-* evidence shards assigned to one unit. This is stricter than checking the
-* full pull-request diff when an oversized path spans multiple units.
+* The first line of every inline finding comment this package posts. Shared
+* with adjudication so both parse the identical title shape.
 */
-const findingAnchorInUnitEvidence = (finding, unit, files) => {
-	const file = files.find((candidate) => candidate.path === finding.path);
-	if (file?.patch === void 0 || finding.endLine < finding.startLine) return false;
-	const assignedOrdinals = new Set(unit.evidenceShards.filter((shard) => shard.path === finding.path).map((shard) => shard.ordinal));
-	const visibleLines = /* @__PURE__ */ new Set();
-	const chunks = fileReviewEvidenceChunks(file);
-	for (let index = 0; index < chunks.length; index += 1) {
-		if (!assignedOrdinals.has(index + 1)) continue;
-		for (const line of chunks[index]?.annotatedPatch.split("\n") ?? []) {
-			const match = /^R(\d+) /.exec(line);
-			if (match?.[1] !== void 0) visibleLines.add(Number(match[1]));
-		}
-	}
-	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!visibleLines.has(line)) return false;
-	return true;
-};
-const uniquePaths = (shards) => [...new Set(shards.map(({ shard }) => shard.path))];
-const plannedEvidenceShards = (files) => {
-	const planned = [];
-	let shardIndex = 0;
-	for (const file of files) {
-		const chunks = fileReviewEvidenceChunks(file);
-		for (let index = 0; index < chunks.length; index += 1) {
-			const chunk = chunks[index];
-			if (chunk === void 0) continue;
-			shardIndex += 1;
-			planned.push({
-				shard: ReviewEvidenceShard.make({
-					shardId: `shard-${String(shardIndex).padStart(4, "0")}`,
-					path: file.path,
-					ordinal: index + 1,
-					total: chunks.length,
-					evidenceChars: chunk.annotatedPatch.length
-				}),
-				file,
-				changedLines: index === 0 ? file.additions + file.deletions : 0
-			});
-		}
-	}
-	return planned;
+const INLINE_FINDING_TITLE_PATTERN = /^\*\*\[(?:🛑 blocking|⚠️ important|💅 nit) · [a-z-]+\] ([^\n]+)\*\*$/;
+const MAX_REVIEW_BODY_CHARS = 6e4;
+/** The host-authored metadata marker is the authority gate for any edit. */
+const hasReviewMetadataMarker = (body) => /<!-- effect-agent-pr-review metadata\n/.test(body);
+const machineComments = (body) => Array.from(body.matchAll(MACHINE_COMMENT_PATTERN), (match) => match[0]);
+const originalVisibleBody = (body) => {
+	const retired = RETIRED_ORIGINAL_PATTERN.exec(body)?.[1];
+	if (retired !== void 0) return retired;
+	return body.replace(MACHINE_COMMENT_PATTERN, "").trim().replace(VERDICT_CALLOUT_PATTERN, "");
 };
-const unitOf = (index, shards) => ReviewUnit.make({
-	unitId: `unit-${String(index + 1).padStart(3, "0")}`,
-	paths: uniquePaths(shards),
-	evidenceShards: shards.map(({ shard }) => shard),
-	changedLines: shards.reduce((total, shard) => total + shard.changedLines, 0),
-	evidenceChars: shards.reduce((total, { shard }) => total + shard.evidenceChars, 0),
-	riskCategories: [...new Set(shards.flatMap(({ file }) => classifyReviewRisks(file)))]
-});
-const discoveryPassesFor = (units) => units.flatMap((unit) => [ReviewDiscoveryPass.make({
-	passId: `${unit.unitId}-general`,
-	unitId: unit.unitId,
-	paths: unit.paths,
-	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-	perspective: "general",
-	riskCategories: []
-}), ReviewDiscoveryPass.make({
-	passId: `${unit.unitId}-specialist`,
-	unitId: unit.unitId,
-	paths: unit.paths,
-	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-	perspective: "risk-specialist",
-	riskCategories: unit.riskCategories
-})]);
-/**
-* Group the changeset into at most `MAX_REVIEW_UNITS` review units.
-*
-* Deterministic by construction: files are ordered by path (so files sharing
-* a directory become neighbors — directory affinity without a heuristic),
-* then split into complete line-bounded evidence shards and packed greedily
-* under the hard evidence and per-unit shard bounds. Capacity is finite and
-* explicit:
-*
-* - files without a textual diff are still delegated when the source
-*   recovered complete bounded UTF-8 base/head content. Findings from that
-*   evidence cannot anchor inline and are reported as concerns;
-* - files with neither form of textual evidence surface in
-*   `undiffablePaths` instead of laundering missing coverage;
-* - an oversized path spans as many deterministic shards and units as needed;
-* - shards beyond `MAX_REVIEW_UNITS` full units surface explicitly, so a path
-*   is partial only when finite plan capacity is genuinely exhausted.
+const findingLocation = (finding) => `${finding.path}:${finding.startLine}${finding.endLine === finding.startLine ? "" : `-${finding.endLine}`}`;
+const renderRetiredBody = (input) => {
+	const shortSha = input.currentState.reviewedHeadSha.slice(0, 7);
+	const comments = machineComments(input.priorBody);
+	const original = originalVisibleBody(input.priorBody);
+	const resolved = input.resolvedFindings.length === 0 ? [] : [
+		"### Findings resolved by later review",
+		"",
+		...input.resolvedFindings.map((finding) => `- \`${findingLocation(finding)}\` ~~${finding.title}~~ · resolved at \`${shortSha}\``),
+		""
+	];
+	const prefix = [
+		`> ℹ️ Superseded — ${input.resolvedFindings.length} of ${input.priorState.unresolvedFindings.length} findings resolved at \`${shortSha}\`; see [the latest review](${input.currentReviewUrl}).`,
+		"",
+		"<details>",
+		"<summary>Previous review details</summary>",
+		"",
+		...resolved,
+		"<!-- effect-agent-pr-review retired-original:start -->"
+	];
+	const suffix = [
+		"<!-- effect-agent-pr-review retired-original:end -->",
+		"",
+		"</details>",
+		...comments.length === 0 ? [] : ["", ...comments]
+	];
+	const render = (visible) => [
+		...prefix,
+		visible,
+		...suffix
+	].join("\n");
+	if (render(original).length <= MAX_REVIEW_BODY_CHARS) return render(original);
+	const truncationNotice = "\n\n_Original review content truncated during retirement._";
+	const budget = Math.max(0, MAX_REVIEW_BODY_CHARS - render(truncationNotice).length);
+	return render(`${original.slice(0, budget)}${truncationNotice}`);
+};
+/** Compute one prior review's resolved subset and deterministic retired body. */
+const decideReviewRetirement = (input) => {
+	const current = new Set(input.currentState.unresolvedFindings.map(findingIdentity));
+	const adjudicated = new Set((input.currentState.adjudications ?? []).map((entry) => adjudicationIdentity(entry)));
+	const resolvedFindings = input.priorState.unresolvedFindings.filter((finding) => !current.has(findingIdentity(finding)) && !adjudicated.has(findingIdentity(finding)));
+	return {
+		body: renderRetiredBody({
+			...input,
+			resolvedFindings
+		}),
+		resolvedFindings,
+		priorFindingCount: input.priorState.unresolvedFindings.length
+	};
+};
+const inlineCommentIdentity = (comment) => {
+	if (comment.startLine === null || comment.endLine === null) return void 0;
+	const firstLine = comment.body.split("\n", 1)[0] ?? "";
+	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine)?.[1];
+	return title === void 0 ? void 0 : findingIdentity({
+		path: comment.path,
+		startLine: comment.startLine,
+		endLine: comment.endLine,
+		title
+	});
+};
+const failOpen = (effect, fallback, message) => effect.pipe(Effect.catch((error) => Effect.logWarning(`${message}: ${String(error)}`).pipe(Effect.as(fallback))));
+const isStrictlyOlderReview = (review, input) => {
+	if (review.submittedAt === null) return false;
+	const submittedAt = DateTime.toEpochMillis(review.submittedAt);
+	const currentSubmittedAt = DateTime.toEpochMillis(input.currentSubmittedAt);
+	return submittedAt < currentSubmittedAt || submittedAt === currentSubmittedAt && review.reviewId < input.currentReviewId;
+};
+/**
+* Retire every marker-bearing prior review against the newest posted state.
+* Every lookup, edit, and minimization is isolated: retirement is cosmetic
+* and can never change the run or check outcome.
 */
-const planReviewUnits = (files, options) => {
-	const ordered = [...files].sort((left, right) => left.path < right.path ? -1 : 1);
-	const reviewable = ordered.filter(isReviewableFile);
-	const undiffable = ordered.filter((file) => !isReviewableFile(file));
-	const shards = plannedEvidenceShards(reviewable);
-	const groups = [];
-	const unassigned = [];
-	let current = [];
-	let currentEvidenceChars = 0;
-	for (const shard of shards) {
-		const nextPaths = /* @__PURE__ */ new Set([...uniquePaths(current), shard.shard.path]);
-		if (current.length >= 12 || nextPaths.size > 12 || current.length > 0 && currentEvidenceChars + shard.shard.evidenceChars > 24e4) {
-			groups.push(current);
-			current = [];
-			currentEvidenceChars = 0;
-		}
-		if (groups.length >= 8) {
-			unassigned.push(shard);
+const retireStaleReviews = Effect.fn("retireStaleReviews")(function* (input) {
+	const host = yield* ReviewRetirementHost;
+	const authenticator = yield* ReviewStateAuthenticator;
+	if (authenticator.status !== "available") {
+		yield* Effect.logWarning("Skipping stale-review retirement because authenticated review state is unavailable.");
+		return ReviewRetirementReport.make({
+			reviewsRetired: 0,
+			findingsResolved: 0,
+			commentsMinimized: 0,
+			failures: 0
+		});
+	}
+	let failures = 0;
+	let reviewsRetired = 0;
+	let findingsResolved = 0;
+	let commentsMinimized = 0;
+	const reviews = yield* failOpen(host.listReviews, void 0, "Could not list prior reviews");
+	if (reviews === void 0) return ReviewRetirementReport.make({
+		reviewsRetired,
+		findingsResolved,
+		commentsMinimized,
+		failures: 1
+	});
+	for (const review of reviews) {
+		if (review.authorNodeId !== input.currentAuthorNodeId || !isStrictlyOlderReview(review, input) || !hasReviewMetadataMarker(review.body)) continue;
+		const priorState = yield* failOpen(authenticator.extract(review.body), Option.none(), `Could not authenticate prior review ${review.reviewId}`);
+		if (Option.isNone(priorState)) continue;
+		const decision = decideReviewRetirement({
+			priorBody: review.body,
+			priorState: priorState.value,
+			currentState: input.currentState,
+			currentReviewUrl: input.currentReviewUrl
+		});
+		if (yield* failOpen(host.updateBody(review.reviewId, decision.body).pipe(Effect.as(true)), false, `Could not retire prior review ${review.reviewId}`)) {
+			reviewsRetired += 1;
+			findingsResolved += decision.resolvedFindings.length;
+		} else failures += 1;
+		if (decision.resolvedFindings.length === 0) continue;
+		const comments = yield* failOpen(host.listComments(review.reviewId), void 0, `Could not list inline comments for prior review ${review.reviewId}`);
+		if (comments === void 0) {
+			failures += 1;
 			continue;
 		}
-		current.push(shard);
-		currentEvidenceChars += shard.shard.evidenceChars;
+		const resolved = new Set(decision.resolvedFindings.map(findingIdentity));
+		for (const comment of comments) {
+			const identity = inlineCommentIdentity(comment);
+			if (identity === void 0 || !resolved.has(identity)) continue;
+			if (yield* failOpen(host.minimizeComment(comment.nodeId).pipe(Effect.as(true)), false, `Could not minimize resolved inline comment ${comment.nodeId}`)) commentsMinimized += 1;
+			else failures += 1;
+		}
 	}
-	if (current.length > 0 && groups.length < 8) groups.push(current);
-	const units = groups.map((group, index) => unitOf(index, group));
-	const assignedShardIds = new Set(units.flatMap((unit) => unit.evidenceShards.map((shard) => shard.shardId)));
-	const assignedPaths = new Set(shards.filter(({ shard }) => assignedShardIds.has(shard.shardId)).map(({ shard }) => shard.path));
-	const unassignedPathsWithEvidence = new Set(unassigned.map(({ shard }) => shard.path));
-	return ReviewUnitPlan.make({
-		totalFiles: files.length,
-		truncated: files.length < options.totalChangedFiles,
-		units,
-		discoveryPasses: discoveryPassesFor(units),
-		undiffablePaths: undiffable.map((file) => file.path),
-		partialEvidencePaths: [...unassignedPathsWithEvidence].filter((path) => assignedPaths.has(path)),
-		unassignedEvidenceShardCount: unassigned.length,
-		unassignedEvidenceShardIds: unassigned.slice(0, 96).map(({ shard }) => shard.shardId),
-		unassignedPaths: [...unassignedPathsWithEvidence].filter((path) => !assignedPaths.has(path))
+	return ReviewRetirementReport.make({
+		reviewsRetired,
+		findingsResolved,
+		commentsMinimized,
+		failures
 	});
+});
+//#endregion
+//#region src/internal/adjudication.ts
+const PositiveLine = Schema.Int.check(Schema.isGreaterThan(0));
+/** Maximum authorized command candidates retained for one inline thread. */
+const MAX_THREAD_ADJUDICATION_COMMANDS = 100;
+/** One reply or top-level comment observed through the adjudication host. */
+var AdjudicationComment = class extends Schema.Class("@effect-agent/pr-review/AdjudicationComment")({
+	body: Schema.String.check(Schema.isMaxLength(65536)),
+	/** GitHub's author_association for the comment author, verbatim. */
+	authorAssociation: Schema.String.check(Schema.isMaxLength(40)),
+	authorLogin: Schema.NonEmptyString.check(Schema.isMaxLength(100)),
+	/** Creation time; a comment without one loses every later-wins tie. */
+	createdAt: Schema.NullOr(Schema.DateTimeUtc),
+	/** Stable zero-based order in the source listing, before thread grouping. */
+	sourceOrder: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+/** One of the action's own inline finding threads, replies in creation order. */
+var AdjudicableThread = class extends Schema.Class("@effect-agent/pr-review/AdjudicableThread")({
+	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
+	startLine: Schema.NullOr(PositiveLine),
+	endLine: Schema.NullOr(PositiveLine),
+	/** The root comment's body; its first line carries the finding title. */
+	rootBody: Schema.String.check(Schema.isMaxLength(65536)),
+	replies: Schema.Array(AdjudicationComment).check(Schema.isMaxLength(100))
+}) {};
+/** A GitHub adjudication read failed. */
+var ReviewAdjudicationFailure = class extends Schema.TaggedError()("ReviewAdjudicationFailure", {
+	operation: Schema.String,
+	reason: Schema.String
+}) {
+	get message() {
+		return `Review adjudication operation '${this.operation}' failed: ${this.reason}`;
+	}
 };
-const severityRank = {
-	blocking: 0,
-	important: 1,
-	nit: 2
+/**
+* Host-side GitHub reads used by adjudication. Domain code never reaches into
+* REST directly, and deterministic tests substitute this port. Both listings
+* return comments in creation order.
+*/
+var ReviewAdjudicationHost = class extends Context.Service()("@effect-agent/pr-review/ReviewAdjudicationHost") {};
+/** Explicit program-edge adapter for runs that intentionally perform no host reads. */
+const noReviewAdjudicationHost = ReviewAdjudicationHost.of({
+	listFindingThreads: Effect.succeed([]),
+	listIssueComments: Effect.succeed([])
+});
+/** Layer form of {@link noReviewAdjudicationHost}. */
+const noReviewAdjudicationHostLayer = Layer.succeed(ReviewAdjudicationHost)(noReviewAdjudicationHost);
+/** author_associations allowed to adjudicate; everything else is ignored. */
+const AUTHORIZED_ADJUDICATION_ASSOCIATIONS = /* @__PURE__ */ new Set([
+	"OWNER",
+	"MEMBER",
+	"COLLABORATOR"
+]);
+const AdjudicationDispositionSchema = Schema.Literals([
+	"accepted-risk",
+	"refuted",
+	"obsolete"
+]);
+const THREAD_COMMAND_PATTERN = /^\/adjudicate[ \t]+([a-z-]+)[ \t]*(?::[ \t]*(.*\S))?[ \t]*$/;
+const ISSUE_COMMAND_PATTERN = /^\/adjudicate[ \t]+([a-z-]+)[ \t]+"([^"\n]+)"[ \t]*(?::[ \t]*(.*\S))?[ \t]*$/;
+const firstLine = (body) => (body.split("\n", 1)[0] ?? "").trim();
+const boundedReason = (raw) => {
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim().slice(0, 300);
+	return trimmed.length === 0 ? void 0 : trimmed;
 };
-const anchorKey = (finding) => `${finding.path} ${finding.startLine} ${finding.endLine}`;
 /**
-* Merge the children's findings into one bounded, deterministic list: dedupe
-* findings sharing an anchor (path + line range) keeping the most severe —
-* and, at equal severity, the first in declaration order — then rank by
-* severity, path, and line, and cap at the `CodeReview` findings bound.
-* This is the merge policy the coordinator's instructions state in prose;
-* pinning it here keeps the policy itself deterministic and testable.
+* Parse one inline-thread reply: `/adjudicate <disposition>(: <reason>)?`.
+* The thread itself names the target identity. Returns undefined for a
+* non-command body and "malformed" for a command that fails the grammar.
 */
-const rankAndDedupeFindings = (findings) => {
-	const byAnchor = /* @__PURE__ */ new Map();
-	for (const finding of findings) {
-		const key = anchorKey(finding);
-		const existing = byAnchor.get(key);
-		if (existing === void 0 || severityRank[finding.severity] < severityRank[existing.severity]) byAnchor.set(key, finding);
-	}
-	return [...byAnchor.values()].sort((left, right) => {
-		const bySeverity = severityRank[left.severity] - severityRank[right.severity];
-		if (bySeverity !== 0) return bySeverity;
-		if (left.path !== right.path) return left.path < right.path ? -1 : 1;
-		return left.startLine - right.startLine;
-	}).slice(0, 20);
+const parseThreadAdjudication = (body) => {
+	const line = firstLine(body);
+	if (!line.startsWith("/adjudicate")) return void 0;
+	const match = THREAD_COMMAND_PATTERN.exec(line);
+	const disposition = match?.[1];
+	if (disposition === void 0 || !Schema.is(AdjudicationDispositionSchema)(disposition)) return "malformed";
+	return {
+		disposition,
+		reason: boundedReason(match?.[2])
+	};
 };
 /**
-* The concern analogue of `rankAndDedupeFindings`: dedupe by exact content
-* keeping the most severe duplicate, rank by severity, and cap at the
-* `CodeReview` concerns bound.
+* Parse one top-level PR comment:
+* `/adjudicate <disposition> "<exact title>"(: <reason>)?`. The quoted title
+* is required because the conversation names no finding thread; it targets
+* the title-alone identity of an unanchored concern.
 */
-const rankAndDedupeConcerns = (concerns) => {
-	const byContent = /* @__PURE__ */ new Map();
-	for (const concern of concerns) {
-		const key = `${concern.title}\u0000${concern.body}`;
-		const previous = byContent.get(key);
-		if (previous === void 0 || severityRank[concern.severity] < severityRank[previous.severity]) byContent.set(key, concern);
-	}
-	return [...byContent.values()].sort((left, right) => severityRank[left.severity] - severityRank[right.severity]).slice(0, 10);
+const parseIssueAdjudication = (body) => {
+	const line = firstLine(body);
+	if (!line.startsWith("/adjudicate")) return void 0;
+	const match = ISSUE_COMMAND_PATTERN.exec(line);
+	const disposition = match?.[1];
+	const title = match?.[2];
+	if (disposition === void 0 || !Schema.is(AdjudicationDispositionSchema)(disposition) || title === void 0 || title.length > 120) return "malformed";
+	return {
+		disposition,
+		title,
+		reason: boundedReason(match?.[3])
+	};
+};
+/** The finding identity an inline thread names, or undefined when unparsable. */
+const threadFindingTarget = (thread) => {
+	if (thread.startLine === null || thread.endLine === null) return void 0;
+	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine(thread.rootBody))?.[1];
+	if (title === void 0 || title.length > 120) return void 0;
+	return {
+		path: thread.path,
+		startLine: thread.startLine,
+		endLine: thread.endLine,
+		title
+	};
 };
-//#endregion
-//#region src/internal/fan-out.ts
-/** One discovery pass returns at most this many anchored candidates. */
-const MAX_CHILD_FINDINGS = 6;
-/** One discovery pass returns at most this many non-anchored candidates. */
-const MAX_CHILD_CONCERNS = 3;
-/** Every unit receives independent general and specialist discovery passes. */
-const MAX_UNIT_CANDIDATES = 18;
 /**
-* General + specialist discovery for every unit, then one verifier per unit.
