@effect-agent/pr-review 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/{github-C6jrBLA2.mjs → github-NjgxGqwM.mjs}

@@ -169,18 +169,6 @@ const annotatePatch = (patch) => {
 	return output.join("\n");
 };
 //#endregion
-//#region src/internal/anchors.ts
-/** Why a finding cannot anchor to the current new-version diff, if any. */
-const anchorViolation = (finding, files) => {
-	const file = files.find((candidate) => candidate.path === finding.path);
-	if (file === void 0) return "path is not part of the changeset";
-	if (file.patch === void 0) return "file has no anchorable textual diff";
-	if (finding.endLine < finding.startLine) return "endLine precedes startLine";
-	if (finding.endLine - finding.startLine + 1 > 100) return "range is implausibly large";
-	const anchors = commentableLines(file.patch);
-	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!anchors.has(line)) return `line ${line} is not part of the diff`;
-};
-//#endregion
 //#region src/internal/source.ts
 /** Reading a file head version larger than this is refused, never truncated silently. */
 const MAX_FILE_CHARS = 2e5;
@@ -442,6 +430,8 @@ const ReviewToolkitLayer = ReviewToolkit.toLayer({
 	read_file_diff: readFileDiffHandler,
 	read_file: readFileHandler
 });
+/** Bounded prior-review context lines injected into reviewer instructions. */
+const ReviewContextLines = Schema.Array(Schema.String.check(Schema.isMaxLength(1200))).check(Schema.isMaxLength(20));
 var ReviewMission = class extends Schema.Class("@effect-agent/pr-review/ReviewMission")({
 	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
 	number: Schema.Int.check(Schema.isGreaterThan(0)),
@@ -449,7 +439,19 @@ var ReviewMission = class extends Schema.Class("@effect-agent/pr-review/ReviewMi
 	body: Schema.String.check(Schema.isMaxLength(2e4)),
 	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
 	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	changedFileCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+	changedFileCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/**
+	* Maintainer-adjudicated identities rendered as bounded context lines; the
+	* reviewer must not re-raise them without materially new evidence. Absent
+	* from fingerprint missions so an adjudication never invalidates the
+	* skip-unchanged authority.
+	*/
+	adjudicatedContext: Schema.optionalKey(ReviewContextLines),
+	/**
+	* Prior-round findings on re-reviewed scope, rendered as bounded context
+	* lines; each must be confirmed, declared fixed, or explicitly withdrawn.
+	*/
+	priorFindingContext: Schema.optionalKey(ReviewContextLines)
 }) {};
 const FindingSeverity = Schema.Literals([
 	"blocking",
@@ -494,10 +496,14 @@ const ReviewVerdict = Schema.Literals([
 * A concern with no diff line to anchor to: a missing deletion or cleanup,
 * rollout or migration sequencing, a coverage gap the diff implies but does
 * not add, or a scope question only the author can answer. Rendered as a
-* review-body section — never as an inline comment, so it needs no anchor and
-* is never demoted.
+* review-body section instead of an inline comment. `evidencePaths` binds the
+* concern to changed files so a later incremental review can invalidate and
+* recheck it when any supporting path changes. It remains optional only for
+* decoding review output and continuity state written before path binding was
+* introduced; a pathless concern cannot authorize incremental continuity.
 */
 var ReviewConcern = class extends Schema.Class("@effect-agent/pr-review/ReviewConcern")({
+	evidencePaths: Schema.optionalKey(Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))),
 	severity: FindingSeverity,
 	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
 	body: Schema.NonEmptyString.check(Schema.isMaxLength(2e3))
@@ -537,6 +543,8 @@ const makeReviewInstructions = (options = {}) => (mission) => {
 		`You are a senior code reviewer for pull request #${mission.number} ("${mission.title}") in ${mission.repository}, merging ${mission.headRef} into ${mission.baseRef}. It changes ${mission.changedFileCount} file(s).`,
 		mission.body.length > 0 ? `Author description:\n${mission.body}` : "The author provided no description.",
 		...resolveGuidance(options.guidance, mission),
+		...mission.adjudicatedContext === void 0 || mission.adjudicatedContext.length === 0 ? [] : ["A maintainer has adjudicated these previously raised review items (disposition, reason). Do not re-raise them unless you have materially new evidence, and if you do, say explicitly what changed since the adjudication:", ...mission.adjudicatedContext.map((line) => `- ${line}`)],
+		...mission.priorFindingContext === void 0 || mission.priorFindingContext.length === 0 ? [] : ["Your previous review raised these findings on the scope you are re-reviewing. For each, either confirm it still holds, state that it is fixed, or withdraw it; do not demand the opposite of your own prior guidance without explicitly acknowledging the reversal:", ...mission.priorFindingContext.map((line) => `- ${line}`)],
 		"Work in this order:",
 		"1. Call list_changed_files once to see the selected input scope. In incremental reviews it is deliberately a subset of the pull request's full diff (totalFiles counts the whole pull request); omitted paths belong to settled prior scope or explicit host exclusions, not to this run.",
 		"2. Call read_file_diff for every listed file. A normal diff marks new-version anchors as R<number>; only those numbers are valid startLine/endLine values. When GitHub omitted a diff, the tool may return bounded base/head content marked B/H instead. Review that content, but report its defects as non-anchored concerns because B/H lines cannot anchor GitHub comments. Never anchor a finding to a removed (-), B, or H line.",
@@ -545,9 +553,9 @@ const makeReviewInstructions = (options = {}) => (mission) => {
 		"When the diff adds or changes a test, check that it can actually fail: a test that would still pass with the bug present is theatre, not coverage. The usual tell is a loose assertion standing where an exact one belongs — >= or a truthiness check over an expected value, or a snapshot that absorbs whatever it is handed.",
 		"Go shallow only when the diff has no behavioral surface at all: doc typos, formatting, lockfile or generated-code regeneration, a mechanical rename. Line count is not the signal — a one-line change to auth, money, SQL, a comparison operator, or a config default is not trivial.",
 		"Drop bloat-shaped findings before reporting: defensive checks for cases that cannot happen, abstractions used once, comments restating obvious code, tests asserting tautologies, just-in-case guards. A finding must be sound, correct, and worth acting on; prefer an explicit keep over an invented finding.",
-		"5. After collecting anchored findings, deliberately scan for concerns with NO line to point at: deletion or cleanup plans for code the diff replaces, rollout or migration sequencing, coverage gaps the diff implies but does not add, scope questions only the author can answer. Report each as a \"concern\", never as a finding with an invented anchor; report none when none exist.",
+		"5. After collecting anchored findings, deliberately scan for concerns with NO line to point at: deletion or cleanup plans for code the diff replaces, rollout or migration sequencing, coverage gaps the diff implies but does not add, scope questions only the author can answer. Report each as a \"concern\", never as a finding with an invented anchor. Every concern must list 1-3 exact changed evidencePaths that support it so later incremental reviews can recheck it when those files change. Report none when none exist, and never split one root concern into differently worded restatements.",
 		`6. Write a walkthrough: for every file whose evidence you examined, one factual sentence (<= 240 chars) describing what changed in that file — written for a reader scanning the pull request, never restating the diff line by line. Use only paths from list_changed_files; invented paths are dropped.`,
-		"7. Then return ONLY a JSON object — no Markdown fences, no prose before or after — exactly this shape: {\"summary\": <string, 1-3 paragraphs of overall assessment>, \"verdict\": <\"approve\" | \"comment\" | \"request-changes\">, \"findings\": [{\"path\": <string, a changed file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL: \"correctness\" | \"security\" | \"concurrency\" | \"performance\" | \"resources\" | \"error-handling\" | \"testing\" | \"maintainability\" | \"style\" | \"docs\">, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement text for exactly lines startLine..endLine, ready to commit>}], \"concerns\": <array, OPTIONAL: [{\"severity\": <\"blocking\" | \"important\" | \"nit\">, \"title\": <string, <= 120 chars>, \"body\": <string>}], only for step-5 concerns with no valid anchor — never duplicate a finding here>, \"walkthrough\": <array, OPTIONAL: [{\"path\": <string, a changed file path>, \"summary\": <string, the step-6 sentence>}], one entry per reviewed file>}.",
+		"7. Then return ONLY a JSON object — no Markdown fences, no prose before or after — exactly this shape: {\"summary\": <string, 1-3 paragraphs of overall assessment>, \"verdict\": <\"approve\" | \"comment\" | \"request-changes\">, \"findings\": [{\"path\": <string, a changed file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL: \"correctness\" | \"security\" | \"concurrency\" | \"performance\" | \"resources\" | \"error-handling\" | \"testing\" | \"maintainability\" | \"style\" | \"docs\">, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement text for exactly lines startLine..endLine, ready to commit>}], \"concerns\": <array, OPTIONAL: [{\"evidencePaths\": <array of 1-3 exact changed file paths>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"title\": <string, <= 120 chars>, \"body\": <string>}], only for step-5 concerns with no valid anchor — never duplicate a finding here>, \"walkthrough\": <array, OPTIONAL: [{\"path\": <string, a changed file path>, \"summary\": <string, the step-6 sentence>}], one entry per reviewed file>}.",
 		`Report at most ${maxFindings} findings and at most 10 concerns; prefer the most important ones. An empty findings array with verdict "approve" is a valid review. Include "suggestion" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement for every line in the range and nothing else.`,
 		"Use verdict \"request-changes\" only when at least one finding or concern is \"blocking\". Line anchors you invent will be discarded, so copy R-numbers from read_file_diff output."
 	].join("\n");
@@ -579,1764 +587,2108 @@ const PullRequestReviewer = Agent.define("pr-reviewer", {
 	}
 });
 //#endregion
-//#region src/internal/coverage.ts
-var FailedReviewUnit = class extends Schema.Class("@effect-agent/pr-review/FailedReviewUnit")({
-	unitId: Schema.NonEmptyString.check(Schema.isMaxLength(32)),
-	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+//#region src/internal/review-state.ts
+const ReviewMode = Schema.Literals(["incremental", "final"]);
+const ReviewScopeMode = Schema.Literals(["incremental", "full"]);
+const GitCommitSha = Schema.NonEmptyString.check(Schema.isMaxLength(64), Schema.isPattern(/^[0-9a-f]{40,64}$/));
+const Fingerprint = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+const StoredText = Schema.NonEmptyString.check(Schema.isMaxLength(800));
+/** A compact unresolved finding suitable for the bounded review-body marker. */
+var StoredReviewFinding = class extends Schema.Class("@effect-agent/pr-review/StoredReviewFinding")({
+	path: ChangedPath,
+	startLine: Schema.Int.check(Schema.isGreaterThan(0)),
+	endLine: Schema.Int.check(Schema.isGreaterThan(0)),
+	severity: FindingSeverity,
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	body: StoredText
 }) {};
+/** A compact unresolved non-anchored concern with its invalidation paths. */
+var StoredReviewConcern = class extends Schema.Class("@effect-agent/pr-review/StoredReviewConcern")({
+	/** Absent only on legacy state written before concern path binding. */
+	evidencePaths: Schema.optionalKey(Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))),
+	severity: FindingSeverity,
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	body: StoredText
+}) {};
+/** How a maintainer settled a previously raised finding or concern. */
+const AdjudicationDisposition = Schema.Literals([
+	"accepted-risk",
+	"refuted",
+	"obsolete"
+]);
+/** The adjudications bound carried by the ReviewState schema. */
+const MAX_STORED_ADJUDICATIONS = 20;
 /**
-* Compatibility diagnostic retained for callers that consumed the original
-* `coverage` field. New UI and state decisions use ReviewInputCoverage and
-* ReviewAssurance directly.
+* One maintainer adjudication of a finding or concern identity. Anchored
+* findings carry their full location identity; unanchored concerns are
+* identified by title alone, so the location fields stay absent.
 */
-var ReviewCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewCoverage")({
-	status: Schema.Literals(["complete", "incomplete"]),
-	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	reviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	unreviewedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	failedUnits: Schema.Array(FailedReviewUnit).check(Schema.isMaxLength(8)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+const StoredAdjudicationFields = Schema.Struct({
+	path: Schema.optionalKey(ChangedPath),
+	startLine: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0))),
+	endLine: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0))),
+	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
+	disposition: AdjudicationDisposition,
+	reason: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(300))),
+	/** GitHub login of the maintainer whose comment adjudicated the identity. */
+	actor: Schema.NonEmptyString.check(Schema.isMaxLength(100))
+}).check(Schema.makeFilter((adjudication) => {
+	const locationParts = [
+		adjudication.path,
+		adjudication.startLine,
+		adjudication.endLine
+	].filter((part) => part !== void 0).length;
+	return locationParts === 0 || locationParts === 3 ? void 0 : "path, startLine, and endLine must be either all present or all absent";
+}, { title: "adjudication locations are complete or unanchored" }));
+var StoredAdjudication = class extends Schema.Class("@effect-agent/pr-review/StoredAdjudication")(StoredAdjudicationFields) {};
+/**
+* The one finding-identity composition shared by retirement, adjudication,
+* and settlement. A tagged JSON tuple keeps anchored findings in a namespace
+* disjoint from title-only concerns and remains unambiguous even when
+* untrusted path or title text contains delimiter characters.
+*/
+const findingIdentity = (finding) => JSON.stringify([
+	"finding",
+	finding.path,
+	finding.startLine,
+	finding.endLine,
+	finding.title
+]);
+/** The disjoint title-only identity namespace for unanchored concerns. */
+const concernIdentity = (concern) => JSON.stringify(["concern", concern.title]);
+/**
+* An adjudication's identity: the shared finding identity when anchored, the
+* disjoint concern identity when unanchored.
+*/
+const adjudicationIdentity = (adjudication) => adjudication.path !== void 0 && adjudication.startLine !== void 0 && adjudication.endLine !== void 0 ? findingIdentity({
+	path: adjudication.path,
+	startLine: adjudication.startLine,
+	endLine: adjudication.endLine,
+	title: adjudication.title
+}) : concernIdentity(adjudication);
+/** The carried-scope bound; a run that cannot fit its leftovers publishes no state. */
+const MAX_STORED_UNREVIEWED_PATHS = 100;
+/** Failed-pass records stored beside the leftover paths; one per unit stage. */
+const MAX_STORED_UNREVIEWED_PASSES = 24;
+/** Stages a leftover path may need retried without a second general discovery. */
+const UnreviewedStage = Schema.Literals([
+	"discovery",
+	"specialist",
+	"verification"
+]);
+/** One failed fan-out pass whose paths should be retried, not rediscovered. */
+var StoredUnreviewedPass = class extends Schema.Class("@effect-agent/pr-review/StoredUnreviewedPass")({
+	stage: UnreviewedStage,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
 }) {};
-var ReviewInputCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewInputCoverage")({
-	status: Schema.Literals(["complete", "incomplete"]),
-	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	assignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	/** Assigned paths whose model-visible diff was truncated by the evidence bound. */
-	partialPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	unassignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+/**
+* Versioned state embedded after EVERY completed run that can be signed. The
+* head plus full-scope fingerprint forms an incremental baseline; an absent
+* unresolved item never means the path is defect-free. `unreviewedPaths`
+* carries retryable review gaps (failed passes) forward so the next
+* incremental run re-reviews exactly them plus the new delta — the baseline
+* advances monotonically instead of freezing on one flaky pass and reopening
+* the whole post-baseline scope. Storing hundreds of path strings separately
+* would not fit GitHub's bounded review body in the worst case.