-* The one-retry budget doubles the worst-case child Run count, but the
-* schedule itself never exceeds this bound.
+* Derive the standing adjudications from the host's listings. Every command
+* is screened fail-closed (authorization, grammar, a parsable target); later
+* adjudications of the same identity win by comment creation order; the
+* result is capped at the ReviewState bound dropping the oldest winners.
 */
-const MAX_REVIEW_CHILDREN = 24;
-/** Bounded structured concurrency across units; passes inside a unit are sequential. */
-const REVIEW_UNIT_CONCURRENCY = 4;
-/** Structural minimum for a child that exposes no tools. */
-const MAX_FILE_REVIEW_TOOL_CALLS = 1;
-const ReviewWorkPhase = Schema.Literals(["discovery", "verification"]);
-const ReviewWorkPerspective = Schema.Literals([
-	"general",
-	"risk-specialist",
-	"candidate-verification"
-]);
-const ReviewCandidateId = Schema.NonEmptyString.check(Schema.isMaxLength(96));
-var FindingCandidate = class extends Schema.TaggedClass()("FindingCandidate", {
-	candidateId: ReviewCandidateId,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	finding: ReviewFinding,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(1))
-}) {};
-var ConcernCandidate = class extends Schema.TaggedClass()("ConcernCandidate", {
-	candidateId: ReviewCandidateId,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	concern: ReviewConcern,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
-}) {};
-const ReviewCandidate = Schema.Union([FindingCandidate, ConcernCandidate]);
-/** Deterministic host equivalence for claims repeated across discovery passes. */
-const reviewCandidateSubjectKey = (candidate) => candidate._tag === "FindingCandidate" ? `finding:${JSON.stringify(Schema.encodeSync(ReviewFinding)(candidate.finding))}` : `concern:${JSON.stringify(Schema.encodeSync(ReviewConcern)(candidate.concern))}`;
-var CandidateAssessment = class extends Schema.Class("@effect-agent/pr-review/CandidateAssessment")({
-	candidateId: ReviewCandidateId,
-	disposition: Schema.Literals(["confirmed", "rejected"]),
-	/**
-	* Exact suggestion settlement: required when the candidate finding carries
-	* a suggestion, forbidden otherwise. Untrusted child output cannot publish
-	* a GitHub replacement block by prompt compliance alone — the host keeps a
-	* confirmed finding's suggestion only on an exact "committable" settlement.
-	*/
-	suggestion: Schema.optionalKey(Schema.Literals(["committable", "not-committable"]).annotate({ description: "Required exactly when the candidate finding carries a suggestion: \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else. Forbidden for candidates without a suggestion." })),
-	rationale: Schema.NonEmptyString.check(Schema.isMaxLength(600))
-}) {};
-/**
-* Exact suggestion settlement shape: a carried suggestion must be settled and
-* nothing else may be. A verification report that violates it is treated as a
-* misbehaving pass and retried within the pass budget.
-*/
-const assessmentSettlesSuggestionExactly = (assessment, candidate) => candidate._tag === "FindingCandidate" && candidate.finding.suggestion !== void 0 ? assessment.suggestion !== void 0 : assessment.suggestion === void 0;
-/**
-* Fail-closed publication of a confirmed finding: only an exact "committable"
-* settlement keeps the suggestion; anything else publishes the finding with
-* the suggestion stripped so unverified text can never become a one-click
-* GitHub replacement block.
-*/
-const confirmedFindingForPublication = (assessment, candidate) => {
-	if (candidate.finding.suggestion === void 0 || assessment.suggestion === "committable") return candidate.finding;
-	const { suggestion: _stripped, ...finding } = candidate.finding;
-	return ReviewFinding.make(finding);
+const deriveAdjudications = (input) => {
+	const candidates = [];
+	const ignored = [];
+	const admit = (comment, command, target) => {
+		candidates.push({
+			adjudication: StoredAdjudication.make({
+				...target.path === void 0 ? {} : { path: target.path },
+				...target.startLine === void 0 ? {} : { startLine: target.startLine },
+				...target.endLine === void 0 ? {} : { endLine: target.endLine },
+				title: target.title,
+				disposition: command.disposition,
+				...command.reason === void 0 ? {} : { reason: command.reason },
+				actor: comment.authorLogin
+			}),
+			epochMillis: comment.createdAt === null ? -1 : DateTime.toEpochMillis(comment.createdAt),
+			sourceOrder: comment.sourceOrder
+		});
+	};
+	const authorized = (comment, surface) => {
+		if (AUTHORIZED_ADJUDICATION_ASSOCIATIONS.has(comment.authorAssociation)) return true;
+		ignored.push(`${surface}: unauthorized /adjudicate from @${comment.authorLogin} (${comment.authorAssociation})`);
+		return false;
+	};
+	for (const thread of input.threads) {
+		const target = threadFindingTarget(thread);
+		for (const reply of thread.replies) {
+			const command = parseThreadAdjudication(reply.body);
+			if (command === void 0) continue;
+			const surface = `inline thread ${thread.path}`;
+			if (command === "malformed") {
+				ignored.push(`${surface}: malformed /adjudicate command from @${reply.authorLogin}`);
+				continue;
+			}
+			if (!authorized(reply, surface)) continue;
+			if (target === void 0) {
+				ignored.push(`${surface}: thread root names no parsable finding title`);
+				continue;
+			}
+			admit(reply, command, target);
+		}
+	}
+	for (const comment of input.issueComments) {
+		const command = parseIssueAdjudication(comment.body);
+		if (command === void 0) continue;
+		const surface = "pull-request conversation";
+		if (command === "malformed") {
+			ignored.push(`${surface}: malformed /adjudicate command from @${comment.authorLogin}`);
+			continue;
+		}
+		if (!authorized(comment, surface)) continue;
+		if (command.title === void 0) {
+			ignored.push(`${surface}: /adjudicate without a quoted target title`);
+			continue;
+		}
+		admit(comment, command, { title: command.title });
+	}
+	const byIdentity = /* @__PURE__ */ new Map();
+	const ordered = [...candidates].sort((left, right) => left.epochMillis - right.epochMillis || left.sourceOrder - right.sourceOrder);
+	for (const candidate of ordered) {
+		const identity = adjudicationIdentity(candidate.adjudication);
+		byIdentity.delete(identity);
+		byIdentity.set(identity, candidate);
+	}
+	const winners = [...byIdentity.values()];
+	const droppedOldest = Math.max(0, winners.length - 20);
+	return {
+		adjudications: winners.slice(droppedOldest).map((candidate) => candidate.adjudication),
+		ignored,
+		droppedOldest
+	};
+};
+/** Later-wins merge of stored prior adjudications with freshly derived ones. */
+const mergeAdjudications = (prior, fresh) => {
+	const byIdentity = /* @__PURE__ */ new Map();
+	for (const adjudication of [...prior, ...fresh]) {
+		const identity = adjudicationIdentity(adjudication);
+		byIdentity.delete(identity);
+		byIdentity.set(identity, adjudication);
+	}
+	const merged = [...byIdentity.values()];
+	return merged.slice(Math.max(0, merged.length - 20));
 };
 /**
-* Concern candidates need explicit paths internally to bind the claim to
-* scheduled evidence. The verifier receives the complete bounded unit so it
-* can use neighboring evidence to falsify the claim. The public ReviewConcern
-* remains path-free after the host confirms and projects it.
+* Collect the standing maintainer adjudications: freshly derived through the
+* host, merged later-wins over the prior state's stored set. The host is a
+* visible Effect requirement; program edges that intentionally perform no
+* reads provide {@link noReviewAdjudicationHost}. Fail-open — any listing
+* fault keeps the complete prior set and never fails the review, because NOT
+* suppressing a finding is the conservative direction.
 */
-var DiscoveredConcern = class extends Schema.Class("@effect-agent/pr-review/DiscoveredConcern")({
-	concern: ReviewConcern,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
+const collectReviewAdjudications = Effect.fn("collectReviewAdjudications")(function* (prior) {
+	const host = yield* ReviewAdjudicationHost;
+	const listings = yield* Effect.all({
+		threads: host.listFindingThreads,
+		issueComments: host.listIssueComments
+	}).pipe(Effect.catch((error) => Effect.logWarning(`Could not collect adjudications from '${error.operation}': ${error.reason}; retaining stored adjudications unchanged.`).pipe(Effect.as(void 0))));
+	if (listings === void 0) return prior;
+	const derived = deriveAdjudications({
+		threads: listings.threads,
+		issueComments: listings.issueComments
+	});
+	for (const note of derived.ignored) yield* Effect.logDebug(`Ignored adjudication command — ${note}`);
+	if (derived.droppedOldest > 0) yield* Effect.logWarning(`Dropped ${derived.droppedOldest} oldest adjudication(s) over the 20-entry bound.`);
+	return mergeAdjudications(prior, derived.adjudications);
+});
+const lineRange = (startLine, endLine) => `${startLine}${endLine === startLine ? "" : `-${endLine}`}`;
+/** One adjudication as a bounded reviewer-prompt context line. */
+const renderAdjudicationContextLine = (adjudication) => {
+	const location = adjudication.path !== void 0 && adjudication.startLine !== void 0 && adjudication.endLine !== void 0 ? `${adjudication.path}:${lineRange(adjudication.startLine, adjudication.endLine)}` : "(unanchored)";
+	const reason = adjudication.reason === void 0 ? "" : `: ${adjudication.reason}`;
+	return `${location} "${adjudication.title}" — ${adjudication.disposition} by @${adjudication.actor}${reason}`;
+};
+/** One prior-round finding as a bounded reviewer-prompt context line. */
+const renderPriorFindingContextLine = (finding) => `${finding.path}:${lineRange(finding.startLine, finding.endLine)} [${finding.severity}] "${finding.title}" — ${finding.body.slice(0, 400)}`;
+/** Build the fan-out prior-review context from the resolved continuity data. */
+const buildPriorReviewContext = (adjudications, priorFindingsOnScope) => ({
+	adjudicated: adjudications.map((adjudication) => ({
+		path: adjudication.path,
+		line: renderAdjudicationContextLine(adjudication)
+	})),
+	priorFindings: priorFindingsOnScope.map((finding) => ({
+		path: finding.path,
+		line: renderPriorFindingContextLine(finding)
+	}))
+});
+//#endregion
+//#region src/internal/anchors.ts
+/** Why a finding cannot anchor to the current new-version diff, if any. */
+const anchorViolation = (finding, files) => {
+	const file = files.find((candidate) => candidate.path === finding.path);
+	if (file === void 0) return "path is not part of the changeset";
+	if (file.patch === void 0) return "file has no anchorable textual diff";
+	if (finding.endLine < finding.startLine) return "endLine precedes startLine";
+	if (finding.endLine - finding.startLine + 1 > 100) return "range is implausibly large";
+	const anchors = commentableLines(file.patch);
+	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!anchors.has(line)) return `line ${line} is not part of the diff`;
+};
+//#endregion
+//#region src/internal/coverage.ts
+var ReviewInputCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewInputCoverage")({
+	status: Schema.Literals(["complete", "incomplete"]),
+	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	assignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	/** Assigned paths whose model-visible diff was truncated by the evidence bound. */
+	partialPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	unassignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	/**
+	* Paths with neither a textual diff nor bounded base/head text (binaries,
+	* oversized files). Fail-closed: they keep the status incomplete for as
+	* long as they are part of the pull request — an unreviewable change must
+	* never authorize a green check. Exclude them deliberately with ignore
+	* globs when that is intended.
+	*/
+	undiffablePaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(20))
 }) {};
-const UnitPaths = Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-const RiskCategories = Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6));
-const Candidates = Schema.Array(ReviewCandidate).check(Schema.isMaxLength(18));
-const EvidenceShardIds = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-/** One complete host-selected evidence shard supplied to a review child. */
-var FileReviewEvidence = class extends Schema.Class("@effect-agent/pr-review/FileReviewEvidence")({
-	shardId: ReviewEvidenceShardId,
-	path: ChangedPath,
-	status: ChangedFileStatus,
-	reviewMode: Schema.Literals([
-		"diff",
-		"content",
-		"unavailable"
+var FailedReviewPass = class extends Schema.Class("@effect-agent/pr-review/FailedReviewPass")({
+	workId: Schema.NonEmptyString.check(Schema.isMaxLength(96)),
+	stage: Schema.Literals([
+		"discovery",
+		"specialist",
+		"verification"
 	]),
-	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	annotatedPatch: Schema.String.check(Schema.isMaxLength(MAX_PATCH_CHARS))
-}) {};
-/** Host-prepared child input with complete bounded diff/content evidence. */
-var FileReviewBrief = class extends Schema.Class("@effect-agent/pr-review/FileReviewBrief")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	paths: UnitPaths,
-	evidenceShardIds: EvidenceShardIds,
-	perspective: ReviewWorkPerspective,
-	riskCategories: RiskCategories,
-	/** Empty for discovery; the exact discovered set for unit verification. */
-	candidates: Candidates,
-	evidence: Schema.Array(FileReviewEvidence).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
-}) {};
-/** Child output; phase-inapplicable collections must be empty. */
-var FileReviewReport = class extends Schema.Class("@effect-agent/pr-review/FileReviewReport")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	findings: Schema.Array(ReviewFinding).check(Schema.isMaxLength(6)),
-	concerns: Schema.Array(DiscoveredConcern).check(Schema.isMaxLength(3)),
-	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
-	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
+	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
 }) {};
 /**
-* A structurally valid child report that does not answer the scheduled pass:
-* wrong identity, phase-inapplicable fields, or an inexact assessment set.
-* Retried once like any other pass fault, because it is model misbehavior,
-* not evidence about the code under review.
+* Settlement of scheduled review work. `incomplete` means reviewer-side work
+* failed after its bounded retry — a machinery gap that is carried forward and
+* retried on the next run, never a statement about the code under review.
+* `unverified` is the flat reviewer's honest constant: one pass with no
+* independent verifier is neither settled assurance nor a failure.
 */
-var ReviewPassMisbehaved = class extends Schema.TaggedError()("ReviewPassMisbehaved", {
-	workId: ReviewPassId,
-	reason: Schema.NonEmptyString.check(Schema.isMaxLength(600))
+var ReviewAssurance = class extends Schema.Class("@effect-agent/pr-review/ReviewAssurance")({
+	status: Schema.Literals([
+		"settled",
+		"incomplete",
+		"unverified"
+	]),
+	requiredGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	discoveredCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	confirmedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	rejectedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	unsettledCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Discovery claims discarded for anchors/paths outside their assigned evidence. */
+	discardedInvalidFindings: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	failedPasses: Schema.Array(FailedReviewPass).check(Schema.isMaxLength(64)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
 }) {};
-const staticGuidanceLines = (guidance) => {
-	if (guidance === void 0) return [];
-	return (typeof guidance === "string" ? [guidance] : guidance).filter((line) => line.length > 0);
+const toolTrace = (events) => {
+	const declared = /* @__PURE__ */ new Map();
+	const succeeded = /* @__PURE__ */ new Map();
+	const failed = /* @__PURE__ */ new Map();
+	for (const event of events) {
+		if (event._tag === "ToolCallDeclared") declared.set(event.toolCallId, event);
+		if (event._tag === "ToolCallSucceeded") succeeded.set(event.toolCallId, event);
+		if (event._tag === "ToolCallFailed") failed.set(event.toolCallId, event);
+	}
+	return {
+		declared,
+		succeeded,
+		failed
+	};
 };
-const evidenceInstructions = [
-	"The host placed complete bounded review evidence shards in the input evidence array. Treat every shard as required input; ordinal/total identifies multi-shard paths.",
-	"You have no tools and cannot roam outside this evidence. If it is insufficient for a candidate, reject or omit that candidate rather than guessing.",
-	"A diff marks new-version anchors as R<number>; only those lines may anchor findings. B/H content evidence is non-anchorable."
-];
-/** Discovery and verification instructions share one child definition. */
-const makeFileReviewerInstructions = (options = {}) => (brief) => {
-	const common = [
-		`You are an attached review worker for ${brief.workId} in host-planned unit ${brief.unitId}: ${brief.paths.join(", ")}.`,
-		...staticGuidanceLines(options.guidance),
-		...evidenceInstructions
-	];
-	if (brief.phase === "verification") return [
-		...common,
-		"Independently verify every candidate in the input. You did not receive another reviewer's transcript or reasoning; use only the candidate claim and bounded evidence.",
-		"The evidence array contains the complete bounded unit, including neighboring changed code that may confirm or falsify a locally plausible claim.",
-		"For each candidate, try to falsify it first. Confirm only when the cited behavior is supported and actionable. Reject unsupported, speculative, duplicate, or non-actionable candidates.",
-		"Return ONLY JSON with phase \"verification\", the exact workId/unitId, empty findings/concerns/fileSummaries arrays, and exactly one assessment per candidateId. Each assessment is {\"candidateId\": <exact id>, \"disposition\": <\"confirmed\" | \"rejected\">, \"suggestion\": <\"committable\" | \"not-committable\", present exactly when the candidate finding carries a suggestion>, \"rationale\": <bounded evidence-based reason>}. Never add or omit an id.",
-		"Settle every carried suggestion independently of the claim: answer \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else — it compiles in context and preserves the finding's intent, never prose describing a change. Otherwise answer \"not-committable\"; the host then publishes the confirmed finding without its suggestion. Omit the assessment \"suggestion\" field for candidates without one."
-	].join("\n");
-	const focus = brief.perspective === "risk-specialist" ? brief.riskCategories.length > 0 ? `This is a fresh specialist discovery pass. Concentrate on these host-classified risks without relying on another pass: ${brief.riskCategories.join(", ")}.` : "This is a fresh specialist discovery pass. The host found no keyword-classified category, so independently scrutinize authentication/authorization, security boundaries, durability, concurrency, credentials, and external side effects rather than treating classification silence as low risk." : "This is the general discovery pass. Review broadly for correctness, security, concurrency, resource, API, and error-handling defects.";
-	return [
-		...common,
-		focus,
-		"The discovery evidence array contains every complete shard in the unit. Review every entry and every shard of a multi-shard path. A later independent verifier, not you, decides which candidates publish.",
-		"When a non-anchored concern depends on one or more unit files, list 1-3 exact evidencePaths to bind the claim to scheduled evidence.",
-		`Return ONLY JSON with phase "discovery", the exact workId/unitId, up to 6 findings, up to 3 concerns shaped as {concern, evidencePaths}, one factual file summary per path (<= 240 chars), and an empty assessments array. Empty candidate arrays are valid; do not invent defects.`,
-		"Each finding is {\"path\": <a unit file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL problem-kind label>, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement source code for exactly lines startLine..endLine, ready to commit>}.",
-		"Include \"suggestion\" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement source for every line in the range and nothing else — never prose describing the change, which belongs in \"body\"."