+*/
+var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewState")({
+	version: Schema.Literal(1),
+	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
+	pullRequestNumber: Schema.Int.check(Schema.isGreaterThan(0)),
+	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
+	baseSha: GitCommitSha,
+	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
+	reviewedHeadSha: GitCommitSha,
+	profileFingerprint: Fingerprint,
+	settledScopeFingerprint: Fingerprint,
+	reviewedPathCount: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 300
+	})),
+	unresolvedFindings: Schema.Array(StoredReviewFinding).check(Schema.isMaxLength(20)),
+	unresolvedConcerns: Schema.Array(StoredReviewConcern).check(Schema.isMaxLength(10)),
+	/** Retryable review gaps carried into the next incremental run's scope. */
+	unreviewedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(100)),
+	/** Which failed pass produced those leftovers. */
+	unreviewedPasses: Schema.Array(StoredUnreviewedPass).check(Schema.isMaxLength(24)),
 	/**
-	* Paths with neither a textual diff nor bounded base/head text (binaries,
-	* oversized files). Fail-closed: they keep the status incomplete for as
-	* long as they are part of the pull request — an unreviewable change must
-	* never authorize a green check. Exclude them deliberately with ignore
-	* globs when that is intended.
+	* True only when the producing run had complete input coverage, no
+	* unsettled pass, and nothing carried. Skip-unchanged authority: an
+	* unchanged patch may skip re-review only over a settled state.
 	*/
-	undiffablePaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(20))
+	settled: Schema.Boolean,
+	lastReviewMode: ReviewScopeMode,
+	/**
+	* Maintainer adjudications standing against this pull request. optionalKey
+	* so state markers signed before the field existed still decode.
+	*/
+	adjudications: Schema.optionalKey(Schema.Array(StoredAdjudication).check(Schema.isMaxLength(20)))
 }) {};
-var FailedReviewPass = class extends Schema.Class("@effect-agent/pr-review/FailedReviewPass")({
-	workId: Schema.NonEmptyString.check(Schema.isMaxLength(96)),
-	stage: Schema.Literals([
-		"discovery",
-		"specialist",
-		"verification"
-	]),
-	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
+const toStoredFinding = (finding) => StoredReviewFinding.make({
+	path: finding.path,
+	startLine: finding.startLine,
+	endLine: finding.endLine,
+	severity: finding.severity,
+	title: finding.title,
+	body: finding.body.slice(0, 800)
+});
+const fromStoredFinding = (finding) => ReviewFinding.make({
+	path: finding.path,
+	startLine: finding.startLine,
+	endLine: finding.endLine,
+	severity: finding.severity,
+	title: finding.title,
+	body: finding.body
+});
+const toStoredConcern = (concern) => StoredReviewConcern.make({
+	...concern.evidencePaths === void 0 ? {} : { evidencePaths: concern.evidencePaths },
+	severity: concern.severity,
+	title: concern.title,
+	body: concern.body.slice(0, 800)
+});
+const fromStoredConcern = (concern) => ReviewConcern.make({
+	...concern.evidencePaths === void 0 ? {} : { evidencePaths: concern.evidencePaths },
+	severity: concern.severity,
+	title: concern.title,
+	body: concern.body
+});
+const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v1:";
+const STATE_MARKER_SUFFIX = " -->";
+const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v1:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
+const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v1\0";
+const MAX_REVIEW_STATE_MARKER_CHARS = 24e3;
+const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
+var ReviewStateAuthenticationFailure = class extends Schema.TaggedError()("ReviewStateAuthenticationFailure", {
+	operation: Schema.Literals(["sign", "verify"]),
+	reason: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
 }) {};
-/**
-* Settlement of scheduled review work. `incomplete` means reviewer-side work
-* failed after its bounded retry — a machinery gap that is carried forward and
-* retried on the next run, never a statement about the code under review.
-* `unverified` is the flat reviewer's honest constant: one pass with no
-* independent verifier is neither settled assurance nor a failure.
-*/
-var ReviewAssurance = class extends Schema.Class("@effect-agent/pr-review/ReviewAssurance")({
-	status: Schema.Literals([
-		"settled",
-		"incomplete",
-		"unverified"
-	]),
-	requiredGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	requiredSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	requiredVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	completedVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	discoveredCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	confirmedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	rejectedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	unsettledCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Discovery claims discarded for anchors/paths outside their assigned evidence. */
-	discardedInvalidFindings: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	failedPasses: Schema.Array(FailedReviewPass).check(Schema.isMaxLength(64)),
-	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+var ReviewStateMarkerTooLarge = class extends Schema.TaggedError()("ReviewStateMarkerTooLarge", {
+	observedChars: Schema.Int.check(Schema.isGreaterThan(0)),
+	maximumChars: Schema.Int.check(Schema.isGreaterThan(0))
 }) {};
-const toolTrace = (events) => {
-	const declared = /* @__PURE__ */ new Map();
-	const succeeded = /* @__PURE__ */ new Map();
-	const failed = /* @__PURE__ */ new Map();
-	for (const event of events) {
-		if (event._tag === "ToolCallDeclared") declared.set(event.toolCallId, event);
-		if (event._tag === "ToolCallSucceeded") succeeded.set(event.toolCallId, event);
-		if (event._tag === "ToolCallFailed") failed.set(event.toolCallId, event);
-	}
-	return {
-		declared,
-		succeeded,
-		failed
-	};
-};
-const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
-/** Render a bounded, deterministic "label (n): a, b, … (+k more)" reason line. */
-const boundedListReason = (label, values) => {
-	const items = sortedUnique(values);
-	let rendered = `${label} (${items.length}): `;
-	for (let index = 0; index < items.length; index += 1) {
-		const item = items[index] ?? "";
-		const separator = index === 0 ? "" : ", ";
-		const omitted = items.length - index - 1;
-		const suffix = omitted === 0 ? "" : ` … (+${omitted} more)`;
-		if (`${rendered}${separator}${item}${suffix}`.length > 1e3) {
-			const omission = `… (+${items.length - index} more)`;
-			return `${rendered.slice(0, 1e3 - omission.length)}${omission}`;
-		}
-		rendered = `${rendered}${separator}${item}`;
-	}
-	return rendered;
-};
-const anchorSurfaceAdjusted = (inputCoverage, anchorFiles, totalAnchorFiles) => anchorFiles.length >= totalAnchorFiles ? inputCoverage : ReviewInputCoverage.make({
-	...inputCoverage,
-	status: "incomplete",
-	reasons: [...inputCoverage.reasons, `full pull-request anchor surface exposed ${anchorFiles.length} of ${totalAnchorFiles} required files`]
+var ReviewStateAuthenticator = class extends Context.Service()("@effect-agent/pr-review/ReviewStateAuthenticator") {};
+const authenticationFailure = (operation, cause) => ReviewStateAuthenticationFailure.make({
+	operation,
+	reason: String(cause).slice(0, 2048)
 });
-/** The flat reviewer's honest constant assurance: one pass, no verifier. */
-const flatAssurance = () => ReviewAssurance.make({
-	status: "unverified",
-	requiredGeneralDiscoveryPasses: 1,
-	completedGeneralDiscoveryPasses: 1,
-	requiredSpecialistPasses: 0,
-	completedSpecialistPasses: 0,
-	requiredVerificationPasses: 0,
-	completedVerificationPasses: 0,
-	discoveredCandidates: 0,
-	confirmedCandidates: 0,
-	rejectedCandidates: 0,
-	unsettledCandidates: 0,
-	discardedInvalidFindings: 0,
-	failedPasses: [],
-	reasons: ["flat review has no independent candidate-verification pass; use the fan-out pipeline for a settled assurance result"]
+const hmacKey = (secret, operation) => Effect.tryPromise({
+	try: () => globalThis.crypto.subtle.importKey("raw", new TextEncoder().encode(Redacted.value(secret)), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]),
+	catch: (cause) => authenticationFailure(operation, cause)
 });
-/**
-* Assess one settled flat run from its Run event trace: which required paths
-* received successful bounded diff evidence. This observes tool INPUT
-* assignment only — the host cannot know which evidence the model weighed.