-	].join("\n");
-};
-const fileReviewerInstructions = makeFileReviewerInstructions();
-const FileReviewToolkit = Toolkit.empty;
-const defaultFileReviewerPolicy = AgentPolicy.make({
-	maxTurns: 6,
-	maxToolCalls: 1,
-	maxDuration: "6 minutes",
-	toolConcurrency: 2,
-	repeatedFailureLimit: 6,
-	tokenBudget: 2e5,
-	contextTokenLimit: 15e4,
-	toolResultBounds: ToolResultBounds.make({ maxBytes: REVIEW_TOOL_RESULT_MAX_BYTES }),
-	onExhaustion: "fail"
-});
-const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
-	input: FileReviewBrief,
-	output: FileReviewReport,
-	instructions: makeFileReviewerInstructions(options),
-	toolkit: FileReviewToolkit,
-	policy: defaultFileReviewerPolicy,
-	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
-	metadata: {
-		deploymentClass: "E",
-		surface: "read-only",
-		stage: "discovery-verification"
-	}
-});
-const FileReviewer = makeFileReviewerDefinition();
-const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
-/** Rebuild one unit's complete evidence from the same snapshot the plan used. */
-const unitEvidence = (unit, files) => Effect.gen(function* () {
-	const byPath = new Map(files.map((file) => [file.path, file]));
-	const evidence = [];
-	for (const shard of unit.evidenceShards) {
-		const file = byPath.get(shard.path);
-		const chunk = file === void 0 ? void 0 : fileReviewEvidenceChunks(file)[shard.ordinal - 1];
-		if (file === void 0 || chunk === void 0) return yield* Effect.die(/* @__PURE__ */ new Error(`planned evidence shard has no source: ${shard.shardId} (${shard.path})`));
-		evidence.push(FileReviewEvidence.make({
-			shardId: shard.shardId,
-			path: shard.path,
-			status: file.status,
-			reviewMode: chunk.reviewMode,
-			ordinal: shard.ordinal,
-			total: shard.total,
-			annotatedPatch: chunk.annotatedPatch
-		}));
-	}
-	return evidence;
-});
-const misbehaved = (workId, reason) => ReviewPassMisbehaved.make({
-	workId,
-	reason: reason.slice(0, 600)
-});
-/** Validate that a verification report assesses exactly the scheduled candidates. */
-const validateVerificationReport = (brief, report) => {
-	if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return misbehaved(brief.workId, "verification output contained discovery-only fields");
-	const expectedById = new Map(brief.candidates.map((candidate) => [candidate.candidateId, candidate]));
-	const assessedIds = /* @__PURE__ */ new Set();
-	for (const assessment of report.assessments) {
-		const candidate = expectedById.get(assessment.candidateId);
-		if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
-		if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return misbehaved(brief.workId, "verification output did not settle suggestion publication exactly");
-		assessedIds.add(assessment.candidateId);
-	}
-	if (assessedIds.size !== expectedById.size) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+/** Render a bounded, deterministic "label (n): a, b, … (+k more)" reason line. */
+const boundedListReason = (label, values) => {
+	const items = sortedUnique(values);
+	let rendered = `${label} (${items.length}): `;
+	for (let index = 0; index < items.length; index += 1) {
+		const item = items[index] ?? "";
+		const separator = index === 0 ? "" : ", ";
+		const omitted = items.length - index - 1;
+		const suffix = omitted === 0 ? "" : ` … (+${omitted} more)`;
+		if (`${rendered}${separator}${item}${suffix}`.length > 1e3) {
+			const omission = `… (+${items.length - index} more)`;
+			return `${rendered.slice(0, 1e3 - omission.length)}${omission}`;
+		}
+		rendered = `${rendered}${separator}${item}`;
+	}
+	return rendered;
 };
 /**
-* Run one scheduled pass: execute the child, decode its report, and enforce
-* the pass contract. Any typed fault — child failure, malformed or misdirected
-* output — is retried once; budget exhaustion is terminal because a retry
-* would fail the same way. The settled outcome is a value either way, so one
-* flaky pass can never fail the whole pipeline.
+* Split carried scope into paths a retry can settle and paths it never can.
+* Undiffable files are a property of the pull request, not a transient
+* reviewer-side failure: gate reasons and rendered callouts must never promise
+* they are "retried automatically" — the honest instruction is to remove them
+* from the pull request or exclude them with ignore globs.
 */
-const runReviewPass = (binding, brief, budget) => Effect.gen(function* () {
-	const result = yield* AgentRuntime.run(binding, brief, {
-		...budget === void 0 ? {} : { budget },
-		estimateCostMicrousd: () => Effect.succeed(500)
-	});
-	const report = yield* Schema.decodeUnknownEffect(FileReviewReport)(result.output).pipe(Effect.mapError((error) => misbehaved(brief.workId, `child report failed to decode: ${error.message}`)));
-	if (report.phase !== brief.phase || report.workId !== brief.workId || report.unitId !== brief.unitId) return yield* misbehaved(brief.workId, "child report identity does not match the scheduled pass");
-	if (brief.phase === "verification") {
-		const violation = validateVerificationReport(brief, report);
-		if (violation !== void 0) return yield* violation;
-	} else if (report.assessments.length > 0) return yield* misbehaved(brief.workId, "discovery output contained verification-only assessments");
+const splitCarriedScope = (input) => {
+	const undiffable = new Set(input.inputCoverage?.undiffablePaths ?? []);
+	const retryablePaths = (input.unreviewedPaths ?? []).filter((path) => !undiffable.has(path));
+	const undiffablePaths = sortedUnique(undiffable);
+	const coverageGapBeyondUndiffable = input.inputCoverage?.status === "incomplete" && input.inputCoverage.reasons.length > (undiffablePaths.length > 0 ? 1 : 0);
 	return {
-		report,
-		turns: result.turns
+		retryablePaths,
+		undiffablePaths,
+		retryableGap: input.assurance?.status === "incomplete" || retryablePaths.length > 0 || coverageGapBeyondUndiffable
 	};
-}).pipe(Effect.scoped, Effect.retry({
-	times: 1,
-	while: (error) => error._tag !== "BudgetExceeded"
-}), Effect.map((settled) => ({
-	_tag: "settled",
-	...settled
-})), Effect.catch((error) => Effect.succeed({
-	_tag: "failed",
-	errorTag: String(error._tag).slice(0, 256)
-})));
+};
+const anchorSurfaceAdjusted = (inputCoverage, anchorFiles, totalAnchorFiles) => anchorFiles.length >= totalAnchorFiles ? inputCoverage : ReviewInputCoverage.make({
+	...inputCoverage,
+	status: "incomplete",
+	reasons: [...inputCoverage.reasons, `full pull-request anchor surface exposed ${anchorFiles.length} of ${totalAnchorFiles} required files`]
+});
+/** The flat reviewer's honest constant assurance: one pass, no verifier. */
+const flatAssurance = () => ReviewAssurance.make({
+	status: "unverified",
+	requiredGeneralDiscoveryPasses: 1,
+	completedGeneralDiscoveryPasses: 1,
+	requiredSpecialistPasses: 0,
+	completedSpecialistPasses: 0,
+	requiredVerificationPasses: 0,
+	completedVerificationPasses: 0,
+	discoveredCandidates: 0,
+	confirmedCandidates: 0,
+	rejectedCandidates: 0,
+	unsettledCandidates: 0,
+	discardedInvalidFindings: 0,
+	failedPasses: [],
+	reasons: ["flat review has no independent candidate-verification pass; use the fan-out pipeline for a settled assurance result"]
+});
 /**
-* Keep only findings anchored inside the pass's exact assigned evidence and
-* concerns bound to unit paths. Everything else is discarded and counted —
-* an invalid anchor invalidates one claim, never the pass that produced it.
+* Assess one settled flat run from its Run event trace: which required paths
+* received successful bounded diff evidence. This observes tool INPUT
+* assignment only — the host cannot know which evidence the model weighed.
 */
-const harvestDiscovery = (pass, unit, files, anchorFiles, report) => {
-	const allowed = new Set(pass.paths);
-	let discarded = 0;
-	const keptFindings = [];
-	for (const finding of report.findings) {
-		if (!allowed.has(finding.path) || anchorViolation(finding, anchorFiles) !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) {
-			discarded += 1;
-			continue;
-		}
-		keptFindings.push(finding);
-	}
-	const keptConcerns = [];
-	for (const candidate of report.concerns) {
-		if (candidate.evidencePaths.some((path) => !allowed.has(path))) {
-			discarded += 1;
-			continue;
+const assessFlatReview = (input) => {
+	const trace = toolTrace(input.events);
+	const requiredPaths = sortedUnique(input.files.map((file) => file.path));
+	const assigned = /* @__PURE__ */ new Set();
+	const partial = /* @__PURE__ */ new Set();
+	const failedPaths = /* @__PURE__ */ new Set();
+	for (const [toolCallId, declaration] of trace.declared) {
+		if (declaration.toolName !== "read_file_diff") continue;
+		const query = Schema.decodeUnknownOption(FileDiffQuery)(declaration.parameters);
+		if (Option.isNone(query)) continue;
+		const success = trace.succeeded.get(toolCallId);
+		if (success !== void 0) {
+			assigned.add(query.value.path);
+			const view = Schema.decodeUnknownOption(FileDiffView)(success.result);
+			if (Option.isSome(view) && view.value.truncated) partial.add(query.value.path);
 		}
-		keptConcerns.push(candidate);
+		if (trace.failed.has(toolCallId)) failedPaths.add(query.value.path);
 	}
+	const undiffable = new Set(input.files.filter((file) => !isReviewableFile(file)).map((file) => file.path));
+	const unassigned = requiredPaths.filter((path) => !undiffable.has(path) && (!assigned.has(path) || failedPaths.has(path)));
+	const reasons = [];
+	if (input.files.length < input.totalFiles) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (undiffable.size > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", undiffable));
+	if (failedPaths.size > 0) reasons.push(boundedListReason("diff reads failed", failedPaths));
+	if (partial.size > 0) reasons.push(boundedListReason("model-visible diff evidence was truncated", partial));
+	if (unassigned.length > 0) reasons.push(boundedListReason("required paths received no successful diff input", unassigned));
 	return {
-		candidates: [...keptFindings.map((finding, index) => FindingCandidate.make({
-			candidateId: `${pass.passId}:finding:${candidateOrdinal(index)}`,
-			workId: pass.passId,
-			unitId: pass.unitId,
-			finding,
-			evidencePaths: [finding.path]
-		})), ...keptConcerns.map((candidate, index) => ConcernCandidate.make({
-			candidateId: `${pass.passId}:concern:${candidateOrdinal(index)}`,
-			workId: pass.passId,
-			unitId: pass.unitId,
-			concern: candidate.concern,
-			evidencePaths: candidate.evidencePaths
-		}))],
-		fileSummaries: report.fileSummaries.filter((entry) => allowed.has(entry.path)),
-		discarded
+		inputCoverage: anchorSurfaceAdjusted(ReviewInputCoverage.make({
+			status: reasons.length === 0 ? "complete" : "incomplete",
+			requiredPaths,
+			assignedPaths: sortedUnique(assigned),
+			partialPaths: sortedUnique(partial),
+			unassignedPaths: sortedUnique(unassigned),
+			undiffablePaths: sortedUnique(undiffable),
+			reasons
+		}), input.anchorFiles, input.totalAnchorFiles),
+		assurance: flatAssurance(),
+		unreviewedPaths: sortedUnique([...unassigned, ...undiffable])
 	};
 };
-const reviewUnit = (binding, unit, passes, input) => Effect.gen(function* () {
-	const evidence = yield* unitEvidence(unit, input.files);
-	const failedPasses = [];
-	const candidates = [];
-	const subjects = /* @__PURE__ */ new Set();
-	const walkthrough = [];
-	let discardedFindings = 0;
-	let turns = 0;
-	let completedGeneralPasses = 0;
-	let completedSpecialistPasses = 0;
-	for (const pass of passes) {
-		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
-		const brief = FileReviewBrief.make({
-			phase: "discovery",
-			workId: pass.passId,
-			unitId: pass.unitId,
-			paths: pass.paths,
-			evidenceShardIds: pass.evidenceShardIds,
-			perspective: pass.perspective,
-			riskCategories: pass.riskCategories,
-			candidates: [],
-			evidence
-		});
-		const outcome = yield* runReviewPass(binding, brief, input.budget);
-		if (outcome._tag === "failed") {
-			failedPasses.push(FailedReviewPass.make({
-				workId: pass.passId,
-				stage,
-				errorTag: outcome.errorTag
-			}));
-			continue;
-		}
-		turns += outcome.turns;
-		if (stage === "specialist") completedSpecialistPasses += 1;
-		else completedGeneralPasses += 1;
-		const harvest = harvestDiscovery(pass, unit, input.files, input.anchorFiles, outcome.report);
-		discardedFindings += harvest.discarded;
-		if (pass.perspective === "general") walkthrough.push(...harvest.fileSummaries);
-		for (const candidate of harvest.candidates) {
-			const subject = reviewCandidateSubjectKey(candidate);
-			if (subjects.has(subject)) continue;
-			subjects.add(subject);
-			candidates.push(candidate);
+/**
+* Input coverage of one host-scheduled fan-out plan: which required paths the
+* bounded plan actually assigned complete evidence for. Capacity overflow and
+* undiffable paths are both real gaps; the pipeline carries them so the check
+* stays fail-closed until they are reviewed, removed, or explicitly ignored.
+*/
+const fanOutInputCoverage = (input) => {
+	const plan = input.plan;
+	const assignedPaths = sortedUnique(plan.units.flatMap((unit) => unit.paths));
+	const unassignedPaths = sortedUnique(plan.unassignedPaths);
+	const reasons = [];
+	if (plan.truncated) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (plan.undiffablePaths.length > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", plan.undiffablePaths));
+	if (plan.partialEvidencePaths.length > 0) reasons.push(boundedListReason("fan-out capacity left some deterministic evidence shards unassigned", plan.partialEvidencePaths));
+	if (plan.unassignedEvidenceShardCount > 0) {
+		reasons.push(`${plan.unassignedEvidenceShardCount} deterministic evidence shard(s) exceeded fan-out capacity`);
+		reasons.push(boundedListReason(`unassigned evidence shard identifier sample (${plan.unassignedEvidenceShardIds.length} of ${plan.unassignedEvidenceShardCount})`, plan.unassignedEvidenceShardIds));
+	}
+	if (plan.unassignedPaths.length > 0) reasons.push(boundedListReason("fan-out capacity left paths unassigned", plan.unassignedPaths));
+	return anchorSurfaceAdjusted(ReviewInputCoverage.make({
+		status: reasons.length === 0 ? "complete" : "incomplete",
+		requiredPaths: sortedUnique(input.files.map((file) => file.path)),
+		assignedPaths,
+		partialPaths: plan.partialEvidencePaths,
+		unassignedPaths,
+		undiffablePaths: sortedUnique(plan.undiffablePaths),
+		reasons
+	}), input.anchorFiles, input.totalAnchorFiles);
+};
+//#endregion
+//#region src/internal/review-units.ts
+/** The delegation fan-out bound: one parent Run spawns at most this many children. */
+const MAX_REVIEW_UNITS = 8;
+/** A unit never carries more files than this, regardless of their size. */
+const MAX_UNIT_FILES = 12;
+/**
+* Bound the complete model-visible evidence assigned to one child. This is a
+* character bound rather than a token estimate because it is deterministic,
+* provider-independent, and enforced before any model call.
+*/
+const UNIT_EVIDENCE_CHAR_BUDGET = 24e4;
+/** Maximum complete evidence shards placed in one child brief. */
+const MAX_UNIT_EVIDENCE_SHARDS = 12;
+/**
+* Keep overflow diagnostics bounded to one plan's total assignment capacity.
+* The plan separately records the exact overflow count and every affected
+* path, so identifiers are a deterministic diagnostic sample rather than the
+* authority for whether input coverage is complete.
+*/
+const MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS = 96;
+/** The merged review never exceeds the `CodeReview` findings bound. */
+const MAX_MERGED_FINDINGS = 20;
+const ReviewUnitId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** High-risk surfaces that receive an explicit specialist focus label. */
+const ReviewRiskCategory = Schema.Literals([
+	"authentication-authorization",
+	"security-boundary",
+	"persistence-durability",
+	"concurrency",
+	"credential-handling",
+	"external-side-effects"
+]);
+const ReviewDiscoveryPerspective = Schema.Literals(["general", "risk-specialist"]);
+const ReviewPassId = Schema.NonEmptyString.check(Schema.isMaxLength(64));
+const ReviewEvidenceShardId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** One complete bounded slice of a changed path's model-visible evidence. */
+var ReviewEvidenceShard = class extends Schema.Class("@effect-agent/pr-review/ReviewEvidenceShard")({
+	shardId: ReviewEvidenceShardId,
+	path: ChangedPath,
+	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(MAX_PATCH_CHARS))
+}) {};
+const EvidenceShardIds$1 = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** One required, independently scoped discovery attempt. */
+var ReviewDiscoveryPass = class extends Schema.Class("@effect-agent/pr-review/ReviewDiscoveryPass")({
+	passId: ReviewPassId,
+	unitId: ReviewUnitId,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	evidenceShardIds: EvidenceShardIds$1,
+	perspective: ReviewDiscoveryPerspective,
+	/** Empty for the general pass; explicit deterministic focus for specialists. */
+	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
+}) {};
+/** One bounded slice of the changeset delegated to one child reviewer. */
+var ReviewUnit = class extends Schema.Class("@effect-agent/pr-review/ReviewUnit")({
+	unitId: ReviewUnitId,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	evidenceShards: Schema.Array(ReviewEvidenceShard).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	/** additions + deletions across the unit's files, for honest sizing. */
+	changedLines: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Complete model-visible diff/content evidence assigned to each child. */
+	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(UNIT_EVIDENCE_CHAR_BUDGET)),
+	/** Host-classified focus labels for the unit's redundant specialist pass. */
+	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
+}) {};
+/** The complete deterministic fan-out plan over one changeset. */
+var ReviewUnitPlan = class extends Schema.Class("@effect-agent/pr-review/ReviewUnitPlan")({
+	totalFiles: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** True when the source returned fewer files than the pull request has. */
+	truncated: Schema.Boolean,
+	units: Schema.Array(ReviewUnit).check(Schema.isMaxLength(8)),
+	/** Exact discovery calls the coordinator must make. */
+	discoveryPasses: Schema.Array(ReviewDiscoveryPass).check(Schema.isMaxLength(16)),
+	/** Changed files with neither a textual diff nor bounded base/head text. */
+	undiffablePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
+	/** Assigned paths with one or more evidence shards beyond plan capacity. */
+	partialEvidencePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
+	/** Exact number of shards beyond the bounded unit capacity. */
+	unassignedEvidenceShardCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Bounded deterministic prefix of the unassigned shard identifiers. */
+	unassignedEvidenceShardIds: Schema.Array(ReviewEvidenceShardId).check(Schema.isMaxLength(96)),
+	/**
+	* Diffable files beyond the fan-out capacity (MAX_REVIEW_UNITS units of
+	* MAX_UNIT_FILES files). Never silently dropped: the coordinator must name
+	* them as unreviewed in its summary.
+	*/
+	unassignedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300))
+}) {};
+const riskRules = [
+	{
+		category: "authentication-authorization",
+		patterns: [
+			/auth/,
+			/authoriz/,
+			/permission/,
+			/principal/,
+			/access[-_ ]?control/,
+			/role\b/
+		]
+	},
+	{
+		category: "security-boundary",
+		patterns: [
+			/security/,
+			/sandbox/,
+			/untrusted/,
+			/schema\.decode/,
+			/validation/,
+			/injection/,
+			/csrf/,
+			/xss/,
+			/path traversal/
+		]
+	},
+	{
+		category: "persistence-durability",
+		patterns: [
+			/durab/,
+			/persist/,
+			/storage/,
+			/database/,
+			/\bsql\b/,
+			/journal/,
+			/ledger/,
+			/checkpoint/,
+			/migration/,
+			/transaction/
+		]
+	},
+	{
+		category: "concurrency",
+		patterns: [
+			/concurr/,
+			/semaphore/,
+			/\bfiber/,
+			/race/,
+			/mutex/,
+			/\block\b/,
+			/queue/,
+			/parallel/,
+			/interrupt/
+		]
+	},
+	{
+		category: "credential-handling",
+		patterns: [
+			/credential/,
+			/secret/,
+			/password/,
+			/api[-_ ]?key/,
+			/bearer/,
+			/hmac/,
+			/signature/
+		]
+	},
+	{
+		category: "external-side-effects",
+		patterns: [
+			/publish/,
+			/webhook/,
+			/github/,
+			/fetch\(/,
+			/http/,
+			/send[-_ ]?(email|message)/,
+			/write[-_ ]?(file|record)/,
+			/delete/,
+			/mutation/,
+			/side[-_ ]?effect/,
+			/spawn/,
+			/exec/
+		]
+	}
+];
+/**
+* Deterministic host policy for specialist assignment. It intentionally
+* favors false positives: an extra bounded pass costs work, while a missed
+* high-risk classification removes redundancy. This is not a claim that the
+* keyword policy recognizes every semantically risky change.
+*/
+const classifyReviewRisks = (file) => {
+	const text = [
+		file.path,
+		file.previousPath ?? "",
+		file.patch ?? "",
+		file.reviewBaseContent ?? "",
+		file.reviewHeadContent ?? ""
+	].join("\n").toLowerCase();
+	return riskRules.filter((rule) => rule.patterns.some((pattern) => pattern.test(text))).map((rule) => rule.category);
+};
+/**
+* Whether every claimed finding anchor was present in the exact bounded
+* evidence shards assigned to one unit. This is stricter than checking the
+* full pull-request diff when an oversized path spans multiple units.
+*/
+const findingAnchorInUnitEvidence = (finding, unit, files) => {
+	const file = files.find((candidate) => candidate.path === finding.path);
+	if (file?.patch === void 0 || finding.endLine < finding.startLine) return false;
+	const assignedOrdinals = new Set(unit.evidenceShards.filter((shard) => shard.path === finding.path).map((shard) => shard.ordinal));
+	const visibleLines = /* @__PURE__ */ new Set();
+	const chunks = fileReviewEvidenceChunks(file);
+	for (let index = 0; index < chunks.length; index += 1) {
+		if (!assignedOrdinals.has(index + 1)) continue;
+		for (const line of chunks[index]?.annotatedPatch.split("\n") ?? []) {
+			const match = /^R(\d+) /.exec(line);
+			if (match?.[1] !== void 0) visibleLines.add(Number(match[1]));
 		}
 	}
-	const confirmed = [];
-	let rejectedCandidates = 0;
-	let unsettledCandidates = 0;
-	let completedVerificationPasses = 0;
-	const requiredVerificationPasses = candidates.length > 0 ? 1 : 0;
-	if (candidates.length > 0) {
-		const workId = `${unit.unitId}-verification`;
-		const brief = FileReviewBrief.make({
-			phase: "verification",
-			workId,
-			unitId: unit.unitId,
-			paths: unit.paths,
-			evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-			perspective: "candidate-verification",
-			riskCategories: unit.riskCategories,
-			candidates,
-			evidence
-		});
-		const outcome = yield* runReviewPass(binding, brief, input.budget);
-		if (outcome._tag === "failed") {
-			unsettledCandidates = candidates.length;
-			failedPasses.push(FailedReviewPass.make({
-				workId,
-				stage: "verification",
-				errorTag: outcome.errorTag
-			}));
-		} else {
-			turns += outcome.turns;
-			completedVerificationPasses = 1;
-			const byId = new Map(candidates.map((candidate) => [candidate.candidateId, candidate]));
-			for (const assessment of outcome.report.assessments) {
-				const candidate = byId.get(assessment.candidateId);
-				if (candidate === void 0) continue;
-				if (assessment.disposition === "confirmed") confirmed.push({
-					assessment,
-					candidate
-				});
-				else rejectedCandidates += 1;
-			}
+	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!visibleLines.has(line)) return false;
+	return true;
+};
+const uniquePaths = (shards) => [...new Set(shards.map(({ shard }) => shard.path))];
+const plannedEvidenceShards = (files) => {
+	const planned = [];
+	let shardIndex = 0;
+	for (const file of files) {
+		const chunks = fileReviewEvidenceChunks(file);
+		for (let index = 0; index < chunks.length; index += 1) {
+			const chunk = chunks[index];
+			if (chunk === void 0) continue;
+			shardIndex += 1;
+			planned.push({
+				shard: ReviewEvidenceShard.make({
+					shardId: `shard-${String(shardIndex).padStart(4, "0")}`,
+					path: file.path,
+					ordinal: index + 1,
+					total: chunks.length,
+					evidenceChars: chunk.annotatedPatch.length
+				}),
+				file,
+				changedLines: index === 0 ? file.additions + file.deletions : 0
+			});
 		}
 	}
-	return {
-		failedPasses,
-		discoveredCandidates: candidates.length,
-		confirmed,
-		rejectedCandidates,
-		unsettledCandidates,
-		discardedFindings,
-		walkthrough,
-		turns,
-		completedGeneralPasses,
-		completedSpecialistPasses,
-		requiredVerificationPasses,
-		completedVerificationPasses,
-		unreviewedPaths: failedPasses.length > 0 ? unit.paths : []
-	};
-});
-const countNoun = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
-const composeSummary = (plan, assurance) => {
-	const requiredDiscovery = assurance.requiredGeneralDiscoveryPasses + assurance.requiredSpecialistPasses;
-	const completedDiscovery = assurance.completedGeneralDiscoveryPasses + assurance.completedSpecialistPasses;
-	const parts = [`Reviewed ${countNoun(plan.totalFiles, "changed file")} across ${countNoun(plan.units.length, "bounded unit")}: ${completedDiscovery}/${requiredDiscovery} discovery and ${assurance.completedVerificationPasses}/${assurance.requiredVerificationPasses} verification pass(es) settled; ${assurance.confirmedCandidates} of ${countNoun(assurance.discoveredCandidates, "discovered candidate")} confirmed by independent verification.`];
-	if (assurance.failedPasses.length > 0) parts.push(`${countNoun(assurance.failedPasses.length, "pass")} did not settle; the affected paths are carried forward and retried on the next run. This is a reviewer-side gap, not a code defect.`);
-	if (assurance.discardedInvalidFindings > 0) parts.push(`${countNoun(assurance.discardedInvalidFindings, "candidate")} discarded for anchors or paths outside the assigned evidence.`);
-	if (plan.undiffablePaths.length > 0) parts.push(`${countNoun(plan.undiffablePaths.length, "path")} had no reviewable textual evidence and keep input coverage incomplete; exclude such paths with ignore globs when that is intended.`);
-	if (plan.unassignedPaths.length > 0 || plan.unassignedEvidenceShardCount > 0) parts.push("The changeset exceeded the bounded fan-out capacity; unassigned scope is reported under input coverage.");
-	parts.push("No configured pipeline can prove absence of defects; this describes settled work only.");
-	return parts.join(" ").slice(0, 4e3);
+	return planned;
 };
+const unitOf = (index, shards) => ReviewUnit.make({
+	unitId: `unit-${String(index + 1).padStart(3, "0")}`,
+	paths: uniquePaths(shards),
+	evidenceShards: shards.map(({ shard }) => shard),
+	changedLines: shards.reduce((total, shard) => total + shard.changedLines, 0),
+	evidenceChars: shards.reduce((total, { shard }) => total + shard.evidenceChars, 0),
+	riskCategories: [...new Set(shards.flatMap(({ file }) => classifyReviewRisks(file)))]
+});
+const discoveryPassesFor = (units) => units.flatMap((unit) => [ReviewDiscoveryPass.make({
+	passId: `${unit.unitId}-general`,
+	unitId: unit.unitId,
+	paths: unit.paths,
+	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+	perspective: "general",
+	riskCategories: []
+}), ReviewDiscoveryPass.make({
+	passId: `${unit.unitId}-specialist`,
+	unitId: unit.unitId,
+	paths: unit.paths,
+	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+	perspective: "risk-specialist",
+	riskCategories: unit.riskCategories
+})]);
 /**
-* Run the complete host-scheduled fan-out pipeline over one selected
-* changeset snapshot: plan, independent discovery, exact verification, and a
-* deterministic host-composed CodeReview from verifier-confirmed candidates
-* only. The verdict is derived from confirmed severities, never model prose.
+* Group the changeset into at most `MAX_REVIEW_UNITS` review units.
+*
+* Deterministic by construction: files are ordered by path (so files sharing
+* a directory become neighbors — directory affinity without a heuristic),
+* then split into complete line-bounded evidence shards and packed greedily
+* under the hard evidence and per-unit shard bounds. Capacity is finite and
+* explicit:
+*
+* - files without a textual diff are still delegated when the source
+*   recovered complete bounded UTF-8 base/head content. Findings from that
+*   evidence cannot anchor inline and are reported as concerns;
+* - files with neither form of textual evidence surface in
+*   `undiffablePaths` instead of laundering missing coverage;
+* - an oversized path spans as many deterministic shards and units as needed;
+* - shards beyond `MAX_REVIEW_UNITS` full units surface explicitly, so a path
+*   is partial only when finite plan capacity is genuinely exhausted.
 */
-const runFanOutReview = (binding, input) => Effect.gen(function* () {
-	const plan = planReviewUnits(input.files, { totalChangedFiles: input.totalChangedFiles });
-	const passesByUnit = /* @__PURE__ */ new Map();
-	for (const pass of plan.discoveryPasses) {
-		const passes = passesByUnit.get(pass.unitId) ?? [];
-		passes.push(pass);
-		passesByUnit.set(pass.unitId, passes);
+const planReviewUnits = (files, options) => {
+	const ordered = [...files].sort((left, right) => left.path < right.path ? -1 : 1);
+	const reviewable = ordered.filter(isReviewableFile);
+	const undiffable = ordered.filter((file) => !isReviewableFile(file));
+	const shards = plannedEvidenceShards(reviewable);
+	const groups = [];
+	const unassigned = [];
+	let current = [];
+	let currentEvidenceChars = 0;
+	for (const shard of shards) {
+		const nextPaths = /* @__PURE__ */ new Set([...uniquePaths(current), shard.shard.path]);
+		if (current.length >= 12 || nextPaths.size > 12 || current.length > 0 && currentEvidenceChars + shard.shard.evidenceChars > 24e4) {
+			groups.push(current);
+			current = [];
+			currentEvidenceChars = 0;
+		}
+		if (groups.length >= 8) {
+			unassigned.push(shard);
+			continue;
+		}
+		current.push(shard);
+		currentEvidenceChars += shard.shard.evidenceChars;
 	}
-	const outcomes = yield* Effect.forEach(plan.units, (unit) => reviewUnit(binding, unit, passesByUnit.get(unit.unitId) ?? [], input), { concurrency: 4 });
-	const failedPasses = outcomes.flatMap((outcome) => outcome.failedPasses);
-	const unsettledCandidates = outcomes.reduce((total, outcome) => total + outcome.unsettledCandidates, 0);
-	const reasons = [];
-	if (failedPasses.length > 0) reasons.push(boundedListReason("configured review passes did not settle", failedPasses.map((pass) => `${pass.workId} (${pass.errorTag})`)));
-	if (unsettledCandidates > 0) reasons.push(`${unsettledCandidates} discovered candidate(s) did not receive exact verification`);
-	const requiredSpecialistPasses = plan.discoveryPasses.filter((pass) => pass.perspective === "risk-specialist").length;
-	const confirmed = outcomes.flatMap((outcome) => outcome.confirmed);
-	const assurance = ReviewAssurance.make({
-		status: reasons.length === 0 ? "settled" : "incomplete",
-		requiredGeneralDiscoveryPasses: plan.discoveryPasses.length - requiredSpecialistPasses,
-		completedGeneralDiscoveryPasses: outcomes.reduce((total, outcome) => total + outcome.completedGeneralPasses, 0),
-		requiredSpecialistPasses,
-		completedSpecialistPasses: outcomes.reduce((total, outcome) => total + outcome.completedSpecialistPasses, 0),
-		requiredVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.requiredVerificationPasses, 0),
-		completedVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.completedVerificationPasses, 0),
-		discoveredCandidates: outcomes.reduce((total, outcome) => total + outcome.discoveredCandidates, 0),
-		confirmedCandidates: confirmed.length,
-		rejectedCandidates: outcomes.reduce((total, outcome) => total + outcome.rejectedCandidates, 0),
-		unsettledCandidates,
-		discardedInvalidFindings: outcomes.reduce((total, outcome) => total + outcome.discardedFindings, 0),
-		failedPasses,
-		reasons
-	});
-	const findings = rankAndDedupeFindings(confirmed.flatMap(({ assessment, candidate }) => candidate._tag === "FindingCandidate" ? [confirmedFindingForPublication(assessment, candidate)] : []));
-	const concerns = rankAndDedupeConcerns(confirmed.flatMap(({ candidate }) => candidate._tag === "ConcernCandidate" ? [candidate.concern] : []));
-	const walkthrough = outcomes.flatMap((outcome) => outcome.walkthrough);
-	const blocking = findings.some((finding) => finding.severity === "blocking") || concerns.some((concern) => concern.severity === "blocking");
-	return {
-		review: CodeReview.make({
-			summary: composeSummary(plan, assurance),
-			verdict: blocking ? "request-changes" : findings.length > 0 || concerns.length > 0 ? "comment" : "approve",
-			findings,
-			...concerns.length === 0 ? {} : { concerns },
-			...walkthrough.length === 0 ? {} : { walkthrough }
-		}),
-		assurance,
-		plan,
-		unreviewedPaths: [.../* @__PURE__ */ new Set([
-			...outcomes.flatMap((outcome) => outcome.unreviewedPaths),
-			...plan.unassignedPaths,
-			...plan.partialEvidencePaths,
-			...plan.undiffablePaths
-		])].sort(),
-		turns: outcomes.reduce((total, outcome) => total + outcome.turns, 0)
-	};
-});
-//#endregion
-//#region src/internal/fingerprint.ts
-const MARKER_PREFIX = "<!-- effect-agent-pr-review fingerprint=sha256:";
-const MARKER_SUFFIX = " -->";
-const MARKER_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:([0-9a-f]{64}) -->/g;
-/** Render the invisible review-body marker for one fingerprint. */
-const renderFingerprintMarker = (fingerprint) => `${MARKER_PREFIX}${fingerprint}${MARKER_SUFFIX}`;
-/** The rendered marker length is fixed; publication reserves room for it. */
-const FINGERPRINT_MARKER_LENGTH = renderFingerprintMarker("0".repeat(64)).length;
-/** Extract the last fingerprint marker in one review body, if any. */
-const extractFingerprint = (body) => {
-	let last;
-	for (const match of body.matchAll(MARKER_PATTERN)) last = match[1];
-	return last;
+	if (current.length > 0 && groups.length < 8) groups.push(current);
+	const units = groups.map((group, index) => unitOf(index, group));
+	const assignedShardIds = new Set(units.flatMap((unit) => unit.evidenceShards.map((shard) => shard.shardId)));
+	const assignedPaths = new Set(shards.filter(({ shard }) => assignedShardIds.has(shard.shardId)).map(({ shard }) => shard.path));
+	const unassignedPathsWithEvidence = new Set(unassigned.map(({ shard }) => shard.path));
+	return ReviewUnitPlan.make({
+		totalFiles: files.length,
+		truncated: files.length < options.totalChangedFiles,
+		units,
+		discoveryPasses: discoveryPassesFor(units),
+		undiffablePaths: undiffable.map((file) => file.path),
+		partialEvidencePaths: [...unassignedPathsWithEvidence].filter((path) => assignedPaths.has(path)),
+		unassignedEvidenceShardCount: unassigned.length,
+		unassignedEvidenceShardIds: unassigned.slice(0, 96).map(({ shard }) => shard.shardId),
+		unassignedPaths: [...unassignedPathsWithEvidence].filter((path) => !assignedPaths.has(path))
+	});
 };
-/** WebCrypto SHA-256; unavailable crypto is a defect, not an expected failure. */
-const sha256Hex = (text) => Effect.promise(async () => {
-	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
-	return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-const FIELD = "\0";
-const RECORD = "
";
-const SECTION = "";
+const severityRank = {
+	blocking: 0,
+	important: 1,
+	nit: 2
+};
+const anchorKey = (finding) => `${finding.path} ${finding.startLine} ${finding.endLine}`;
 /**
-* Unified-diff hunk coordinates describe where a patch applies, not what it
-* changes. A content-equivalent rebase can shift both coordinates while
-* leaving every context/addition/deletion line unchanged, so exclude only
-* those coordinates from the canonical patch representation.
+* Merge the children's findings into one bounded, deterministic list: dedupe
+* findings sharing an anchor (path + line range) keeping the most severe —
+* and, at equal severity, the first in declaration order — then rank by
+* severity, path, and line, and cap at the `CodeReview` findings bound.
+* This is the merge policy the coordinator's instructions state in prose;
+* pinning it here keeps the policy itself deterministic and testable.
 */
-const canonicalPatch = (patch) => patch.replace(/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/gm, "@@ -_ +_ @@");
+const rankAndDedupeFindings = (findings) => {
+	const byAnchor = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const key = anchorKey(finding);
+		const existing = byAnchor.get(key);
+		if (existing === void 0 || severityRank[finding.severity] < severityRank[existing.severity]) byAnchor.set(key, finding);
+	}
+	return [...byAnchor.values()].sort((left, right) => {
+		const bySeverity = severityRank[left.severity] - severityRank[right.severity];
+		if (bySeverity !== 0) return bySeverity;
+		if (left.path !== right.path) return left.path < right.path ? -1 : 1;
+		return left.startLine - right.startLine;
+	}).slice(0, 20);
+};
 /**
-* Canonical changeset encoding: sorted by path so provider ordering never
-* matters, with every review-relevant field of every file.
+* Stable identity for one concern. The paths are part of the claim: identical
+* prose about two independent files must not collapse into one item.
 */
-const canonicalChangeset = (files) => files.map((file) => `${file.path}${FIELD}${file.status}${FIELD}${String(file.additions)}${FIELD}${String(file.deletions)}${FIELD}${file.patch === void 0 ? "" : canonicalPatch(file.patch)}${FIELD}${file.reviewBaseContent ?? ""}${FIELD}${file.reviewHeadContent ?? ""}`).sort().join(RECORD);
+const reviewConcernKey = (concern) => `${(concern.evidencePaths ?? []).join("\0")}\u0001${concern.title}\u0000${concern.body}`;
 /**
-* Fingerprint one review's complete input surface: the (already
-* ignore-filtered) changeset plus the caller's prompt signature — the
-* rendered instructions and any review-shaping options the instructions do
-* not carry.
+* The concern analogue of `rankAndDedupeFindings`: dedupe by exact scoped
+* content keeping the most severe duplicate, rank by severity, and cap at the
+* `CodeReview` concerns bound.
 */
-const computeChangesetFingerprint = (files, signature) => sha256Hex(`${canonicalChangeset(files)}${SECTION}${signature}`);
+const rankAndDedupeConcerns = (concerns) => {
+	const byContent = /* @__PURE__ */ new Map();
+	for (const concern of concerns) {
+		const key = reviewConcernKey(concern);
+		const previous = byContent.get(key);
+		if (previous === void 0 || severityRank[concern.severity] < severityRank[previous.severity]) byContent.set(key, concern);
+	}
+	return [...byContent.values()].sort((left, right) => severityRank[left.severity] - severityRank[right.severity]).slice(0, 10);
+};
 //#endregion
-//#region src/internal/review-state.ts
-const ReviewMode = Schema.Literals(["incremental", "final"]);
-const ReviewScopeMode = Schema.Literals(["incremental", "full"]);
-const GitCommitSha = Schema.NonEmptyString.check(Schema.isMaxLength(64), Schema.isPattern(/^[0-9a-f]{40,64}$/));
-const Fingerprint = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
-const StoredText = Schema.NonEmptyString.check(Schema.isMaxLength(800));
-/** A compact unresolved finding suitable for the bounded review-body marker. */
-var StoredReviewFinding = class extends Schema.Class("@effect-agent/pr-review/StoredReviewFinding")({
+//#region src/internal/fan-out.ts
+/** One discovery pass returns at most this many anchored candidates. */
+const MAX_CHILD_FINDINGS = 6;
+/** One discovery pass returns at most this many non-anchored candidates. */
+const MAX_CHILD_CONCERNS = 3;
+/** Every unit receives independent general and specialist discovery passes. */
+const MAX_UNIT_CANDIDATES = 18;
+/**
+* General + specialist discovery for every unit, then one verifier per unit.
+* The one-retry budget doubles the worst-case child Run count, but the
+* schedule itself never exceeds this bound.