-*/
-const assessFlatReview = (input) => {
-	const trace = toolTrace(input.events);
-	const requiredPaths = sortedUnique(input.files.map((file) => file.path));
-	const assigned = /* @__PURE__ */ new Set();
-	const partial = /* @__PURE__ */ new Set();
-	const failedPaths = /* @__PURE__ */ new Set();
-	for (const [toolCallId, declaration] of trace.declared) {
-		if (declaration.toolName !== "read_file_diff") continue;
-		const query = Schema.decodeUnknownOption(FileDiffQuery)(declaration.parameters);
-		if (Option.isNone(query)) continue;
-		const success = trace.succeeded.get(toolCallId);
-		if (success !== void 0) {
-			assigned.add(query.value.path);
-			const view = Schema.decodeUnknownOption(FileDiffView)(success.result);
-			if (Option.isSome(view) && view.value.truncated) partial.add(query.value.path);
-		}
-		if (trace.failed.has(toolCallId)) failedPaths.add(query.value.path);
+const signatureBytes = (signature) => {
+	const pairs = signature.match(/../g) ?? [];
+	const buffer = new ArrayBuffer(pairs.length);
+	const bytes = new Uint8Array(buffer);
+	for (let index = 0; index < pairs.length; index += 1) bytes[index] = Number.parseInt(pairs[index] ?? "", 16);
+	return buffer;
+};
+/** Validated WebCrypto adapter selected at the Action composition root. */
+const webCryptoReviewStateAuthenticatorLayer = (secret) => Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
+	status: "available",
+	unavailableReason: void 0,
+	render: (state) => Effect.gen(function* () {
+		const json = yield* Schema.encodeUnknownEffect(Schema.fromJsonString(ReviewState))(state).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
+		const payload = Encoding.encodeBase64(json);
+		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
+		const key = yield* hmacKey(secret, "sign");
+		const signature = yield* Effect.tryPromise({
+			try: () => globalThis.crypto.subtle.sign("HMAC", key, message),
+			catch: (cause) => authenticationFailure("sign", cause)
+		});
+		const hex = Array.from(new Uint8Array(signature)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+		const marker = `${STATE_MARKER_PREFIX}${payload}.${hex}${STATE_MARKER_SUFFIX}`;
+		if (marker.length > 24e3) return yield* ReviewStateMarkerTooLarge.make({
+			observedChars: marker.length,
+			maximumChars: MAX_REVIEW_STATE_MARKER_CHARS
+		});
+		return yield* Schema.decodeUnknownEffect(ReviewStateMarker)(marker).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
+	}),
+	extract: (body) => {
+		if (body.length > 6e4) return Effect.succeed(Option.none());
+		const match = STATE_MARKER_PATTERN.exec(body);
+		const payload = match?.[1];
+		const signature = match?.[2];
+		if (payload === void 0 || signature === void 0) return Effect.succeed(Option.none());
+		const marker = `${STATE_MARKER_PREFIX}${payload}.${signature}${STATE_MARKER_SUFFIX}`;
+		if (!Schema.is(ReviewStateMarker)(marker)) return Effect.succeed(Option.none());
+		const json = Result.getOrUndefined(Encoding.decodeBase64String(payload));
+		if (json === void 0) return Effect.succeed(Option.none());
+		const decoded = Schema.decodeUnknownOption(Schema.fromJsonString(ReviewState))(json);
+		if (Option.isNone(decoded)) return Effect.succeed(Option.none());
+		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
+		return Effect.gen(function* () {
+			const key = yield* hmacKey(secret, "verify");
+			return (yield* Effect.tryPromise({
+				try: () => globalThis.crypto.subtle.verify("HMAC", key, signatureBytes(signature), message),
+				catch: (cause) => authenticationFailure("verify", cause)
+			})) ? Option.some(decoded.value) : Option.none();
+		});
 	}
-	const undiffable = new Set(input.files.filter((file) => !isReviewableFile(file)).map((file) => file.path));
-	const unassigned = requiredPaths.filter((path) => !undiffable.has(path) && (!assigned.has(path) || failedPaths.has(path)));
-	const reasons = [];
-	if (input.files.length < input.totalFiles) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
-	if (undiffable.size > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", undiffable));
-	if (failedPaths.size > 0) reasons.push(boundedListReason("diff reads failed", failedPaths));
-	if (partial.size > 0) reasons.push(boundedListReason("model-visible diff evidence was truncated", partial));
-	if (unassigned.length > 0) reasons.push(boundedListReason("required paths received no successful diff input", unassigned));
-	return {
-		inputCoverage: anchorSurfaceAdjusted(ReviewInputCoverage.make({
-			status: reasons.length === 0 ? "complete" : "incomplete",
-			requiredPaths,
-			assignedPaths: sortedUnique(assigned),
-			partialPaths: sortedUnique(partial),
-			unassignedPaths: sortedUnique(unassigned),
-			undiffablePaths: sortedUnique(undiffable),
-			reasons
-		}), input.anchorFiles, input.totalAnchorFiles),
-		assurance: flatAssurance(),
-		unreviewedPaths: sortedUnique([...unassigned, ...undiffable])
-	};
+}));
+/** Explicit no-state implementation for hosts without a stable authentication secret. */
+const unavailableReviewStateAuthenticatorLayer = (reason) => {
+	const safeReason = reason === "" ? "review-state authentication is unavailable" : reason;
+	return Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
+		status: "unavailable",
+		unavailableReason: safeReason.slice(0, 1e3),
+		render: () => Effect.fail(ReviewStateAuthenticationFailure.make({
+			operation: "sign",
+			reason: safeReason.slice(0, 2048)
+		})),
+		extract: () => Effect.succeed(Option.none())
+	}));
 };
+/** The bounded result of GitHub's previous-head...current-head comparison. */
+var ReviewHeadComparison = class extends Schema.Class("@effect-agent/pr-review/ReviewHeadComparison")({
+	status: Schema.Literals([
+		"ahead",
+		"behind",
+		"diverged",
+		"identical"
+	]),
+	baseSha: GitCommitSha,
+	headSha: GitCommitSha,
+	mergeBaseSha: GitCommitSha,
+	files: Schema.Array(ChangedFile).check(Schema.isMaxLength(300)),
+	/** GitHub caps compare-file payloads at 300; equality is conservatively truncated. */
+	truncated: Schema.Boolean
+}) {};
+const fullReviewSelection = (input) => ({
+	mode: "full",
+	reason: input.reason,
+	files: input.files,
+	affectedPaths: input.files.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]),
+	retryPaths: [],
+	retryStages: [],
+	totalFiles: input.totalFiles,
+	baselineSha: void 0,
+	priorState: void 0,
+	profileFingerprint: input.profileFingerprint
+});
+/** Three-dot lineage from the reviewed head to the current head is usable. */
+const isLineageAncestor = (comparison, priorState, currentHeadSha) => comparison.baseSha === priorState.reviewedHeadSha && comparison.headSha === currentHeadSha && comparison.mergeBaseSha === priorState.reviewedHeadSha && !comparison.truncated && (comparison.status === "ahead" || comparison.status === "identical");
 /**
-* Input coverage of one host-scheduled fan-out plan: which required paths the
-* bounded plan actually assigned complete evidence for. Capacity overflow and
-* undiffable paths are both real gaps; the pipeline carries them so the check
-* stays fail-closed until they are reviewed, removed, or explicitly ignored.
+* Validate that persisted state belongs to this exact PR/base lineage and the
+* same review profile. A mismatch is a full-review reason, never an error that
+* silently suppresses review work.