+*/
+const MAX_REVIEW_CHILDREN = 24;
+/** Bounded structured concurrency across units; passes inside a unit are sequential. */
+const REVIEW_UNIT_CONCURRENCY = 4;
+/** Structural minimum for a child that exposes no tools. */
+const MAX_FILE_REVIEW_TOOL_CALLS = 1;
+const ReviewWorkPhase = Schema.Literals(["discovery", "verification"]);
+const ReviewWorkPerspective = Schema.Literals([
+	"general",
+	"risk-specialist",
+	"candidate-verification"
+]);
+const ReviewCandidateId = Schema.NonEmptyString.check(Schema.isMaxLength(96));
+var FindingCandidate = class extends Schema.TaggedClass()("FindingCandidate", {
+	candidateId: ReviewCandidateId,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	finding: ReviewFinding,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(1))
+}) {};
+var ConcernCandidate = class extends Schema.TaggedClass()("ConcernCandidate", {
+	candidateId: ReviewCandidateId,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	concern: ReviewConcern,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
+}) {};
+const ReviewCandidate = Schema.Union([FindingCandidate, ConcernCandidate]);
+/** Deterministic host equivalence for claims repeated across discovery passes. */
+const reviewCandidateSubjectKey = (candidate) => candidate._tag === "FindingCandidate" ? `finding:${JSON.stringify(Schema.encodeSync(ReviewFinding)(candidate.finding))}` : `concern:${JSON.stringify(Schema.encodeSync(ReviewConcern)(candidate.concern))}`;
+var CandidateAssessment = class extends Schema.Class("@effect-agent/pr-review/CandidateAssessment")({
+	candidateId: ReviewCandidateId,
+	disposition: Schema.Literals(["confirmed", "rejected"]),
+	/**
+	* Exact suggestion settlement: required when the candidate finding carries
+	* a suggestion, forbidden otherwise. Untrusted child output cannot publish
+	* a GitHub replacement block by prompt compliance alone — the host keeps a
+	* confirmed finding's suggestion only on an exact "committable" settlement.
+	*/
+	suggestion: Schema.optionalKey(Schema.Literals(["committable", "not-committable"]).annotate({ description: "Required exactly when the candidate finding carries a suggestion: \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else. Forbidden for candidates without a suggestion." })),
+	rationale: Schema.NonEmptyString.check(Schema.isMaxLength(600))
+}) {};
+/**
+* Exact suggestion settlement shape: a carried suggestion must be settled and
+* nothing else may be. A verification report that violates it is treated as a
+* misbehaving pass and retried within the pass budget.
+*/
+const assessmentSettlesSuggestionExactly = (assessment, candidate) => candidate._tag === "FindingCandidate" && candidate.finding.suggestion !== void 0 ? assessment.suggestion !== void 0 : assessment.suggestion === void 0;
+/**
+* Fail-closed publication of a confirmed finding: only an exact "committable"
+* settlement keeps the suggestion; anything else publishes the finding with
+* the suggestion stripped so unverified text can never become a one-click
+* GitHub replacement block.
+*/
+const confirmedFindingForPublication = (assessment, candidate) => {
+	if (candidate.finding.suggestion === void 0 || assessment.suggestion === "committable") return candidate.finding;
+	const { suggestion: _stripped, ...finding } = candidate.finding;
+	return ReviewFinding.make(finding);
+};
+/**
+* Concern candidates need explicit paths internally to bind the claim to
+* scheduled evidence. The verifier receives the complete bounded unit so it
+* can use neighboring evidence to falsify the claim. The host copies these
+* validated paths onto a confirmed public concern for incremental continuity.
+*/
+var DiscoveredConcern = class extends Schema.Class("@effect-agent/pr-review/DiscoveredConcern")({
+	concern: ReviewConcern,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
+}) {};
+const UnitPaths = Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** Bounded prior-review context lines injected into discovery instructions. */
+const UnitContextLines = Schema.Array(Schema.String.check(Schema.isMaxLength(1200))).check(Schema.isMaxLength(20));
+const RiskCategories = Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6));
+const Candidates = Schema.Array(ReviewCandidate).check(Schema.isMaxLength(18));
+const EvidenceShardIds = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** One complete host-selected evidence shard supplied to a review child. */
+var FileReviewEvidence = class extends Schema.Class("@effect-agent/pr-review/FileReviewEvidence")({
+	shardId: ReviewEvidenceShardId,
 	path: ChangedPath,
-	startLine: Schema.Int.check(Schema.isGreaterThan(0)),
-	endLine: Schema.Int.check(Schema.isGreaterThan(0)),
-	severity: FindingSeverity,
-	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
-	body: StoredText
+	status: ChangedFileStatus,
+	reviewMode: Schema.Literals([
+		"diff",
+		"content",
+		"unavailable"
+	]),
+	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	annotatedPatch: Schema.String.check(Schema.isMaxLength(MAX_PATCH_CHARS))
 }) {};
-/** A compact unresolved non-anchored concern carried until a final audit. */
-var StoredReviewConcern = class extends Schema.Class("@effect-agent/pr-review/StoredReviewConcern")({
-	severity: FindingSeverity,
-	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
-	body: StoredText
+/** Host-prepared child input with complete bounded diff/content evidence. */
+var FileReviewBrief = class extends Schema.Class("@effect-agent/pr-review/FileReviewBrief")({
+	phase: ReviewWorkPhase,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	paths: UnitPaths,
+	evidenceShardIds: EvidenceShardIds,
+	perspective: ReviewWorkPerspective,
+	riskCategories: RiskCategories,
+	/** Empty for discovery; the exact discovered set for unit verification. */
+	candidates: Candidates,
+	evidence: Schema.Array(FileReviewEvidence).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	/** Maintainer-adjudicated identities on this unit; do not re-raise. */
+	adjudicatedContext: Schema.optionalKey(UnitContextLines),
+	/** Prior-round findings on this unit's re-reviewed paths. */
+	priorFindingContext: Schema.optionalKey(UnitContextLines)
+}) {};
+/** Child output; phase-inapplicable collections must be empty. */
+var FileReviewReport = class extends Schema.Class("@effect-agent/pr-review/FileReviewReport")({
+	phase: ReviewWorkPhase,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	findings: Schema.Array(ReviewFinding).check(Schema.isMaxLength(6)),
+	concerns: Schema.Array(DiscoveredConcern).check(Schema.isMaxLength(3)),
+	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
+	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
 }) {};
-/** The carried-scope bound; a run that cannot fit its leftovers publishes no state. */
-const MAX_STORED_UNREVIEWED_PATHS = 100;
 /**
-* Versioned state embedded after EVERY completed run that can be signed. The
-* head plus full-scope fingerprint forms an incremental baseline; an absent
-* unresolved item never means the path is defect-free. `unreviewedPaths`
-* carries retryable review gaps (failed passes) forward so the next
-* incremental run re-reviews exactly them plus the new delta — the baseline
-* advances monotonically instead of freezing on one flaky pass and reopening
-* the whole post-baseline scope. The `acceptedScopeFingerprint` name is
-* retained for wire compatibility. Storing hundreds of path strings
-* separately would not fit GitHub's bounded review body in the worst case.
+* A structurally valid child report that does not answer the scheduled pass:
+* wrong identity, phase-inapplicable fields, or an inexact assessment set.
+* Retried once like any other pass fault, because it is model misbehavior,
+* not evidence about the code under review.
 */
-var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewState")({
-	version: Schema.Literal(2),
-	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
-	pullRequestNumber: Schema.Int.check(Schema.isGreaterThan(0)),
-	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	baseSha: GitCommitSha,
-	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	reviewedHeadSha: GitCommitSha,
-	profileFingerprint: Fingerprint,
-	acceptedScopeFingerprint: Fingerprint,
-	reviewedPathCount: Schema.Int.check(Schema.isBetween({
-		minimum: 0,
-		maximum: 300
-	})),
-	unresolvedFindings: Schema.Array(StoredReviewFinding).check(Schema.isMaxLength(20)),
-	unresolvedConcerns: Schema.Array(StoredReviewConcern).check(Schema.isMaxLength(10)),
-	/** Retryable review gaps carried into the next incremental run's scope. */
-	unreviewedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(100)),
-	/**
-	* True only when the producing run had complete input coverage, no
-	* unsettled pass, and nothing carried. Skip-unchanged authority: an
-	* unchanged patch may skip re-review only over a settled state.
-	*/
-	settled: Schema.Boolean,
-	lastReviewMode: ReviewScopeMode
+var ReviewPassMisbehaved = class extends Schema.TaggedError()("ReviewPassMisbehaved", {
+	workId: ReviewPassId,
+	reason: Schema.NonEmptyString.check(Schema.isMaxLength(600))
 }) {};
-const toStoredFinding = (finding) => StoredReviewFinding.make({
-	path: finding.path,
-	startLine: finding.startLine,
-	endLine: finding.endLine,
-	severity: finding.severity,
-	title: finding.title,
-	body: finding.body.slice(0, 800)
-});
-const fromStoredFinding = (finding) => ReviewFinding.make({
-	path: finding.path,
-	startLine: finding.startLine,
-	endLine: finding.endLine,
-	severity: finding.severity,
-	title: finding.title,
-	body: finding.body
-});
-const toStoredConcern = (concern) => StoredReviewConcern.make({
-	severity: concern.severity,
-	title: concern.title,
-	body: concern.body.slice(0, 800)
+const staticGuidanceLines = (guidance) => {
+	if (guidance === void 0) return [];
+	return (typeof guidance === "string" ? [guidance] : guidance).filter((line) => line.length > 0);
+};
+const evidenceInstructions = [
+	"The host placed complete bounded review evidence shards in the input evidence array. Treat every shard as required input; ordinal/total identifies multi-shard paths.",
+	"You have no tools and cannot roam outside this evidence. If it is insufficient for a candidate, reject or omit that candidate rather than guessing.",
+	"A diff marks new-version anchors as R<number>; only those lines may anchor findings. B/H content evidence is non-anchorable."
+];
+/** Discovery and verification instructions share one child definition. */
+const makeFileReviewerInstructions = (options = {}) => (brief) => {
+	const common = [
+		`You are an attached review worker for ${brief.workId} in host-planned unit ${brief.unitId}: ${brief.paths.join(", ")}.`,
+		...staticGuidanceLines(options.guidance),
+		...evidenceInstructions
+	];
+	if (brief.phase === "verification") return [
+		...common,
+		"Independently verify every candidate in the input. You did not receive another reviewer's transcript or reasoning; use only the candidate claim and bounded evidence.",
+		"The evidence array contains the complete bounded unit, including neighboring changed code that may confirm or falsify a locally plausible claim.",
+		"For each candidate, try to falsify it first. Confirm only when the cited behavior is supported and actionable. Reject unsupported, speculative, duplicate, or non-actionable candidates.",
+		"Return ONLY JSON with phase \"verification\", the exact workId/unitId, empty findings/concerns/fileSummaries arrays, and exactly one assessment per candidateId. Each assessment is {\"candidateId\": <exact id>, \"disposition\": <\"confirmed\" | \"rejected\">, \"suggestion\": <\"committable\" | \"not-committable\", present exactly when the candidate finding carries a suggestion>, \"rationale\": <bounded evidence-based reason>}. Never add or omit an id.",
+		"Settle every carried suggestion independently of the claim: answer \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else — it compiles in context and preserves the finding's intent, never prose describing a change. Otherwise answer \"not-committable\"; the host then publishes the confirmed finding without its suggestion. Omit the assessment \"suggestion\" field for candidates without one."
+	].join("\n");
+	const focus = brief.perspective === "risk-specialist" ? brief.riskCategories.length > 0 ? `This is a fresh specialist discovery pass. Concentrate on these host-classified risks without relying on another pass: ${brief.riskCategories.join(", ")}.` : "This is a fresh specialist discovery pass. The host found no keyword-classified category, so independently scrutinize authentication/authorization, security boundaries, durability, concurrency, credentials, and external side effects rather than treating classification silence as low risk." : "This is the general discovery pass. Review broadly for correctness, security, concurrency, resource, API, and error-handling defects.";
+	const adjudicated = brief.adjudicatedContext ?? [];
+	const priorFindings = brief.priorFindingContext ?? [];
+	return [
+		...common,
+		focus,
+		...adjudicated.length === 0 ? [] : ["A maintainer has adjudicated these previously raised items on this unit (disposition, reason). Do not re-raise them unless you have materially new evidence, and if you do, say explicitly what changed since the adjudication:", ...adjudicated.map((line) => `- ${line}`)],
+		...priorFindings.length === 0 ? [] : ["A previous review round raised these findings on this unit's paths. For each, either confirm it still holds, state that it is fixed, or withdraw it; do not demand the opposite of that prior guidance without explicitly acknowledging the reversal:", ...priorFindings.map((line) => `- ${line}`)],
+		"The discovery evidence array contains every complete shard in the unit. Review every entry and every shard of a multi-shard path. A later independent verifier, not you, decides which candidates publish.",
+		"Every non-anchored concern must list 1-3 exact evidencePaths to bind the claim to scheduled evidence. Report one root concern once; never split it into differently worded restatements.",
+		`Return ONLY JSON with phase "discovery", the exact workId/unitId, up to 6 findings, up to 3 concerns shaped as {concern, evidencePaths}, one factual file summary per path (<= 240 chars), and an empty assessments array. Empty candidate arrays are valid; do not invent defects.`,
+		"Each finding is {\"path\": <a unit file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL problem-kind label>, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement source code for exactly lines startLine..endLine, ready to commit>}.",
+		"Include \"suggestion\" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement source for every line in the range and nothing else — never prose describing the change, which belongs in \"body\"."
+	].join("\n");
+};
+const fileReviewerInstructions = makeFileReviewerInstructions();
+const FileReviewToolkit = Toolkit.empty;
+const defaultFileReviewerPolicy = AgentPolicy.make({
+	maxTurns: 6,
+	maxToolCalls: 1,
+	maxDuration: "6 minutes",
+	toolConcurrency: 2,
+	repeatedFailureLimit: 6,
+	tokenBudget: 2e5,
+	contextTokenLimit: 15e4,
+	toolResultBounds: ToolResultBounds.make({ maxBytes: REVIEW_TOOL_RESULT_MAX_BYTES }),
+	onExhaustion: "fail"
 });
-const fromStoredConcern = (concern) => ReviewConcern.make({
-	severity: concern.severity,
-	title: concern.title,
-	body: concern.body
+const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
+	input: FileReviewBrief,
+	output: FileReviewReport,
+	instructions: makeFileReviewerInstructions(options),
+	toolkit: FileReviewToolkit,
+	policy: defaultFileReviewerPolicy,
+	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
+	metadata: {
+		deploymentClass: "E",
+		surface: "read-only",
+		stage: "discovery-verification"
+	}
 });
-const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v2:";
-const STATE_MARKER_SUFFIX = " -->";
-const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v2:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
-const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v2\0";
-const MAX_REVIEW_STATE_MARKER_CHARS = 24e3;
-const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v2:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
-var ReviewStateAuthenticationFailure = class extends Schema.TaggedError()("ReviewStateAuthenticationFailure", {
-	operation: Schema.Literals(["sign", "verify"]),
-	reason: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
-}) {};
-var ReviewStateMarkerTooLarge = class extends Schema.TaggedError()("ReviewStateMarkerTooLarge", {
-	observedChars: Schema.Int.check(Schema.isGreaterThan(0)),
-	maximumChars: Schema.Int.check(Schema.isGreaterThan(0))
-}) {};
-var ReviewStateAuthenticator = class extends Context.Service()("@effect-agent/pr-review/ReviewStateAuthenticator") {};
-const authenticationFailure = (operation, cause) => ReviewStateAuthenticationFailure.make({
-	operation,
-	reason: String(cause).slice(0, 2048)
+const FileReviewer = makeFileReviewerDefinition();
+const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
+/** Rebuild one unit's complete evidence from the same snapshot the plan used. */
+const unitEvidence = (unit, files) => Effect.gen(function* () {
+	const byPath = new Map(files.map((file) => [file.path, file]));
+	const evidence = [];
+	for (const shard of unit.evidenceShards) {
+		const file = byPath.get(shard.path);
+		const chunk = file === void 0 ? void 0 : fileReviewEvidenceChunks(file)[shard.ordinal - 1];
+		if (file === void 0 || chunk === void 0) return yield* Effect.die(/* @__PURE__ */ new Error(`planned evidence shard has no source: ${shard.shardId} (${shard.path})`));
+		evidence.push(FileReviewEvidence.make({
+			shardId: shard.shardId,
+			path: shard.path,
+			status: file.status,
+			reviewMode: chunk.reviewMode,
+			ordinal: shard.ordinal,
+			total: shard.total,
+			annotatedPatch: chunk.annotatedPatch
+		}));
+	}
+	return evidence;
 });
-const hmacKey = (secret, operation) => Effect.tryPromise({
-	try: () => globalThis.crypto.subtle.importKey("raw", new TextEncoder().encode(Redacted.value(secret)), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign", "verify"]),
-	catch: (cause) => authenticationFailure(operation, cause)
+const misbehaved = (workId, reason) => ReviewPassMisbehaved.make({
+	workId,
+	reason: reason.slice(0, 600)
 });
-const signatureBytes = (signature) => {
-	const pairs = signature.match(/../g) ?? [];
-	const buffer = new ArrayBuffer(pairs.length);
-	const bytes = new Uint8Array(buffer);
-	for (let index = 0; index < pairs.length; index += 1) bytes[index] = Number.parseInt(pairs[index] ?? "", 16);
-	return buffer;
-};
-/** Validated WebCrypto adapter selected at the Action composition root. */
-const webCryptoReviewStateAuthenticatorLayer = (secret) => Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
-	status: "available",
-	unavailableReason: void 0,
-	render: (state) => Effect.gen(function* () {
-		const json = yield* Schema.encodeUnknownEffect(Schema.fromJsonString(ReviewState))(state).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
-		const payload = Encoding.encodeBase64(json);
-		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
-		const key = yield* hmacKey(secret, "sign");
-		const signature = yield* Effect.tryPromise({
-			try: () => globalThis.crypto.subtle.sign("HMAC", key, message),
-			catch: (cause) => authenticationFailure("sign", cause)
-		});
-		const hex = Array.from(new Uint8Array(signature)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-		const marker = `${STATE_MARKER_PREFIX}${payload}.${hex}${STATE_MARKER_SUFFIX}`;
-		if (marker.length > 24e3) return yield* ReviewStateMarkerTooLarge.make({
-			observedChars: marker.length,
-			maximumChars: MAX_REVIEW_STATE_MARKER_CHARS
-		});
-		return yield* Schema.decodeUnknownEffect(ReviewStateMarker)(marker).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
-	}),
-	extract: (body) => {
-		if (body.length > 6e4) return Effect.succeed(Option.none());
-		const match = STATE_MARKER_PATTERN.exec(body);
-		const payload = match?.[1];
-		const signature = match?.[2];
-		if (payload === void 0 || signature === void 0) return Effect.succeed(Option.none());
-		const marker = `${STATE_MARKER_PREFIX}${payload}.${signature}${STATE_MARKER_SUFFIX}`;
-		if (!Schema.is(ReviewStateMarker)(marker)) return Effect.succeed(Option.none());
-		const json = Result.getOrUndefined(Encoding.decodeBase64String(payload));
-		if (json === void 0) return Effect.succeed(Option.none());
-		const decoded = Schema.decodeUnknownOption(Schema.fromJsonString(ReviewState))(json);
-		if (Option.isNone(decoded)) return Effect.succeed(Option.none());
-		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
-		return Effect.gen(function* () {
-			const key = yield* hmacKey(secret, "verify");
-			return (yield* Effect.tryPromise({
-				try: () => globalThis.crypto.subtle.verify("HMAC", key, signatureBytes(signature), message),
-				catch: (cause) => authenticationFailure("verify", cause)
-			})) ? Option.some(decoded.value) : Option.none();
-		});
+/** Validate that a verification report assesses exactly the scheduled candidates. */
+const validateVerificationReport = (brief, report) => {
+	if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return misbehaved(brief.workId, "verification output contained discovery-only fields");
+	const expectedById = new Map(brief.candidates.map((candidate) => [candidate.candidateId, candidate]));
+	const assessedIds = /* @__PURE__ */ new Set();
+	for (const assessment of report.assessments) {
+		const candidate = expectedById.get(assessment.candidateId);
+		if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+		if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return misbehaved(brief.workId, "verification output did not settle suggestion publication exactly");
+		assessedIds.add(assessment.candidateId);
 	}
-}));
-/** Explicit no-state implementation for hosts without a stable authentication secret. */
-const unavailableReviewStateAuthenticatorLayer = (reason) => {
-	const safeReason = reason === "" ? "review-state authentication is unavailable" : reason;
-	return Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
-		status: "unavailable",
-		unavailableReason: safeReason.slice(0, 1e3),
-		render: () => Effect.fail(ReviewStateAuthenticationFailure.make({
-			operation: "sign",
-			reason: safeReason.slice(0, 2048)
-		})),
-		extract: () => Effect.succeed(Option.none())
-	}));
+	if (assessedIds.size !== expectedById.size) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
 };
-/** The bounded result of GitHub's previous-head...current-head comparison. */
-var ReviewHeadComparison = class extends Schema.Class("@effect-agent/pr-review/ReviewHeadComparison")({
-	status: Schema.Literals([
-		"ahead",
-		"behind",
-		"diverged",
-		"identical"
-	]),
-	baseSha: GitCommitSha,
-	headSha: GitCommitSha,
-	mergeBaseSha: GitCommitSha,
-	files: Schema.Array(ChangedFile).check(Schema.isMaxLength(300)),
-	/** GitHub caps compare-file payloads at 300; equality is conservatively truncated. */
-	truncated: Schema.Boolean
-}) {};
-const fullSelection = (input) => ({
-	mode: "full",
-	reason: input.reason,
-	files: input.files,
-	affectedPaths: input.files.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]),
-	totalFiles: input.totalFiles,
-	baselineSha: void 0,
-	priorState: void 0,
-	profileFingerprint: input.profileFingerprint
-});
 /**
-* Validate that persisted state belongs to this exact PR/base lineage and the
-* same review profile. A mismatch is a full-review reason, never an error that
-* silently suppresses review work.