 */
-const fanOutInputCoverage = (input) => {
-	const plan = input.plan;
-	const assignedPaths = sortedUnique(plan.units.flatMap((unit) => unit.paths));
-	const unassignedPaths = sortedUnique(plan.unassignedPaths);
-	const reasons = [];
-	if (plan.truncated) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
-	if (plan.undiffablePaths.length > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", plan.undiffablePaths));
-	if (plan.partialEvidencePaths.length > 0) reasons.push(boundedListReason("fan-out capacity left some deterministic evidence shards unassigned", plan.partialEvidencePaths));
-	if (plan.unassignedEvidenceShardCount > 0) {
-		reasons.push(`${plan.unassignedEvidenceShardCount} deterministic evidence shard(s) exceeded fan-out capacity`);
-		reasons.push(boundedListReason(`unassigned evidence shard identifier sample (${plan.unassignedEvidenceShardIds.length} of ${plan.unassignedEvidenceShardCount})`, plan.unassignedEvidenceShardIds));
+const validateReviewState = (state, current, profileFingerprint) => {
+	if (state.repository !== current.repository || state.pullRequestNumber !== current.number) return "stored state belongs to a different pull request";
+	if (current.baseSha === void 0) return "the current base commit is unavailable";
+	if (state.baseRef !== current.baseRef) return "the pull request base ref changed";
+	if (state.headRef !== current.headRef) return "the pull request head ref changed";
+	if (state.profileFingerprint !== profileFingerprint) return "the reviewer profile or model configuration changed";
+	if (state.unresolvedConcerns.some((concern) => concern.evidencePaths === void 0)) return "stored concerns predate affected-path tracking";
+};
+const filePaths = (file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath];
+const incrementalFromDelta = (input) => {
+	const currentPaths = new Set(input.fullFiles.flatMap(filePaths));
+	const affectedPaths = /* @__PURE__ */ new Set([...input.deltaFiles.flatMap(filePaths), ...input.extraAffectedPaths ?? []]);
+	const initialAffectedCount = affectedPaths.size;
+	let expanded = true;
+	while (expanded) {
+		expanded = false;
+		for (const concern of input.priorState.unresolvedConcerns) {
+			const paths = concern.evidencePaths ?? [];
+			if (!paths.some((path) => affectedPaths.has(path))) continue;
+			for (const path of paths) if (!affectedPaths.has(path)) {
+				affectedPaths.add(path);
+				expanded = true;
+			}
+		}
 	}
-	if (plan.unassignedPaths.length > 0) reasons.push(boundedListReason("fan-out capacity left paths unassigned", plan.unassignedPaths));
-	return anchorSurfaceAdjusted(ReviewInputCoverage.make({
-		status: reasons.length === 0 ? "complete" : "incomplete",
-		requiredPaths: sortedUnique(input.files.map((file) => file.path)),
-		assignedPaths,
-		partialPaths: plan.partialEvidencePaths,
-		unassignedPaths,
-		undiffablePaths: sortedUnique(plan.undiffablePaths),
-		reasons
-	}), input.anchorFiles, input.totalAnchorFiles);
+	const selectedByPath = /* @__PURE__ */ new Map();
+	for (const file of input.deltaFiles) if (currentPaths.has(file.path) || file.previousPath !== void 0 && currentPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const carriedPaths = input.priorState.unreviewedPaths.filter((path) => currentPaths.has(path));
+	const retryOnly = /* @__PURE__ */ new Set();
+	const retryStages = /* @__PURE__ */ new Set();
+	for (const path of carriedPaths) {
+		if (affectedPaths.has(path)) continue;
+		retryOnly.add(path);
+		for (const pass of input.priorState.unreviewedPasses) if (pass.paths.includes(path)) retryStages.add(pass.stage);
+	}
+	if (retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) {
+		retryStages.add("discovery");
+		retryStages.add("specialist");
+	}
+	if (retryOnly.size > 0 && retryStages.size === 0) {
+		for (const path of retryOnly) affectedPaths.add(path);
+		retryStages.add("discovery");
+		retryStages.add("specialist");
+		retryStages.add("verification");
+	}
+	for (const file of input.fullFiles) if (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath) || retryOnly.has(file.path) || file.previousPath !== void 0 && retryOnly.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const selectedFiles = [...selectedByPath.values()].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+	const leftoverCount = [...retryOnly].filter((path) => !affectedPaths.has(path)).length;
+	const carriedReason = leftoverCount > 0 ? `; retrying ${leftoverCount} unchanged leftover path(s) without rediscovery` : carriedPaths.length > 0 ? `; retrying ${carriedPaths.length} carried unreviewed path(s)` : "";
+	const concernPathCount = affectedPaths.size - initialAffectedCount;
+	const concernReason = concernPathCount === 0 ? "" : `; reopening ${concernPathCount} related concern path(s) for context`;
+	return {
+		mode: "incremental",
+		reason: `${input.reason}${carriedReason}${concernReason}`,
+		files: selectedFiles,
+		affectedPaths: [...affectedPaths].sort(),
+		retryPaths: [...retryOnly].filter((path) => !affectedPaths.has(path)).sort(),
+		retryStages: [...retryStages].sort(),
+		totalFiles: selectedFiles.length,
+		baselineSha: input.priorState.reviewedHeadSha,
+		priorState: input.priorState,
+		profileFingerprint: input.profileFingerprint
+	};
 };
-/** Compatibility aggregate over the two precise claims. */
-const compatibilityCoverage = (inputCoverage, assurance) => {
-	const assuranceIncomplete = assurance.status === "incomplete";
-	const failedUnits = /* @__PURE__ */ new Map();
-	for (const pass of assurance.failedPasses) {
-		const unitId = pass.workId.slice(0, 8);
-		if (!failedUnits.has(unitId)) failedUnits.set(unitId, FailedReviewUnit.make({
-			unitId,
-			errorTag: `${pass.stage}:${pass.errorTag}`
-		}));
+/** Pure, deterministic range selection with conservative full-review fallbacks. */
+const selectReviewRange = (input) => {
+	const full = (reason) => fullReviewSelection({
+		reason,
+		files: input.fullFiles,
+		totalFiles: input.current.totalChangedFiles,
+		profileFingerprint: input.profileFingerprint
+	});
+	if (input.requestedMode === "final") return full("explicit final full-diff audit requested");
+	if (input.lookupFailure !== void 0) return full(`stored review state could not be recovered: ${input.lookupFailure}`);
+	if (input.priorState === void 0) return full("no compatible stored review state was found");
+	const invalid = validateReviewState(input.priorState, input.current, input.profileFingerprint);
+	if (invalid !== void 0) return full(invalid);
+	const comparison = input.comparison;
+	if (comparison !== void 0 && isLineageAncestor(comparison, input.priorState, input.current.headSha)) {
+		const extraAffected = [];
+		let baseReason = "";
+		if (input.priorState.baseSha !== input.current.baseSha) {
+			const baseComparison = input.baseComparison;
+			if (baseComparison === void 0) return full("the pull request base changed and its lineage comparison was unavailable");
+			if (baseComparison.baseSha !== input.priorState.baseSha || baseComparison.headSha !== input.current.baseSha || baseComparison.mergeBaseSha !== input.priorState.baseSha || baseComparison.status !== "ahead" && baseComparison.status !== "identical" || baseComparison.truncated) return full("the pull request base changed materially or exceeded the comparison bound");
+			for (const file of baseComparison.files) extraAffected.push(...filePaths(file));
+			baseReason = `; base advanced from ${input.priorState.baseSha.slice(0, 7)} and overlapping PR paths were included`;
+		}
+		return incrementalFromDelta({
+			current: input.current,
+			fullFiles: input.fullFiles,
+			profileFingerprint: input.profileFingerprint,
+			priorState: input.priorState,
+			deltaFiles: comparison.files,
+			extraAffectedPaths: extraAffected,
+			reason: `changes since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}`
+		});
 	}
-	return ReviewCoverage.make({
-		status: inputCoverage.status === "complete" && !assuranceIncomplete ? "complete" : "incomplete",
-		requiredPaths: inputCoverage.requiredPaths,
-		reviewedPaths: inputCoverage.assignedPaths,
-		unreviewedPaths: sortedUnique([...inputCoverage.partialPaths, ...inputCoverage.unassignedPaths]),
-		failedUnits: [...failedUnits.values()].slice(0, 8),
-		reasons: [...inputCoverage.reasons, ...assuranceIncomplete ? assurance.reasons : []]
+	const contentComparison = input.contentComparison;
+	if (contentComparison !== void 0 && !contentComparison.truncated) return incrementalFromDelta({
+		current: input.current,
+		fullFiles: input.fullFiles,
+		profileFingerprint: input.profileFingerprint,
+		priorState: input.priorState,
+		deltaFiles: contentComparison.files,
+		reason: `rewritten history; contents changed since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}`
 	});
+	if (comparison === void 0) return full("the incremental head comparison was unavailable");
+	if (comparison.truncated) return full("the incremental comparison exceeded GitHub's file bound");
+	return full("the prior reviewed head is not an ancestor of the current head");
 };
-//#endregion
-//#region src/internal/review-units.ts
-/** The delegation fan-out bound: one parent Run spawns at most this many children. */
-const MAX_REVIEW_UNITS = 8;
-/** A unit never carries more files than this, regardless of their size. */
-const MAX_UNIT_FILES = 12;
-/** Compatibility export; complete evidence chars now own unit packing. */
-const UNIT_CHANGED_LINE_BUDGET = 800;
+/** Per-run context consumed by orchestration and publication, not by the model. */
+var ReviewExecutionContext = class extends Context.Service()("@effect-agent/pr-review/ReviewExecutionContext") {};
 /**
-* Bound the complete model-visible evidence assigned to one child. This is a
-* character bound rather than a token estimate because it is deterministic,
-* provider-independent, and enforced before any model call.