+* Run one scheduled pass: execute the child, decode its report, and enforce
+* the pass contract. Any typed fault — child failure, malformed or misdirected
+* output — is retried once; budget exhaustion is terminal because a retry
+* would fail the same way. The settled outcome is a value either way, so one
+* flaky pass can never fail the whole pipeline.
 */
-const validateReviewState = (state, current, profileFingerprint) => {
-	if (state.repository !== current.repository || state.pullRequestNumber !== current.number) return "stored state belongs to a different pull request";
-	if (current.baseSha === void 0) return "the current base commit is unavailable";
-	if (state.baseRef !== current.baseRef) return "the pull request base ref changed";
-	if (state.headRef !== current.headRef) return "the pull request head ref changed";
-	if (state.profileFingerprint !== profileFingerprint) return "the reviewer profile or model configuration changed";
-};
-/** Pure, deterministic range selection with conservative full-review fallbacks. */
-const selectReviewRange = (input) => {
-	const full = (reason) => fullSelection({
-		reason,
-		files: input.fullFiles,
-		totalFiles: input.current.totalChangedFiles,
-		profileFingerprint: input.profileFingerprint
+const runReviewPass = (binding, brief, budget) => Effect.gen(function* () {
+	const result = yield* AgentRuntime.run(binding, brief, {
+		...budget === void 0 ? {} : { budget },
+		estimateCostMicrousd: () => Effect.succeed(500)
 	});
-	if (input.requestedMode === "final") return full("explicit final full-diff audit requested");
-	if (input.lookupFailure !== void 0) return full(`stored review state could not be recovered: ${input.lookupFailure}`);
-	if (input.priorState === void 0) return full("no compatible stored review state was found");
-	const invalid = validateReviewState(input.priorState, input.current, input.profileFingerprint);
-	if (invalid !== void 0) return full(invalid);
-	const comparison = input.comparison;
-	if (comparison === void 0) return full("the incremental head comparison was unavailable");
-	if (comparison.baseSha !== input.priorState.reviewedHeadSha || comparison.headSha !== input.current.headSha || comparison.mergeBaseSha !== input.priorState.reviewedHeadSha || comparison.status !== "ahead" && comparison.status !== "identical") return full("the prior reviewed head is not an ancestor of the current head");
-	if (comparison.truncated) return full("the incremental comparison exceeded GitHub's file bound");
-	const affectedPaths = new Set(comparison.files.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]));
-	let baseReason = "";
-	if (input.priorState.baseSha !== input.current.baseSha) {
-		const baseComparison = input.baseComparison;
-		if (baseComparison === void 0) return full("the pull request base changed and its lineage comparison was unavailable");
-		if (baseComparison.baseSha !== input.priorState.baseSha || baseComparison.headSha !== input.current.baseSha || baseComparison.mergeBaseSha !== input.priorState.baseSha || baseComparison.status !== "ahead" && baseComparison.status !== "identical" || baseComparison.truncated) return full("the pull request base changed materially or exceeded the comparison bound");
-		for (const file of baseComparison.files) {
-			affectedPaths.add(file.path);
-			if (file.previousPath !== void 0) affectedPaths.add(file.previousPath);
+	const report = yield* Schema.decodeUnknownEffect(FileReviewReport)(result.output).pipe(Effect.mapError((error) => misbehaved(brief.workId, `child report failed to decode: ${error.message}`)));
+	if (report.phase !== brief.phase || report.workId !== brief.workId || report.unitId !== brief.unitId) return yield* misbehaved(brief.workId, "child report identity does not match the scheduled pass");
+	if (brief.phase === "verification") {
+		const violation = validateVerificationReport(brief, report);
+		if (violation !== void 0) return yield* violation;
+	} else if (report.assessments.length > 0) return yield* misbehaved(brief.workId, "discovery output contained verification-only assessments");
+	return {
+		report,
+		turns: result.turns
+	};
+}).pipe(Effect.scoped, Effect.retry({
+	times: 1,
+	while: (error) => error._tag !== "BudgetExceeded"
+}), Effect.map((settled) => ({
+	_tag: "settled",
+	...settled
+})), Effect.catch((error) => Effect.succeed({
+	_tag: "failed",
+	errorTag: String(error._tag).slice(0, 256)
+})));
+/**
+* Keep only findings anchored inside the pass's exact assigned evidence and
+* concerns bound to unit paths. Everything else is discarded and counted —
+* an invalid anchor invalidates one claim, never the pass that produced it.
+*/
+const harvestDiscovery = (pass, unit, files, anchorFiles, report) => {
+	const allowed = new Set(pass.paths);
+	let discarded = 0;
+	const keptFindings = [];
+	for (const finding of report.findings) {
+		if (!allowed.has(finding.path) || anchorViolation(finding, anchorFiles) !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) {
+			discarded += 1;
+			continue;
 		}
-		baseReason = `; base advanced from ${input.priorState.baseSha.slice(0, 7)} and overlapping PR paths were included`;
+		keptFindings.push(finding);
 	}
-	const currentPaths = new Set(input.fullFiles.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]));
-	const selectedByPath = /* @__PURE__ */ new Map();
-	for (const file of comparison.files) if (currentPaths.has(file.path) || file.previousPath !== void 0 && currentPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
-	const carriedPaths = new Set(input.priorState.unreviewedPaths.filter((path) => currentPaths.has(path)));
-	for (const path of carriedPaths) affectedPaths.add(path);
-	const rescuePaths = input.priorState.baseSha !== input.current.baseSha;
-	if (rescuePaths || carriedPaths.size > 0) {
-		for (const file of input.fullFiles) if (rescuePaths && (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath)) || carriedPaths.has(file.path) || file.previousPath !== void 0 && carriedPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const keptConcerns = [];
+	for (const candidate of report.concerns) {
+		if (candidate.evidencePaths.some((path) => !allowed.has(path))) {
+			discarded += 1;
+			continue;
+		}
+		keptConcerns.push(candidate);
 	}
-	const selectedFiles = [...selectedByPath.values()].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
-	const carriedReason = carriedPaths.size === 0 ? "" : `; retrying ${carriedPaths.size} carried unreviewed path(s)`;
 	return {
-		mode: "incremental",
-		reason: `changes since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}${carriedReason}`,
-		files: selectedFiles,
-		affectedPaths: [...affectedPaths].sort(),
-		totalFiles: selectedFiles.length,
-		baselineSha: input.priorState.reviewedHeadSha,
-		priorState: input.priorState,
-		profileFingerprint: input.profileFingerprint
+		candidates: [...keptFindings.map((finding, index) => FindingCandidate.make({
+			candidateId: `${pass.passId}:finding:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
+			finding,
+			evidencePaths: [finding.path]
+		})), ...keptConcerns.map((candidate, index) => ConcernCandidate.make({
+			candidateId: `${pass.passId}:concern:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
+			concern: candidate.concern,
+			evidencePaths: candidate.evidencePaths
+		}))],
+		fileSummaries: report.fileSummaries.filter((entry) => allowed.has(entry.path)),
+		discarded
 	};
 };
-/** Per-run context consumed by orchestration and publication, not by the model. */
-var ReviewExecutionContext = class extends Context.Service()("@effect-agent/pr-review/ReviewExecutionContext") {};
-/**
-* Decorate the full source with the selected review range. Full anchor files
-* remain available to host-side publication validation; model tools see only
-* the selected delta and may read head context only for that delta's paths.
-*/
-const selectedPullRequestSourceLayer = (selection) => Layer.effect(PullRequestSource)(Effect.gen(function* () {
-	const source = yield* PullRequestSource;
-	const selectedPaths = new Set(selection.files.map((file) => file.path));
-	const selectedFiles = source.changedFiles.pipe(Effect.map((fullFiles) => {
-		const fullByPath = new Map(fullFiles.map((file) => [file.path, file]));
-		return selection.files.map((file) => {
-			if (file.patch !== void 0) return file;
-			const full = fullByPath.get(file.path);
-			return full === void 0 ? file : ChangedFile.make({
-				...file,
-				...full.reviewBaseContent === void 0 ? {} : { reviewBaseContent: full.reviewBaseContent },
-				...full.reviewHeadContent === void 0 ? {} : { reviewHeadContent: full.reviewHeadContent }
-			});
+const reviewUnit = (binding, unit, passes, input) => Effect.gen(function* () {
+	const evidence = yield* unitEvidence(unit, input.files);
+	const failedPasses = [];
+	const candidates = [];
+	const subjects = /* @__PURE__ */ new Set();
+	const walkthrough = [];
+	let discardedFindings = 0;
+	let turns = 0;
+	let completedGeneralPasses = 0;
+	let completedSpecialistPasses = 0;
+	const unitPaths = new Set(unit.paths);
+	const adjudicatedContext = (input.priorContext?.adjudicated ?? []).filter((entry) => entry.path === void 0 || unitPaths.has(entry.path)).map((entry) => entry.line).slice(0, 20);
+	const priorFindingContext = (input.priorContext?.priorFindings ?? []).filter((entry) => unitPaths.has(entry.path)).map((entry) => entry.line).slice(0, 20);
+	for (const pass of passes) {
+		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
+		const brief = FileReviewBrief.make({
+			phase: "discovery",
+			workId: pass.passId,
+			unitId: pass.unitId,
+			paths: pass.paths,
+			evidenceShardIds: pass.evidenceShardIds,
+			perspective: pass.perspective,
+			riskCategories: pass.riskCategories,
+			candidates: [],
+			evidence,
+			...adjudicatedContext.length === 0 ? {} : { adjudicatedContext },
+			...priorFindingContext.length === 0 ? {} : { priorFindingContext }
 		});
-	}));
-	return PullRequestSource.of({
-		metadata: source.metadata,
-		changedFiles: selectedFiles,
-		anchorFiles: source.anchorFiles,
-		readFile: (path) => selectedPaths.has(path) ? source.readFile(path) : Effect.fail(ReviewInputViolation.make({
-			input: path,
-			reason: "Path is outside this incremental review range."
-		}))
-	});
-}));
-/** Profile fingerprints are SHA-256 over configuration-only signatures. */
-const computeProfileFingerprint = (signature) => Effect.promise(async () => {
-	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(signature));
-	return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-/** Build the full-surface mission used only to resolve profile guidance. */
-const buildProfileMission = (metadata, files) => ReviewMission.make({
-	repository: metadata.repository,
-	number: metadata.number,
-	title: metadata.title,
-	body: metadata.body,
-	baseRef: metadata.baseRef,
-	headRef: metadata.headRef,
-	changedFileCount: files.length
-});
-//#endregion
-//#region src/internal/retirement.ts
-const PositiveLine = Schema.Int.check(Schema.isGreaterThan(0));
-/** One previously posted review as observed through the retirement host. */
-var RetirableReview = class extends Schema.Class("@effect-agent/pr-review/RetirableReview")({
-	reviewId: Schema.Int.check(Schema.isGreaterThan(0)),
-	body: Schema.String.check(Schema.isMaxLength(6e4)),
-	commitSha: Schema.NonEmptyString.check(Schema.isMaxLength(64)),
-	authorNodeId: Schema.NullOr(Schema.NonEmptyString.check(Schema.isMaxLength(200))),
-	submittedAt: Schema.NullOr(Schema.DateTimeUtc)
-}) {};
-/** One inline comment attached to a previously posted review. */
-var RetirableReviewComment = class extends Schema.Class("@effect-agent/pr-review/RetirableReviewComment")({
-	nodeId: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
-	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
-	startLine: Schema.NullOr(PositiveLine),
-	endLine: Schema.NullOr(PositiveLine),
-	body: Schema.String.check(Schema.isMaxLength(65536))
-}) {};
-/** A GitHub retirement read or mutation failed. */
-var ReviewRetirementFailure = class extends Schema.TaggedError()("ReviewRetirementFailure", {
-	operation: Schema.String,
-	reason: Schema.String
-}) {
-	get message() {
-		return `Review retirement operation '${this.operation}' failed: ${this.reason}`;
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			failedPasses.push(FailedReviewPass.make({
+				workId: pass.passId,
+				stage,
+				errorTag: outcome.errorTag
+			}));
+			continue;
+		}
+		turns += outcome.turns;
+		if (stage === "specialist") completedSpecialistPasses += 1;
+		else completedGeneralPasses += 1;
+		const harvest = harvestDiscovery(pass, unit, input.files, input.anchorFiles, outcome.report);
+		discardedFindings += harvest.discarded;
+		if (pass.perspective === "general") walkthrough.push(...harvest.fileSummaries);
+		for (const candidate of harvest.candidates) {
+			const subject = reviewCandidateSubjectKey(candidate);
+			if (subjects.has(subject)) continue;
+			subjects.add(subject);
+			candidates.push(candidate);
+		}
 	}
-};
-/**
-* Host-side GitHub operations used by retirement. Domain code never reaches
-* into REST or GraphQL directly, and deterministic tests substitute this port.
-*/
-var ReviewRetirementHost = class extends Context.Service()("@effect-agent/pr-review/ReviewRetirementHost") {};
-/** Observable cosmetic work completed by one fail-open retirement pass. */
-var ReviewRetirementReport = class extends Schema.Class("@effect-agent/pr-review/ReviewRetirementReport")({
-	reviewsRetired: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	findingsResolved: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	commentsMinimized: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	failures: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
-}) {};
-const findingIdentity = (finding) => `${finding.path}\u0000${finding.startLine}\u0000${finding.endLine}\u0000${finding.title}`;
-const REVIEW_METADATA_PATTERN = /<!-- effect-agent-pr-review metadata\n[\s\S]*?\n-->/g;
-const FINGERPRINT_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:[0-9a-f]{64} -->/g;
-const STATE_PATTERN = /<!-- effect-agent-pr-review state-v\d+:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
-const RETIRED_ORIGINAL_PATTERN = /<!-- effect-agent-pr-review retired-original:start -->\n([\s\S]*?)\n<!-- effect-agent-pr-review retired-original:end -->/;
-const MACHINE_COMMENT_PATTERN = new RegExp(`${REVIEW_METADATA_PATTERN.source}|${FINGERPRINT_PATTERN.source}|${STATE_PATTERN.source}`, "g");
-const VERDICT_CALLOUT_PATTERN = /^(?:> \[!(?:CAUTION|IMPORTANT)\]\n> [^\n]*(?:\n> [^\n]*)*|> (?:ℹ️|✅)[^\n]*)\n*/;
-const INLINE_FINDING_TITLE_PATTERN = /^\*\*\[(?:🛑 blocking|⚠️ important|💅 nit)(?: · [a-z-]+)?\] ([^\n]+)\*\*$/;
-const MAX_REVIEW_BODY_CHARS = 6e4;
-/** The host-authored metadata marker is the authority gate for any edit. */
-const hasReviewMetadataMarker = (body) => /<!-- effect-agent-pr-review metadata\n/.test(body);
-const machineComments = (body) => Array.from(body.matchAll(MACHINE_COMMENT_PATTERN), (match) => match[0]);
-const originalVisibleBody = (body) => {
-	const retired = RETIRED_ORIGINAL_PATTERN.exec(body)?.[1];
-	if (retired !== void 0) return retired;
-	return body.replace(MACHINE_COMMENT_PATTERN, "").trim().replace(VERDICT_CALLOUT_PATTERN, "");
-};
-const findingLocation = (finding) => `${finding.path}:${finding.startLine}${finding.endLine === finding.startLine ? "" : `-${finding.endLine}`}`;
-const renderRetiredBody = (input) => {
-	const shortSha = input.currentState.reviewedHeadSha.slice(0, 7);
-	const comments = machineComments(input.priorBody);
-	const original = originalVisibleBody(input.priorBody);
-	const resolved = input.resolvedFindings.length === 0 ? [] : [
-		"### Findings resolved by later review",
-		"",
-		...input.resolvedFindings.map((finding) => `- \`${findingLocation(finding)}\` ~~${finding.title}~~ · resolved at \`${shortSha}\``),
-		""
-	];
-	const prefix = [
-		`> ℹ️ Superseded — ${input.resolvedFindings.length} of ${input.priorState.unresolvedFindings.length} findings resolved at \`${shortSha}\`; see [the latest review](${input.currentReviewUrl}).`,
-		"",
-		"<details>",
-		"<summary>Previous review details</summary>",
-		"",
-		...resolved,
-		"<!-- effect-agent-pr-review retired-original:start -->"
-	];
-	const suffix = [
-		"<!-- effect-agent-pr-review retired-original:end -->",
-		"",
-		"</details>",
-		...comments.length === 0 ? [] : ["", ...comments]
-	];
-	const render = (visible) => [
-		...prefix,
-		visible,
-		...suffix
-	].join("\n");
-	if (render(original).length <= MAX_REVIEW_BODY_CHARS) return render(original);
-	const truncationNotice = "\n\n_Original review content truncated during retirement._";
-	const budget = Math.max(0, MAX_REVIEW_BODY_CHARS - render(truncationNotice).length);
-	return render(`${original.slice(0, budget)}${truncationNotice}`);
-};
-/** Compute one prior review's resolved subset and deterministic retired body. */
-const decideReviewRetirement = (input) => {
-	const current = new Set(input.currentState.unresolvedFindings.map(findingIdentity));
-	const resolvedFindings = input.priorState.unresolvedFindings.filter((finding) => !current.has(findingIdentity(finding)));
-	return {
-		body: renderRetiredBody({
-			...input,
-			resolvedFindings
-		}),
-		resolvedFindings,
-		priorFindingCount: input.priorState.unresolvedFindings.length
+	const confirmed = [];
+	let rejectedCandidates = 0;
+	let unsettledCandidates = 0;
+	let completedVerificationPasses = 0;
+	const requiredVerificationPasses = candidates.length > 0 ? 1 : 0;
+	if (candidates.length > 0) {
+		const workId = `${unit.unitId}-verification`;
+		const brief = FileReviewBrief.make({
+			phase: "verification",
+			workId,
+			unitId: unit.unitId,
+			paths: unit.paths,
+			evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+			perspective: "candidate-verification",
+			riskCategories: unit.riskCategories,
+			candidates,
+			evidence
+		});
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			unsettledCandidates = candidates.length;
+			failedPasses.push(FailedReviewPass.make({
+				workId,
+				stage: "verification",
+				errorTag: outcome.errorTag
+			}));
+		} else {
+			turns += outcome.turns;
+			completedVerificationPasses = 1;
+			const byId = new Map(candidates.map((candidate) => [candidate.candidateId, candidate]));
+			for (const assessment of outcome.report.assessments) {
+				const candidate = byId.get(assessment.candidateId);
+				if (candidate === void 0) continue;
+				if (assessment.disposition === "confirmed") confirmed.push({
+					assessment,
+					candidate
+				});
+				else rejectedCandidates += 1;
+			}
+		}
+	}
+	return {
+		failedPasses,
+		discoveredCandidates: candidates.length,
+		confirmed,
+		rejectedCandidates,
+		unsettledCandidates,
+		discardedFindings,
+		walkthrough,
+		turns,
+		completedGeneralPasses,
+		completedSpecialistPasses,
+		requiredVerificationPasses,
+		completedVerificationPasses,
+		unreviewedPaths: failedPasses.length > 0 ? unit.paths : [],
+		unreviewedPasses: failedPasses.map((pass) => ({
+			stage: pass.stage,
+			paths: unit.paths
+		}))
 	};
+});
+const countNoun = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+const composeSummary = (plan, assurance) => {
+	const requiredDiscovery = assurance.requiredGeneralDiscoveryPasses + assurance.requiredSpecialistPasses;
+	const completedDiscovery = assurance.completedGeneralDiscoveryPasses + assurance.completedSpecialistPasses;
+	const parts = [`Reviewed ${countNoun(plan.totalFiles, "changed file")} across ${countNoun(plan.units.length, "bounded unit")}: ${completedDiscovery}/${requiredDiscovery} discovery and ${assurance.completedVerificationPasses}/${assurance.requiredVerificationPasses} verification pass(es) settled; ${assurance.confirmedCandidates} of ${countNoun(assurance.discoveredCandidates, "discovered candidate")} confirmed by independent verification.`];
+	if (assurance.failedPasses.length > 0) parts.push(`${countNoun(assurance.failedPasses.length, "pass")} did not settle; the affected paths are carried forward and retried on the next run. This is a reviewer-side gap, not a code defect.`);
+	if (assurance.discardedInvalidFindings > 0) parts.push(`${countNoun(assurance.discardedInvalidFindings, "candidate")} discarded for anchors or paths outside the assigned evidence.`);
+	if (plan.undiffablePaths.length > 0) parts.push(`${countNoun(plan.undiffablePaths.length, "path")} had no reviewable textual evidence and keep input coverage incomplete; exclude such paths with ignore globs when that is intended.`);
+	if (plan.unassignedPaths.length > 0 || plan.unassignedEvidenceShardCount > 0) parts.push("The changeset exceeded the bounded fan-out capacity; unassigned scope is reported under input coverage.");
+	parts.push("No configured pipeline can prove absence of defects; this describes settled work only.");
+	return parts.join(" ").slice(0, 4e3);
 };
-const inlineCommentIdentity = (comment) => {
-	if (comment.startLine === null || comment.endLine === null) return void 0;
-	const firstLine = comment.body.split("\n", 1)[0] ?? "";
-	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine)?.[1];
-	return title === void 0 ? void 0 : findingIdentity({
-		path: comment.path,
-		startLine: comment.startLine,
-		endLine: comment.endLine,
-		title
+const remapPlanUnitIds = (plan, offset) => {
+	if (offset === 0) return plan;
+	const units = plan.units.map((unit, index) => ReviewUnit.make({
+		...unit,
+		unitId: `unit-${String(offset + index + 1).padStart(3, "0")}`
+	}));
+	const mappedIds = /* @__PURE__ */ new Map();
+	for (const [index, unit] of plan.units.entries()) {
+		const remapped = units[index];
+		if (remapped !== void 0) mappedIds.set(unit.unitId, remapped.unitId);
+	}
+	return ReviewUnitPlan.make({
+		...plan,
+		units,
+		discoveryPasses: plan.discoveryPasses.map((pass) => {
+			const unitId = mappedIds.get(pass.unitId) ?? pass.unitId;
+			return ReviewDiscoveryPass.make({
+				...pass,
+				unitId,
+				passId: `${unitId}${pass.passId.slice(pass.unitId.length)}`
+			});
+		})
 	});
 };
-const failOpen = (effect, fallback, message) => effect.pipe(Effect.catch((error) => Effect.logWarning(`${message}: ${String(error)}`).pipe(Effect.as(fallback))));
-const isStrictlyOlderReview = (review, input) => {
-	if (review.submittedAt === null) return false;
-	const submittedAt = DateTime.toEpochMillis(review.submittedAt);
-	const currentSubmittedAt = DateTime.toEpochMillis(input.currentSubmittedAt);
-	return submittedAt < currentSubmittedAt || submittedAt === currentSubmittedAt && review.reviewId < input.currentReviewId;
-};
-/**
-* Retire every marker-bearing prior review against the newest posted state.
-* Every lookup, edit, and minimization is isolated: retirement is cosmetic
-* and can never change the run or check outcome.
-*/
-const retireStaleReviews = Effect.fn("retireStaleReviews")(function* (input) {
-	const host = yield* ReviewRetirementHost;
-	const authenticator = yield* ReviewStateAuthenticator;
-	if (authenticator.status !== "available") {
-		yield* Effect.logWarning("Skipping stale-review retirement because authenticated review state is unavailable.");
-		return ReviewRetirementReport.make({
-			reviewsRetired: 0,
-			findingsResolved: 0,
-			commentsMinimized: 0,
-			failures: 0
-		});
+const scheduleFanOutWork = (input) => {
+	const retryPathSet = new Set(input.retry?.paths ?? []);
+	const retryStages = new Set(input.retry?.stages ?? []);
+	if (retryPathSet.size === 0) {
+		const plan = planReviewUnits(input.files, { totalChangedFiles: input.totalChangedFiles });
+		const passesByUnit = /* @__PURE__ */ new Map();
+		for (const pass of plan.discoveryPasses) {
+			const passes = passesByUnit.get(pass.unitId) ?? [];
+			passes.push(pass);
+			passesByUnit.set(pass.unitId, passes);
+		}
+		return {
+			plan,
+			passesByUnit,
+			overflowRetryPaths: []
+		};
 	}
-	let failures = 0;
-	let reviewsRetired = 0;
-	let findingsResolved = 0;
-	let commentsMinimized = 0;
-	const reviews = yield* failOpen(host.listReviews, void 0, "Could not list prior reviews");
-	if (reviews === void 0) return ReviewRetirementReport.make({
-		reviewsRetired,
-		findingsResolved,
-		commentsMinimized,
-		failures: 1
+	const freshFiles = input.files.filter((file) => !retryPathSet.has(file.path));
+	const retryFiles = input.files.filter((file) => retryPathSet.has(file.path));
+	const freshPlan = planReviewUnits(freshFiles, { totalChangedFiles: input.totalChangedFiles });
+	const retryPlan = remapPlanUnitIds(planReviewUnits(retryFiles, { totalChangedFiles: input.totalChangedFiles }), freshPlan.units.length);
+	const acceptedFresh = freshPlan.units.slice(0, 8);
+	const acceptedRetry = retryPlan.units.slice(0, Math.max(0, 8 - acceptedFresh.length));
+	const overflowRetryPaths = retryPlan.units.slice(acceptedRetry.length).flatMap((unit) => [...unit.paths]);
+	const retryPassFilter = (pass) => {
+		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
+		return retryStages.has(stage);
+	};
+	const acceptedRetryIds = new Set(acceptedRetry.map((unit) => unit.unitId));
+	let retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId) && retryPassFilter(pass));
+	if (retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId));
+	const acceptedFreshIds = new Set(acceptedFresh.map((unit) => unit.unitId));
+	const discoveryPasses = [...freshPlan.discoveryPasses.filter((pass) => acceptedFreshIds.has(pass.unitId)), ...retryPasses];
+	const plan = ReviewUnitPlan.make({
+		totalFiles: input.files.length,
+		truncated: freshPlan.truncated || retryPlan.truncated,
+		units: [...acceptedFresh, ...acceptedRetry],
+		discoveryPasses,
+		undiffablePaths: [.../* @__PURE__ */ new Set([...freshPlan.undiffablePaths, ...retryPlan.undiffablePaths])].sort(),
+		partialEvidencePaths: [.../* @__PURE__ */ new Set([...freshPlan.partialEvidencePaths, ...retryPlan.partialEvidencePaths])].sort(),
+		unassignedEvidenceShardCount: freshPlan.unassignedEvidenceShardCount + retryPlan.unassignedEvidenceShardCount,
+		unassignedEvidenceShardIds: [...freshPlan.unassignedEvidenceShardIds, ...retryPlan.unassignedEvidenceShardIds].slice(0, 96),
+		unassignedPaths: [.../* @__PURE__ */ new Set([
+			...freshPlan.unassignedPaths,
+			...retryPlan.unassignedPaths,
+			...overflowRetryPaths
+		])].sort()
 	});
-	for (const review of reviews) {
-		if (review.authorNodeId !== input.currentAuthorNodeId || !isStrictlyOlderReview(review, input) || !hasReviewMetadataMarker(review.body)) continue;
-		const priorState = yield* failOpen(authenticator.extract(review.body), Option.none(), `Could not authenticate prior review ${review.reviewId}`);
-		if (Option.isNone(priorState)) continue;
-		const decision = decideReviewRetirement({
-			priorBody: review.body,
-			priorState: priorState.value,
-			currentState: input.currentState,
-			currentReviewUrl: input.currentReviewUrl
-		});
-		if (yield* failOpen(host.updateBody(review.reviewId, decision.body).pipe(Effect.as(true)), false, `Could not retire prior review ${review.reviewId}`)) {
-			reviewsRetired += 1;
-			findingsResolved += decision.resolvedFindings.length;
-		} else failures += 1;
-		if (decision.resolvedFindings.length === 0) continue;
-		const comments = yield* failOpen(host.listComments(review.reviewId), void 0, `Could not list inline comments for prior review ${review.reviewId}`);
-		if (comments === void 0) {
-			failures += 1;
-			continue;
-		}
-		const resolved = new Set(decision.resolvedFindings.map(findingIdentity));
-		for (const comment of comments) {
-			const identity = inlineCommentIdentity(comment);
-			if (identity === void 0 || !resolved.has(identity)) continue;
-			if (yield* failOpen(host.minimizeComment(comment.nodeId).pipe(Effect.as(true)), false, `Could not minimize resolved inline comment ${comment.nodeId}`)) commentsMinimized += 1;
-			else failures += 1;
-		}
+	const passesByUnit = /* @__PURE__ */ new Map();
+	for (const pass of discoveryPasses) {
+		const passes = passesByUnit.get(pass.unitId) ?? [];
+		passes.push(pass);
+		passesByUnit.set(pass.unitId, passes);
 	}
-	return ReviewRetirementReport.make({
-		reviewsRetired,
-		findingsResolved,
-		commentsMinimized,
-		failures
+	return {
+		plan,
+		passesByUnit,
+		overflowRetryPaths
+	};
+};
+/**
+* Run the complete host-scheduled fan-out pipeline over one selected
+* changeset snapshot: plan, independent discovery, exact verification, and a
+* deterministic host-composed CodeReview from verifier-confirmed candidates
+* only. The verdict is derived from confirmed severities, never model prose.
+*/
+const runFanOutReview = (binding, input) => Effect.gen(function* () {
+	const { plan, passesByUnit, overflowRetryPaths } = scheduleFanOutWork(input);
+	const outcomes = yield* Effect.forEach(plan.units, (unit) => reviewUnit(binding, unit, passesByUnit.get(unit.unitId) ?? [], input), { concurrency: 4 });
+	const failedPasses = outcomes.flatMap((outcome) => outcome.failedPasses);
+	const unsettledCandidates = outcomes.reduce((total, outcome) => total + outcome.unsettledCandidates, 0);
+	const reasons = [];
+	if (failedPasses.length > 0) reasons.push(boundedListReason("configured review passes did not settle", failedPasses.map((pass) => `${pass.workId} (${pass.errorTag})`)));
+	if (unsettledCandidates > 0) reasons.push(`${unsettledCandidates} discovered candidate(s) did not receive exact verification`);
+	const requiredSpecialistPasses = plan.discoveryPasses.filter((pass) => pass.perspective === "risk-specialist").length;
+	const confirmed = outcomes.flatMap((outcome) => outcome.confirmed);
+	const assurance = ReviewAssurance.make({
+		status: reasons.length === 0 ? "settled" : "incomplete",
+		requiredGeneralDiscoveryPasses: plan.discoveryPasses.length - requiredSpecialistPasses,
+		completedGeneralDiscoveryPasses: outcomes.reduce((total, outcome) => total + outcome.completedGeneralPasses, 0),
+		requiredSpecialistPasses,
+		completedSpecialistPasses: outcomes.reduce((total, outcome) => total + outcome.completedSpecialistPasses, 0),
+		requiredVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.requiredVerificationPasses, 0),
+		completedVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.completedVerificationPasses, 0),
+		discoveredCandidates: outcomes.reduce((total, outcome) => total + outcome.discoveredCandidates, 0),
+		confirmedCandidates: confirmed.length,
+		rejectedCandidates: outcomes.reduce((total, outcome) => total + outcome.rejectedCandidates, 0),
+		unsettledCandidates,
+		discardedInvalidFindings: outcomes.reduce((total, outcome) => total + outcome.discardedFindings, 0),
+		failedPasses,
+		reasons
 	});
+	const findings = rankAndDedupeFindings(confirmed.flatMap(({ assessment, candidate }) => candidate._tag === "FindingCandidate" ? [confirmedFindingForPublication(assessment, candidate)] : []));
+	const concerns = rankAndDedupeConcerns(confirmed.flatMap(({ candidate }) => candidate._tag === "ConcernCandidate" ? [ReviewConcern.make({
+		...candidate.concern,
+		evidencePaths: [...new Set(candidate.evidencePaths)].sort()
+	})] : []));
+	const walkthrough = outcomes.flatMap((outcome) => outcome.walkthrough);
+	const blocking = findings.some((finding) => finding.severity === "blocking") || concerns.some((concern) => concern.severity === "blocking");
+	return {
+		review: CodeReview.make({
+			summary: composeSummary(plan, assurance),
+			verdict: blocking ? "request-changes" : findings.length > 0 || concerns.length > 0 ? "comment" : "approve",
+			findings,
+			...concerns.length === 0 ? {} : { concerns },
+			...walkthrough.length === 0 ? {} : { walkthrough }
+		}),
+		assurance,
+		plan,
+		unreviewedPaths: [.../* @__PURE__ */ new Set([
+			...outcomes.flatMap((outcome) => outcome.unreviewedPaths),
+			...plan.unassignedPaths,
+			...plan.partialEvidencePaths,
+			...plan.undiffablePaths
+		])].sort(),
+		unreviewedPasses: [...outcomes.flatMap((outcome) => outcome.unreviewedPasses), ...overflowRetryPaths.length === 0 ? [] : (input.retry?.stages.length ? input.retry.stages : [
+			"discovery",
+			"specialist",
+			"verification"
+		]).map((stage) => ({
+			stage,
+			paths: overflowRetryPaths
+		}))],
+		turns: outcomes.reduce((total, outcome) => total + outcome.turns, 0)
+	};
+});
+//#endregion
+//#region src/internal/fingerprint.ts
+const MARKER_PREFIX = "<!-- effect-agent-pr-review fingerprint=sha256:";
+const MARKER_SUFFIX = " -->";
+const MARKER_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:([0-9a-f]{64}) -->/g;
+/** Render the invisible review-body marker for one fingerprint. */
+const renderFingerprintMarker = (fingerprint) => `${MARKER_PREFIX}${fingerprint}${MARKER_SUFFIX}`;
+/** The rendered marker length is fixed; publication reserves room for it. */
+const FINGERPRINT_MARKER_LENGTH = renderFingerprintMarker("0".repeat(64)).length;
+/** Extract the last fingerprint marker in one review body, if any. */
+const extractFingerprint = (body) => {
+	let last;
+	for (const match of body.matchAll(MARKER_PATTERN)) last = match[1];
+	return last;
+};
+/** SHA-256 via `Crypto.Crypto`; unavailable crypto is a defect, not an expected failure. */
+const sha256Hex = Effect.fn("sha256Hex")(function* (text) {
+	const digest = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(text)).pipe(Effect.orDie);
+	return Encoding.encodeHex(digest);
 });
+const FIELD = "\0";
+const RECORD = "
";
+const SECTION = "";
+/**
+* Unified-diff hunk coordinates describe where a patch applies, not what it
+* changes. A content-equivalent rebase can shift both coordinates while
+* leaving every context/addition/deletion line unchanged, so exclude only
+* those coordinates from the canonical patch representation.
+*/
+const canonicalPatch = (patch) => patch.replace(/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/gm, "@@ -_ +_ @@");
+/**
+* Canonical changeset encoding: sorted by path so provider ordering never
+* matters, with every review-relevant field of every file.
+*/
+const canonicalChangeset = (files) => files.map((file) => `${file.path}${FIELD}${file.status}${FIELD}${String(file.additions)}${FIELD}${String(file.deletions)}${FIELD}${file.patch === void 0 ? "" : canonicalPatch(file.patch)}${FIELD}${file.reviewBaseContent ?? ""}${FIELD}${file.reviewHeadContent ?? ""}`).sort().join(RECORD);
+/**
+* Fingerprint one review's complete input surface: the (already
+* ignore-filtered) changeset plus the caller's prompt signature — the
+* rendered instructions and any review-shaping options the instructions do
+* not carry.
+*/
+const computeChangesetFingerprint = (files, signature) => sha256Hex(`${canonicalChangeset(files)}${SECTION}${signature}`);
+/** Profile fingerprints are SHA-256 over configuration-only signatures. */
+const computeProfileFingerprint = (signature) => sha256Hex(signature);
 //#endregion
 //#region src/internal/github.ts
 const defaultGraphqlUrl = (apiUrl) => apiUrl === "https://api.github.com" ? "https://api.github.com/graphql" : apiUrl.replace(/\/api\/v3$/, "/api/graphql");
@@ -2250,8 +2754,8 @@ const GitHubReviewCommentWire = Schema.Struct({
 	node_id: Schema.String,
 	path: Schema.String,
 	body: Schema.String,
-	line: Schema.NullOr(Schema.Int),
-	original_line: Schema.NullOr(Schema.Int),
+	line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	original_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
 	start_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
 	original_start_line: Schema.optionalKey(Schema.NullOr(Schema.Int))
 });
@@ -2492,8 +2996,9 @@ const gitHubReviewRetirementHostLayer = Layer.effect(ReviewRetirementHost)(Effec
 			url: `${prefix}/reviews/${reviewId}/comments`,
 			decode: decodeRetirement(GitHubReviewCommentsPageWire, "listReviewCommentsForRetirement")
 		}).pipe(Effect.map((comments) => comments.map((comment) => {
-			const endLine = comment.line ?? comment.original_line;
-			const startLine = comment.start_line ?? comment.original_start_line ?? endLine;
+			const positiveLine = (value) => value !== void 0 && value !== null && value > 0 ? value : null;
+			const endLine = positiveLine(comment.line ?? comment.original_line);
+			const startLine = positiveLine(comment.start_line ?? comment.original_start_line) ?? endLine;
 			return RetirableReviewComment.make({
 				nodeId: comment.node_id,
 				path: comment.path,
@@ -2516,6 +3021,137 @@ const gitHubReviewRetirementHostLayer = Layer.effect(ReviewRetirementHost)(Effec
 		})
 	});
 }));
+const MAX_ADJUDICATION_PAGES = 5;
+const GitHubThreadCommentWire = Schema.Struct({
+	id: Schema.Int,
+	in_reply_to_id: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	path: Schema.String,
+	body: Schema.String,
+	author_association: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	user: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+	created_at: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	original_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	start_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	original_start_line: Schema.optionalKey(Schema.NullOr(Schema.Int))
+});
+const GitHubThreadCommentsPageWire = Schema.Array(GitHubThreadCommentWire);
+const GitHubIssueCommentWire = Schema.Struct({
+	body: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	author_association: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	user: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+	created_at: Schema.optionalKey(Schema.NullOr(Schema.String))
+});
+const GitHubIssueCommentsPageWire = Schema.Array(GitHubIssueCommentWire);
+const toAdjudicationComment = (wire, sourceOrder) => {
+	const login = wire.user?.login;
+	if (login === void 0 || login.length === 0) return void 0;
+	return AdjudicationComment.make({
+		body: (wire.body ?? "").slice(0, 65536),
+		authorAssociation: (wire.author_association ?? "NONE").slice(0, 40),
+		authorLogin: login.slice(0, 100),
+		createdAt: parseGitHubSubmittedAt(wire.created_at ?? null),
+		sourceOrder
+	});
+};
+/**
+* GitHub-backed host reads for maintainer adjudication, installed by
+* `gitHubReviewLayers` in `github-env.ts` at the public composition root: this action's own
+* inline finding threads (roots authored by the configured review author)
+* with their replies, and the pull request's top-level conversation comments.
+* Both listings are creation-ordered.