+* Explicit direct-run adapter for callers that intentionally review the full
+* source without authenticated incremental continuity.
 */
-const UNIT_EVIDENCE_CHAR_BUDGET = 24e4;
-/** Maximum complete evidence shards placed in one child brief. */
-const MAX_UNIT_EVIDENCE_SHARDS = 12;
+const fullReviewExecutionContextLayer = (reason) => Layer.effect(ReviewExecutionContext, Effect.gen(function* () {
+	const source = yield* PullRequestSource;
+	const [metadata, files] = yield* Effect.all([source.metadata, source.changedFiles]);
+	return fullReviewSelection({
+		reason,
+		files,
+		totalFiles: metadata.totalChangedFiles
+	});
+}));
 /**
-* Keep overflow diagnostics bounded to one plan's total assignment capacity.
-* The plan separately records the exact overflow count and every affected
-* path, so identifiers are a deterministic diagnostic sample rather than the
-* authority for whether input coverage is complete.
+* Decorate the full source with the selected review range. Full anchor files
+* remain available to host-side publication validation; model tools see only
+* the selected delta and may read head context only for that delta's paths.
 */
-const MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS = 96;
-/** @deprecated Use `MAX_PATCH_CHARS`; this is now the per-shard bound. */
-const MAX_FILE_EVIDENCE_CHARS = MAX_PATCH_CHARS;
-/** The merged review never exceeds the `CodeReview` findings bound. */
-const MAX_MERGED_FINDINGS = 20;
-const ReviewUnitId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
-/** High-risk surfaces that receive an explicit specialist focus label. */
-const ReviewRiskCategory = Schema.Literals([
-	"authentication-authorization",
-	"security-boundary",
-	"persistence-durability",
-	"concurrency",
-	"credential-handling",
-	"external-side-effects"
-]);
-const ReviewDiscoveryPerspective = Schema.Literals(["general", "risk-specialist"]);
-const ReviewPassId = Schema.NonEmptyString.check(Schema.isMaxLength(64));
-const ReviewEvidenceShardId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
-/** One complete bounded slice of a changed path's model-visible evidence. */
-var ReviewEvidenceShard = class extends Schema.Class("@effect-agent/pr-review/ReviewEvidenceShard")({
-	shardId: ReviewEvidenceShardId,
-	path: ChangedPath,
-	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(MAX_PATCH_CHARS))
-}) {};
-const EvidenceShardIds$1 = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-/** One required, independently scoped discovery attempt. */
-var ReviewDiscoveryPass = class extends Schema.Class("@effect-agent/pr-review/ReviewDiscoveryPass")({
-	passId: ReviewPassId,
-	unitId: ReviewUnitId,
-	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	evidenceShardIds: EvidenceShardIds$1,
-	perspective: ReviewDiscoveryPerspective,
-	/** Empty for the general pass; explicit deterministic focus for specialists. */
-	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
-}) {};
-/** One bounded slice of the changeset delegated to one child reviewer. */
-var ReviewUnit = class extends Schema.Class("@effect-agent/pr-review/ReviewUnit")({
-	unitId: ReviewUnitId,
-	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	evidenceShards: Schema.Array(ReviewEvidenceShard).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
-	/** additions + deletions across the unit's files, for honest sizing. */
-	changedLines: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Complete model-visible diff/content evidence assigned to each child. */
-	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(UNIT_EVIDENCE_CHAR_BUDGET)),
-	/** Host-classified focus labels for the unit's redundant specialist pass. */
-	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
+const selectedPullRequestSourceLayer = (selection) => Layer.effect(PullRequestSource)(Effect.gen(function* () {
+	const source = yield* PullRequestSource;
+	const selectedPaths = new Set(selection.files.map((file) => file.path));
+	const selectedFiles = source.changedFiles.pipe(Effect.map((fullFiles) => {
+		const fullByPath = new Map(fullFiles.map((file) => [file.path, file]));
+		return selection.files.map((file) => {
+			if (file.patch !== void 0) return file;
+			const full = fullByPath.get(file.path);
+			return full === void 0 ? file : ChangedFile.make({
+				...file,
+				...full.reviewBaseContent === void 0 ? {} : { reviewBaseContent: full.reviewBaseContent },
+				...full.reviewHeadContent === void 0 ? {} : { reviewHeadContent: full.reviewHeadContent }
+			});
+		});
+	}));
+	return PullRequestSource.of({
+		metadata: source.metadata,
+		changedFiles: selectedFiles,
+		anchorFiles: source.anchorFiles,
+		readFile: (path) => selectedPaths.has(path) ? source.readFile(path) : Effect.fail(ReviewInputViolation.make({
+			input: path,
+			reason: "Path is outside this incremental review range."
+		}))
+	});
+}));
+/** Build the full-surface mission used only to resolve profile guidance. */
+const buildProfileMission = (metadata, files) => ReviewMission.make({
+	repository: metadata.repository,
+	number: metadata.number,
+	title: metadata.title,
+	body: metadata.body,
+	baseRef: metadata.baseRef,
+	headRef: metadata.headRef,
+	changedFileCount: files.length
+});
+//#endregion
+//#region src/internal/retirement.ts
+const PositiveLine$1 = Schema.Int.check(Schema.isGreaterThan(0));
+/** One previously posted review as observed through the retirement host. */
+var RetirableReview = class extends Schema.Class("@effect-agent/pr-review/RetirableReview")({
+	reviewId: Schema.Int.check(Schema.isGreaterThan(0)),
+	body: Schema.String.check(Schema.isMaxLength(6e4)),
+	commitSha: Schema.NonEmptyString.check(Schema.isMaxLength(64)),
+	authorNodeId: Schema.NullOr(Schema.NonEmptyString.check(Schema.isMaxLength(200))),
+	submittedAt: Schema.NullOr(Schema.DateTimeUtc)
 }) {};
-/** The complete deterministic fan-out plan over one changeset. */
-var ReviewUnitPlan = class extends Schema.Class("@effect-agent/pr-review/ReviewUnitPlan")({
-	totalFiles: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** True when the source returned fewer files than the pull request has. */
-	truncated: Schema.Boolean,
-	units: Schema.Array(ReviewUnit).check(Schema.isMaxLength(8)),
-	/** Exact discovery calls the coordinator must make. */
-	discoveryPasses: Schema.Array(ReviewDiscoveryPass).check(Schema.isMaxLength(16)),
-	/** Changed files with neither a textual diff nor bounded base/head text. */
-	undiffablePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
-	/** Assigned paths with one or more evidence shards beyond plan capacity. */
-	partialEvidencePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
-	/** Exact number of shards beyond the bounded unit capacity. */
-	unassignedEvidenceShardCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Bounded deterministic prefix of the unassigned shard identifiers. */
-	unassignedEvidenceShardIds: Schema.Array(ReviewEvidenceShardId).check(Schema.isMaxLength(96)),
-	/**
-	* Diffable files beyond the fan-out capacity (MAX_REVIEW_UNITS units of
-	* MAX_UNIT_FILES files). Never silently dropped: the coordinator must name
-	* them as unreviewed in its summary.
-	*/
-	unassignedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300))
+/** One inline comment attached to a previously posted review. */
+var RetirableReviewComment = class extends Schema.Class("@effect-agent/pr-review/RetirableReviewComment")({
+	nodeId: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
+	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
+	startLine: Schema.NullOr(PositiveLine$1),
+	endLine: Schema.NullOr(PositiveLine$1),
+	body: Schema.String.check(Schema.isMaxLength(65536))
 }) {};
-const riskRules = [
-	{
-		category: "authentication-authorization",
-		patterns: [
-			/auth/,
-			/authoriz/,
-			/permission/,
-			/principal/,
-			/access[-_ ]?control/,
-			/role\b/
-		]
-	},
-	{
-		category: "security-boundary",
-		patterns: [
-			/security/,
-			/sandbox/,
-			/untrusted/,
-			/schema\.decode/,
-			/validation/,
-			/injection/,
-			/csrf/,
-			/xss/,
-			/path traversal/
-		]
-	},
-	{
-		category: "persistence-durability",
-		patterns: [
-			/durab/,
-			/persist/,
-			/storage/,
-			/database/,
-			/\bsql\b/,
-			/journal/,
-			/ledger/,
-			/checkpoint/,
-			/migration/,
-			/transaction/
-		]
-	},
-	{
-		category: "concurrency",
-		patterns: [
-			/concurr/,
-			/semaphore/,
-			/\bfiber/,
-			/race/,
-			/mutex/,
-			/\block\b/,
-			/queue/,
-			/parallel/,
-			/interrupt/
-		]
-	},
-	{
-		category: "credential-handling",
-		patterns: [
-			/credential/,
-			/secret/,
-			/password/,
-			/api[-_ ]?key/,
-			/bearer/,
-			/hmac/,
-			/signature/
-		]
-	},
-	{
-		category: "external-side-effects",
-		patterns: [
-			/publish/,
-			/webhook/,
-			/github/,
-			/fetch\(/,
-			/http/,
-			/send[-_ ]?(email|message)/,
-			/write[-_ ]?(file|record)/,
-			/delete/,
-			/mutation/,
-			/side[-_ ]?effect/,
-			/spawn/,
-			/exec/
-		]
+/** A GitHub retirement read or mutation failed. */
+var ReviewRetirementFailure = class extends Schema.TaggedError()("ReviewRetirementFailure", {
+	operation: Schema.String,
+	reason: Schema.String
+}) {
+	get message() {
+		return `Review retirement operation '${this.operation}' failed: ${this.reason}`;
 	}
-];
+};
 /**
-* Deterministic host policy for specialist assignment. It intentionally
-* favors false positives: an extra bounded pass costs work, while a missed
-* high-risk classification removes redundancy. This is not a claim that the
-* keyword policy recognizes every semantically risky change.
+* Host-side GitHub operations used by retirement. Domain code never reaches
+* into REST or GraphQL directly, and deterministic tests substitute this port.
 */
-const classifyReviewRisks = (file) => {
-	const text = [
-		file.path,
-		file.previousPath ?? "",
-		file.patch ?? "",
-		file.reviewBaseContent ?? "",
-		file.reviewHeadContent ?? ""
-	].join("\n").toLowerCase();
-	return riskRules.filter((rule) => rule.patterns.some((pattern) => pattern.test(text))).map((rule) => rule.category);
-};
+var ReviewRetirementHost = class extends Context.Service()("@effect-agent/pr-review/ReviewRetirementHost") {};
+/** Observable cosmetic work completed by one fail-open retirement pass. */
+var ReviewRetirementReport = class extends Schema.Class("@effect-agent/pr-review/ReviewRetirementReport")({
+	reviewsRetired: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	findingsResolved: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	commentsMinimized: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	failures: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+const REVIEW_METADATA_PATTERN = /<!-- effect-agent-pr-review metadata\n[\s\S]*?\n-->/g;
+const FINGERPRINT_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:[0-9a-f]{64} -->/g;
+const STATE_PATTERN = /<!-- effect-agent-pr-review state-v1:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
+const RETIRED_ORIGINAL_PATTERN = /<!-- effect-agent-pr-review retired-original:start -->\n([\s\S]*?)\n<!-- effect-agent-pr-review retired-original:end -->/;
+const MACHINE_COMMENT_PATTERN = new RegExp(`${REVIEW_METADATA_PATTERN.source}|${FINGERPRINT_PATTERN.source}|${STATE_PATTERN.source}`, "g");
+const VERDICT_CALLOUT_PATTERN = /^(?:> \[!(?:CAUTION|IMPORTANT)\]\n> [^\n]*(?:\n> [^\n]*)*|> (?:ℹ️|✅)[^\n]*)\n*/;
 /**
-* Whether every claimed finding anchor was present in the exact bounded
-* evidence shards assigned to one unit. This is stricter than checking the
-* full pull-request diff when an oversized path spans multiple units.
+* The first line of every inline finding comment this package posts. Shared
+* with adjudication so both parse the identical title shape.
 */
-const findingAnchorInUnitEvidence = (finding, unit, files) => {
-	const file = files.find((candidate) => candidate.path === finding.path);
-	if (file?.patch === void 0 || finding.endLine < finding.startLine) return false;
-	const assignedOrdinals = new Set(unit.evidenceShards.filter((shard) => shard.path === finding.path).map((shard) => shard.ordinal));
-	const visibleLines = /* @__PURE__ */ new Set();
-	const chunks = fileReviewEvidenceChunks(file);
-	for (let index = 0; index < chunks.length; index += 1) {
-		if (!assignedOrdinals.has(index + 1)) continue;
-		for (const line of chunks[index]?.annotatedPatch.split("\n") ?? []) {
-			const match = /^R(\d+) /.exec(line);
-			if (match?.[1] !== void 0) visibleLines.add(Number(match[1]));
-		}
-	}
-	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!visibleLines.has(line)) return false;
-	return true;
-};
-const uniquePaths = (shards) => [...new Set(shards.map(({ shard }) => shard.path))];
-const plannedEvidenceShards = (files) => {
-	const planned = [];
-	let shardIndex = 0;
-	for (const file of files) {
-		const chunks = fileReviewEvidenceChunks(file);
-		for (let index = 0; index < chunks.length; index += 1) {
-			const chunk = chunks[index];
-			if (chunk === void 0) continue;
-			shardIndex += 1;
-			planned.push({
-				shard: ReviewEvidenceShard.make({
-					shardId: `shard-${String(shardIndex).padStart(4, "0")}`,
-					path: file.path,
-					ordinal: index + 1,
-					total: chunks.length,
-					evidenceChars: chunk.annotatedPatch.length
-				}),
-				file,
-				changedLines: index === 0 ? file.additions + file.deletions : 0
-			});
-		}
-	}
-	return planned;
+const INLINE_FINDING_TITLE_PATTERN = /^\*\*\[(?:🛑 blocking|⚠️ important|💅 nit) · [a-z-]+\] ([^\n]+)\*\*$/;
+const MAX_REVIEW_BODY_CHARS = 6e4;
+/** The host-authored metadata marker is the authority gate for any edit. */
+const hasReviewMetadataMarker = (body) => /<!-- effect-agent-pr-review metadata\n/.test(body);
+const machineComments = (body) => Array.from(body.matchAll(MACHINE_COMMENT_PATTERN), (match) => match[0]);
+const originalVisibleBody = (body) => {
+	const retired = RETIRED_ORIGINAL_PATTERN.exec(body)?.[1];
+	if (retired !== void 0) return retired;
+	return body.replace(MACHINE_COMMENT_PATTERN, "").trim().replace(VERDICT_CALLOUT_PATTERN, "");
+};
+const findingLocation = (finding) => `${finding.path}:${finding.startLine}${finding.endLine === finding.startLine ? "" : `-${finding.endLine}`}`;
+const renderRetiredBody = (input) => {
+	const shortSha = input.currentState.reviewedHeadSha.slice(0, 7);
+	const comments = machineComments(input.priorBody);
+	const original = originalVisibleBody(input.priorBody);
+	const resolved = input.resolvedFindings.length === 0 ? [] : [
+		"### Findings resolved by later review",
+		"",
+		...input.resolvedFindings.map((finding) => `- \`${findingLocation(finding)}\` ~~${finding.title}~~ · resolved at \`${shortSha}\``),
+		""
+	];
+	const prefix = [