+*/
+const gitHubReviewAdjudicationHostLayer = Layer.effect(ReviewAdjudicationHost)(Effect.gen(function* () {
+	const target = yield* GitHubReviewTarget;
+	const client = yield* HttpClient.HttpClient;
+	const reviewAuthorLogin = (target.reviewAuthorLogin ?? "github-actions[bot]").toLowerCase();
+	const asAdjudicationFailure = (operation) => (error) => ReviewAdjudicationFailure.make({
+		operation,
+		reason: `${error._tag}: ${error.message ?? "request failed"}`.slice(0, 2048)
+	});
+	const decodeAdjudication = (schema, operation) => {
+		const decode = Schema.decodeUnknownEffect(schema);
+		return (response) => response.json.pipe(Effect.mapError(asAdjudicationFailure(operation)), Effect.flatMap((body) => decode(body).pipe(Effect.mapError(asAdjudicationFailure(operation)))));
+	};
+	const listPaged = (input) => Effect.gen(function* () {
+		const values = [];
+		const perPage = 100;
+		for (let page = 1; page <= MAX_ADJUDICATION_PAGES; page += 1) {
+			const response = yield* client.execute(withCommonHeaders(HttpClientRequest.get(input.url).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setUrlParams({
+				per_page: String(perPage),
+				page: String(page),
+				sort: "created",
+				direction: "asc"
+			})), target.token)).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.mapError(asAdjudicationFailure(input.operation)));
+			const pageValues = yield* input.decode(response);
+			values.push(...pageValues);
+			if (pageValues.length < perPage) return values;
+		}
+		return yield* ReviewAdjudicationFailure.make({
+			operation: input.operation,
+			reason: `history exceeds the bounded ${MAX_ADJUDICATION_PAGES * 100}-item lookup`
+		});
+	});
+	const listFindingThreads = Effect.gen(function* () {
+		const wires = yield* listPaged({
+			operation: "listReviewCommentsForAdjudication",
+			url: `${target.apiUrl}/repos/${target.repository}/pulls/${target.number}/comments`,
+			decode: decodeAdjudication(GitHubThreadCommentsPageWire, "listReviewCommentsForAdjudication")
+		});
+		const positiveLine = (value) => value !== void 0 && value !== null && value > 0 ? value : null;
+		const threads = /* @__PURE__ */ new Map();
+		for (const wire of wires) {
+			if (wire.in_reply_to_id !== void 0 && wire.in_reply_to_id !== null) continue;
+			if (wire.user?.login.toLowerCase() !== reviewAuthorLogin) continue;
+			threads.set(wire.id, {
+				root: wire,
+				replies: []
+			});
+		}
+		for (const [sourceOrder, wire] of wires.entries()) {
+			if (wire.in_reply_to_id === void 0 || wire.in_reply_to_id === null) continue;
+			const thread = threads.get(wire.in_reply_to_id);
+			if (thread === void 0) continue;
+			const reply = toAdjudicationComment(wire, sourceOrder);
+			if (reply === void 0) continue;
+			if (parseThreadAdjudication(reply.body) === void 0) continue;
+			if (!AUTHORIZED_ADJUDICATION_ASSOCIATIONS.has(reply.authorAssociation)) {
+				yield* Effect.logDebug(`Ignored inline adjudication command from @${reply.authorLogin} (${reply.authorAssociation}).`);
+				continue;
+			}
+			if (thread.replies.length >= 100) return yield* ReviewAdjudicationFailure.make({
+				operation: "listReviewCommentsForAdjudication",
+				reason: `inline thread ${wire.in_reply_to_id} exceeds the bounded 100-command adjudication lookup`
+			});
+			thread.replies.push(reply);
+		}
+		return [...threads.values()].filter((thread) => thread.root.path.length > 0 && thread.root.path.length <= 500).map(({ root, replies }) => {
+			const endLine = positiveLine(root.line ?? root.original_line);
+			const startLine = positiveLine(root.start_line ?? root.original_start_line) ?? endLine;
+			return AdjudicableThread.make({
+				path: root.path,
+				startLine,
+				endLine,
+				rootBody: root.body.slice(0, 65536),
+				replies
+			});
+		});
+	});
+	const listIssueComments = Effect.gen(function* () {
+		return (yield* listPaged({
+			operation: "listIssueCommentsForAdjudication",
+			url: `${target.apiUrl}/repos/${target.repository}/issues/${target.number}/comments`,
+			decode: decodeAdjudication(GitHubIssueCommentsPageWire, "listIssueCommentsForAdjudication")
+		})).flatMap((wire, sourceOrder) => {
+			const comment = toAdjudicationComment(wire, sourceOrder);
+			return comment === void 0 ? [] : [comment];
+		});
+	});
+	return ReviewAdjudicationHost.of({
+		listFindingThreads,
+		listIssueComments
+	});
+}));
 /** Reading the pull request's previously posted reviews failed. */
 var PriorReviewLookupFailure = class extends Schema.TaggedError()("PriorReviewLookupFailure", { reason: Schema.String }) {
 	get message() {
@@ -2583,8 +3219,8 @@ const gitHubPriorReviewsLayer = Layer.effect(PriorReviews)(Effect.gen(function*
 			latestState
 		};
 	}).pipe(Effect.provideService(HttpClient.HttpClient, client));
-	const compareHeads = (baseSha, headSha) => Effect.gen(function* () {
-		const wire = yield* (yield* HttpClient.execute(withCommonHeaders(HttpClientRequest.get(`${target.apiUrl}/repos/${target.repository}/compare/${encodeURIComponent(baseSha)}...${encodeURIComponent(headSha)}`).pipe(HttpClientRequest.acceptJson), target.token)).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.mapError(asLookupFailure))).json.pipe(Effect.mapError(asLookupFailure), Effect.flatMap((body) => Schema.decodeUnknownEffect(GitHubCompareWire)(body).pipe(Effect.mapError(asLookupFailure))));
+	const compareCommits = (baseSha, headSha, separator) => Effect.gen(function* () {
+		const wire = yield* (yield* HttpClient.execute(withCommonHeaders(HttpClientRequest.get(`${target.apiUrl}/repos/${target.repository}/compare/${encodeURIComponent(baseSha)}${separator}${encodeURIComponent(headSha)}`).pipe(HttpClientRequest.acceptJson), target.token)).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.mapError(asLookupFailure))).json.pipe(Effect.mapError(asLookupFailure), Effect.flatMap((body) => Schema.decodeUnknownEffect(GitHubCompareWire)(body).pipe(Effect.mapError(asLookupFailure))));
 		const files = wire.files.map(toChangedFile);
 		return ReviewHeadComparison.make({
 			status: wire.status,
@@ -2595,13 +3231,22 @@ const gitHubPriorReviewsLayer = Layer.effect(PriorReviews)(Effect.gen(function*
 			truncated: files.length >= 300
 		});
 	}).pipe(Effect.provideService(HttpClient.HttpClient, client));
+	const compareTrees = (baseSha, headSha) => compareCommits(baseSha, headSha, "..").pipe(Effect.map((comparison) => ReviewHeadComparison.make({
+		status: comparison.status === "identical" ? "identical" : "ahead",
+		baseSha,
+		headSha,
+		mergeBaseSha: baseSha,
+		files: comparison.files,
+		truncated: comparison.truncated
+	})));
 	return PriorReviews.of({
 		latestFingerprint: readMarkers(Option.none()).pipe(Effect.map((markers) => markers.latestFingerprint)),
 		latestState: Effect.gen(function* () {
 			const authenticator = yield* ReviewStateAuthenticator;
 			return yield* readMarkers(Option.some(authenticator)).pipe(Effect.map((markers) => markers.latestState));
 		}),
-		compareHeads
+		compareHeads: (baseSha, headSha) => compareCommits(baseSha, headSha, "..."),
+		compareTrees
 	});
 }));
 /**
@@ -2614,6 +3259,6 @@ const fingerprintUnchanged = (current) => Effect.gen(function* () {
 	return Option.isSome(latest) && latest.value === current;
 });
 //#endregion
-export { DiscoveredConcern as $, commentableLines as $n, boundedListReason as $t, ReviewStateAuthenticationFailure as A, clampMaxFindings as An, MAX_UNIT_FILES as At, selectReviewRange as B, MAX_CHANGED_FILES as Bn, UNIT_CHANGED_LINE_BUDGET as Bt, MAX_REVIEW_STATE_MARKER_CHARS as C, ReviewConcern as Cn, reviewCandidateSubjectKey as Ct, ReviewMode as D, ReviewToolkitLayer as Dn, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as Dt, ReviewHeadComparison as E, ReviewToolkit as En, MAX_MERGED_FINDINGS as Et, StoredReviewFinding as F, makeReviewInstructions as Fn, ReviewPassId as Ft, validateReviewState as G, ReviewInputViolation as Gn, rankAndDedupeConcerns as Gt, toStoredConcern as H, PullRequestMetadata as Hn, classifyReviewRisks as Ht, buildProfileMission as I, readFileDiffHandler as In, ReviewRiskCategory as It, computeChangesetFingerprint as J, ChangedFile as Jn, FailedReviewUnit as Jt, webCryptoReviewStateAuthenticatorLayer as K, normalizeRepoRelativePath as Kn, rankAndDedupeFindings as Kt, computeProfileFingerprint as L, readFileHandler as Ln, ReviewUnit as Lt, ReviewStateMarker as M, fileDiffView as Mn, ReviewDiscoveryPerspective as Mt, ReviewStateMarkerTooLarge as N, fileReviewEvidenceChunks as Nn, ReviewEvidenceShard as Nt, ReviewScopeMode as O, ReviewVerdict as On, MAX_REVIEW_UNITS as Ot, StoredReviewConcern as P, listChangedFilesHandler as Pn, ReviewEvidenceShardId as Pt, ConcernCandidate as Q, annotatePatch as Qn, assessFlatReview as Qt, fromStoredConcern as R, resolveGuidance as Rn, ReviewUnitId as Rt, GitCommitSha as S, ReadFileDiff as Sn, makeFileReviewerInstructions as St, ReviewExecutionContext as T, ReviewMission as Tn, MAX_FILE_EVIDENCE_CHARS as Tt, toStoredFinding as U, PullRequestSource as Un, findingAnchorInUnitEvidence as Ut, selectedPullRequestSourceLayer as V, MAX_FILE_CHARS as Vn, UNIT_EVIDENCE_CHAR_BUDGET as Vt, unavailableReviewStateAuthenticatorLayer as W, PullRequestSourceFailure as Wn, planReviewUnits as Wt, renderFingerprintMarker as X, ChangedPath as Xn, ReviewCoverage as Xt, extractFingerprint as Y, ChangedFileStatus as Yn, ReviewAssurance as Yt, CandidateAssessment as Z, MAX_REVIEW_CONTENT_CHARS as Zn, ReviewInputCoverage as Zt, ReviewRetirementHost as _, MAX_WALKTHROUGH_ENTRIES as _n, assessmentSettlesSuggestionExactly as _t, PriorReviews as a, CodeReview as an, FindingCandidate as at, hasReviewMetadataMarker as b, REVIEW_TOOL_RESULT_MAX_BYTES as bn, fileReviewerInstructions as bt, fingerprintUnchanged as c, FileSlice as cn, MAX_FILE_REVIEW_TOOL_CALLS as ct, gitHubReviewPublisherLayer as d, FindingSeverity as dn, REVIEW_UNIT_CONCURRENCY as dt, compatibilityCoverage as en, hasReviewableContent as er, FileReviewBrief as et, gitHubReviewRetirementHostLayer as f, ListChangedFiles as fn, ReviewCandidate as ft, ReviewRetirementFailure as g, MAX_PATCH_CHARS as gn, ReviewWorkPhase as gt, RetirableReviewComment as h, MAX_FINDINGS as hn, ReviewWorkPerspective as ht, PriorReviewLookupFailure as i, ChangedFilesView as in, FileReviewer as it, ReviewStateAuthenticator as j, defaultReviewPolicy as jn, ReviewDiscoveryPass as jt, ReviewState as k, WalkthroughEntry as kn, MAX_UNIT_EVIDENCE_SHARDS as kt, gitHubPriorReviewsLayer as l, FileSliceQuery as ln, MAX_REVIEW_CHILDREN as lt, RetirableReview as m, MAX_CONCERNS as mn, ReviewPassMisbehaved as mt, GitHubApiFailure as n, flatAssurance as nn, parsePatch as nr, FileReviewReport as nt, PublishedReview as o, FileDiffQuery as on, MAX_CHILD_CONCERNS as ot, parseGitHubSubmittedAt as p, ListChangedFilesQuery as pn, ReviewCandidateId as pt, FINGERPRINT_MARKER_LENGTH as q, anchorViolation as qn, FailedReviewPass as qt, GitHubReviewTarget as r, ChangedFileSummary as rn, renderReviewContent as rr, FileReviewToolkit as rt, ReviewPublisher as s, FileDiffView as sn, MAX_CHILD_FINDINGS as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, fanOutInputCoverage as tn, isReviewableFile as tr, FileReviewEvidence as tt, gitHubPullRequestSourceLayer as u, FindingCategory as un, MAX_UNIT_CANDIDATES as ut, ReviewRetirementReport as v, MAX_WALKTHROUGH_SUMMARY_CHARS as vn, confirmedFindingForPublication as vt, MAX_STORED_UNREVIEWED_PATHS as w, ReviewFinding as wn, runFanOutReview as wt, retireStaleReviews as x, ReadFile as xn, makeFileReviewerDefinition as xt, decideReviewRetirement as y, PullRequestReviewer as yn, defaultFileReviewerPolicy as yt, fromStoredFinding as z, reviewInstructions as zn, ReviewUnitPlan as zt };
+export { ReviewDiscoveryPass as $, ReviewFinding as $n, MAX_STORED_ADJUDICATIONS as $t, MAX_CHILD_FINDINGS as A, validateReviewState as An, parsePatch as Ar, buildPriorReviewContext as At, assessmentSettlesSuggestionExactly as B, FindingSeverity as Bn, threadFindingTarget as Bt, FileReviewBrief as C, fullReviewSelection as Cn, ChangedFileStatus as Cr, anchorViolation as Ct, FileReviewer as D, toStoredConcern as Dn, commentableLines as Dr, MAX_THREAD_ADJUDICATION_COMMANDS as Dt, FileReviewToolkit as E, selectedPullRequestSourceLayer as En, annotatePatch as Er, AdjudicationComment as Et, ReviewCandidate as F, FileDiffQuery as Fn, noReviewAdjudicationHostLayer as Ft, makeFileReviewerInstructions as G, MAX_PATCH_CHARS as Gn, ReviewRetirementHost as Gt, defaultFileReviewerPolicy as H, ListChangedFilesQuery as Hn, RetirableReview as Ht, ReviewCandidateId as I, FileDiffView as In, parseIssueAdjudication as It, MAX_MERGED_FINDINGS as J, PullRequestReviewer as Jn, hasReviewMetadataMarker as Jt, reviewCandidateSubjectKey as K, MAX_WALKTHROUGH_ENTRIES as Kn, ReviewRetirementReport as Kt, ReviewPassMisbehaved as L, FileSlice as Ln, parseThreadAdjudication as Lt, MAX_REVIEW_CHILDREN as M, ChangedFileSummary as Mn, deriveAdjudications as Mt, MAX_UNIT_CANDIDATES as N, ChangedFilesView as Nn, mergeAdjudications as Nt, FindingCandidate as O, toStoredFinding as On, hasReviewableContent as Or, ReviewAdjudicationFailure as Ot, REVIEW_UNIT_CONCURRENCY as P, CodeReview as Pn, noReviewAdjudicationHost as Pt, MAX_UNIT_FILES as Q, ReviewConcern as Qn, MAX_REVIEW_STATE_MARKER_CHARS as Qt, ReviewWorkPerspective as R, FileSliceQuery as Rn, renderAdjudicationContextLine as Rt, DiscoveredConcern as S, fullReviewExecutionContextLayer as Sn, ChangedFile as Sr, splitCarriedScope as St, FileReviewReport as T, selectReviewRange as Tn, MAX_REVIEW_CONTENT_CHARS as Tr, AdjudicableThread as Tt, fileReviewerInstructions as U, MAX_CONCERNS as Un, RetirableReviewComment as Ut, confirmedFindingForPublication as V, ListChangedFiles as Vn, INLINE_FINDING_TITLE_PATTERN as Vt, makeFileReviewerDefinition as W, MAX_FINDINGS as Wn, ReviewRetirementFailure as Wt, MAX_REVIEW_UNITS as X, ReadFile as Xn, AdjudicationDisposition as Xt, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as Y, REVIEW_TOOL_RESULT_MAX_BYTES as Yn, retireStaleReviews as Yt, MAX_UNIT_EVIDENCE_SHARDS as Z, ReadFileDiff as Zn, GitCommitSha as Zt, computeProfileFingerprint as _, buildProfileMission as _n, PullRequestMetadata as _r, ReviewInputCoverage as _t, PriorReviews as a, ReviewScopeMode as an, clampMaxFindings as ar, ReviewUnit as at, CandidateAssessment as b, fromStoredConcern as bn, ReviewInputViolation as br, fanOutInputCoverage as bt, fingerprintUnchanged as c, ReviewStateAuthenticator as cn, fileReviewEvidenceChunks as cr, UNIT_EVIDENCE_CHAR_BUDGET as ct, gitHubReviewAdjudicationHostLayer as d, StoredAdjudication as dn, readFileDiffHandler as dr, planReviewUnits as dt, MAX_STORED_UNREVIEWED_PASSES as en, ReviewMission as er, ReviewDiscoveryPerspective as et, gitHubReviewPublisherLayer as f, StoredReviewConcern as fn, readFileHandler as fr, rankAndDedupeConcerns as ft, computeChangesetFingerprint as g, adjudicationIdentity as gn, MAX_FILE_CHARS as gr, ReviewAssurance as gt, FINGERPRINT_MARKER_LENGTH as h, UnreviewedStage as hn, MAX_CHANGED_FILES as hr, FailedReviewPass as ht, PriorReviewLookupFailure as i, ReviewMode as in, WalkthroughEntry as ir, ReviewRiskCategory as it, MAX_FILE_REVIEW_TOOL_CALLS as j, webCryptoReviewStateAuthenticatorLayer as jn, renderReviewContent as jr, collectReviewAdjudications as jt, MAX_CHILD_CONCERNS as k, unavailableReviewStateAuthenticatorLayer as kn, isReviewableFile as kr, ReviewAdjudicationHost as kt, gitHubPriorReviewsLayer as l, ReviewStateMarker as ln, listChangedFilesHandler as lr, classifyReviewRisks as lt, parseGitHubSubmittedAt as m, StoredUnreviewedPass as mn, reviewInstructions as mr, reviewConcernKey as mt, GitHubApiFailure as n, ReviewExecutionContext as nn, ReviewToolkitLayer as nr, ReviewEvidenceShardId as nt, PublishedReview as o, ReviewState as on, defaultReviewPolicy as or, ReviewUnitId as ot, gitHubReviewRetirementHostLayer as p, StoredReviewFinding as pn, resolveGuidance as pr, rankAndDedupeFindings as pt, runFanOutReview as q, MAX_WALKTHROUGH_SUMMARY_CHARS as qn, decideReviewRetirement as qt, GitHubReviewTarget as r, ReviewHeadComparison as rn, ReviewVerdict as rr, ReviewPassId as rt, ReviewPublisher as s, ReviewStateAuthenticationFailure as sn, fileDiffView as sr, ReviewUnitPlan as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, MAX_STORED_UNREVIEWED_PATHS as tn, ReviewToolkit as tr, ReviewEvidenceShard as tt, gitHubPullRequestSourceLayer as u, ReviewStateMarkerTooLarge as un, makeReviewInstructions as ur, findingAnchorInUnitEvidence as ut, extractFingerprint as v, concernIdentity as vn, PullRequestSource as vr, assessFlatReview as vt, FileReviewEvidence as w, isLineageAncestor as wn, ChangedPath as wr, AUTHORIZED_ADJUDICATION_ASSOCIATIONS as wt, ConcernCandidate as x, fromStoredFinding as xn, normalizeRepoRelativePath as xr, flatAssurance as xt, renderFingerprintMarker as y, findingIdentity as yn, PullRequestSourceFailure as yr, boundedListReason as yt, ReviewWorkPhase as z, FindingCategory as zn, renderPriorFindingContextLine as zt };
 
-//# sourceMappingURL=github-BbwYzNrC.mjs.map
+//# sourceMappingURL=github-NjgxGqwM.mjs.map