+		`> ℹ️ Superseded — ${input.resolvedFindings.length} of ${input.priorState.unresolvedFindings.length} findings resolved at \`${shortSha}\`; see [the latest review](${input.currentReviewUrl}).`,
+		"",
+		"<details>",
+		"<summary>Previous review details</summary>",
+		"",
+		...resolved,
+		"<!-- effect-agent-pr-review retired-original:start -->"
+	];
+	const suffix = [
+		"<!-- effect-agent-pr-review retired-original:end -->",
+		"",
+		"</details>",
+		...comments.length === 0 ? [] : ["", ...comments]
+	];
+	const render = (visible) => [
+		...prefix,
+		visible,
+		...suffix
+	].join("\n");
+	if (render(original).length <= MAX_REVIEW_BODY_CHARS) return render(original);
+	const truncationNotice = "\n\n_Original review content truncated during retirement._";
+	const budget = Math.max(0, MAX_REVIEW_BODY_CHARS - render(truncationNotice).length);
+	return render(`${original.slice(0, budget)}${truncationNotice}`);
+};
+/** Compute one prior review's resolved subset and deterministic retired body. */
+const decideReviewRetirement = (input) => {
+	const current = new Set(input.currentState.unresolvedFindings.map(findingIdentity));
+	const adjudicated = new Set((input.currentState.adjudications ?? []).map((entry) => adjudicationIdentity(entry)));
+	const resolvedFindings = input.priorState.unresolvedFindings.filter((finding) => !current.has(findingIdentity(finding)) && !adjudicated.has(findingIdentity(finding)));
+	return {
+		body: renderRetiredBody({
+			...input,
+			resolvedFindings
+		}),
+		resolvedFindings,
+		priorFindingCount: input.priorState.unresolvedFindings.length
+	};
+};
+const inlineCommentIdentity = (comment) => {
+	if (comment.startLine === null || comment.endLine === null) return void 0;
+	const firstLine = comment.body.split("\n", 1)[0] ?? "";
+	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine)?.[1];
+	return title === void 0 ? void 0 : findingIdentity({
+		path: comment.path,
+		startLine: comment.startLine,
+		endLine: comment.endLine,
+		title
+	});
+};
+const failOpen = (effect, fallback, message) => effect.pipe(Effect.catch((error) => Effect.logWarning(`${message}: ${String(error)}`).pipe(Effect.as(fallback))));
+const isStrictlyOlderReview = (review, input) => {
+	if (review.submittedAt === null) return false;
+	const submittedAt = DateTime.toEpochMillis(review.submittedAt);
+	const currentSubmittedAt = DateTime.toEpochMillis(input.currentSubmittedAt);
+	return submittedAt < currentSubmittedAt || submittedAt === currentSubmittedAt && review.reviewId < input.currentReviewId;
 };
-const unitOf = (index, shards) => ReviewUnit.make({
-	unitId: `unit-${String(index + 1).padStart(3, "0")}`,
-	paths: uniquePaths(shards),
-	evidenceShards: shards.map(({ shard }) => shard),
-	changedLines: shards.reduce((total, shard) => total + shard.changedLines, 0),
-	evidenceChars: shards.reduce((total, { shard }) => total + shard.evidenceChars, 0),
-	riskCategories: [...new Set(shards.flatMap(({ file }) => classifyReviewRisks(file)))]
-});
-const discoveryPassesFor = (units) => units.flatMap((unit) => [ReviewDiscoveryPass.make({
-	passId: `${unit.unitId}-general`,
-	unitId: unit.unitId,
-	paths: unit.paths,
-	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-	perspective: "general",
-	riskCategories: []
-}), ReviewDiscoveryPass.make({
-	passId: `${unit.unitId}-specialist`,
-	unitId: unit.unitId,
-	paths: unit.paths,
-	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-	perspective: "risk-specialist",
-	riskCategories: unit.riskCategories
-})]);
 /**
-* Group the changeset into at most `MAX_REVIEW_UNITS` review units.
-*
-* Deterministic by construction: files are ordered by path (so files sharing
-* a directory become neighbors — directory affinity without a heuristic),
-* then split into complete line-bounded evidence shards and packed greedily
-* under the hard evidence and per-unit shard bounds. Capacity is finite and
-* explicit:
-*
-* - files without a textual diff are still delegated when the source
-*   recovered complete bounded UTF-8 base/head content. Findings from that
-*   evidence cannot anchor inline and are reported as concerns;
-* - files with neither form of textual evidence surface in
-*   `undiffablePaths` instead of laundering missing coverage;
-* - an oversized path spans as many deterministic shards and units as needed;
-* - shards beyond `MAX_REVIEW_UNITS` full units surface explicitly, so a path
-*   is partial only when finite plan capacity is genuinely exhausted.
+* Retire every marker-bearing prior review against the newest posted state.
+* Every lookup, edit, and minimization is isolated: retirement is cosmetic
+* and can never change the run or check outcome.
 */
-const planReviewUnits = (files, options) => {
-	const ordered = [...files].sort((left, right) => left.path < right.path ? -1 : 1);
-	const reviewable = ordered.filter(isReviewableFile);
-	const undiffable = ordered.filter((file) => !isReviewableFile(file));
-	const shards = plannedEvidenceShards(reviewable);
-	const groups = [];
-	const unassigned = [];
-	let current = [];
-	let currentEvidenceChars = 0;
-	for (const shard of shards) {
-		const nextPaths = /* @__PURE__ */ new Set([...uniquePaths(current), shard.shard.path]);
-		if (current.length >= 12 || nextPaths.size > 12 || current.length > 0 && currentEvidenceChars + shard.shard.evidenceChars > 24e4) {
-			groups.push(current);
-			current = [];
-			currentEvidenceChars = 0;
-		}
-		if (groups.length >= 8) {
-			unassigned.push(shard);
+const retireStaleReviews = Effect.fn("retireStaleReviews")(function* (input) {
+	const host = yield* ReviewRetirementHost;
+	const authenticator = yield* ReviewStateAuthenticator;
+	if (authenticator.status !== "available") {
+		yield* Effect.logWarning("Skipping stale-review retirement because authenticated review state is unavailable.");
+		return ReviewRetirementReport.make({
+			reviewsRetired: 0,
+			findingsResolved: 0,
+			commentsMinimized: 0,
+			failures: 0
+		});
+	}
+	let failures = 0;
+	let reviewsRetired = 0;
+	let findingsResolved = 0;
+	let commentsMinimized = 0;
+	const reviews = yield* failOpen(host.listReviews, void 0, "Could not list prior reviews");
+	if (reviews === void 0) return ReviewRetirementReport.make({
+		reviewsRetired,
+		findingsResolved,
+		commentsMinimized,
+		failures: 1
+	});
+	for (const review of reviews) {
+		if (review.authorNodeId !== input.currentAuthorNodeId || !isStrictlyOlderReview(review, input) || !hasReviewMetadataMarker(review.body)) continue;
+		const priorState = yield* failOpen(authenticator.extract(review.body), Option.none(), `Could not authenticate prior review ${review.reviewId}`);
+		if (Option.isNone(priorState)) continue;
+		const decision = decideReviewRetirement({
+			priorBody: review.body,
+			priorState: priorState.value,
+			currentState: input.currentState,
+			currentReviewUrl: input.currentReviewUrl
+		});
+		if (yield* failOpen(host.updateBody(review.reviewId, decision.body).pipe(Effect.as(true)), false, `Could not retire prior review ${review.reviewId}`)) {
+			reviewsRetired += 1;
+			findingsResolved += decision.resolvedFindings.length;
+		} else failures += 1;
+		if (decision.resolvedFindings.length === 0) continue;
+		const comments = yield* failOpen(host.listComments(review.reviewId), void 0, `Could not list inline comments for prior review ${review.reviewId}`);
+		if (comments === void 0) {
+			failures += 1;
 			continue;
 		}
-		current.push(shard);
-		currentEvidenceChars += shard.shard.evidenceChars;
+		const resolved = new Set(decision.resolvedFindings.map(findingIdentity));
+		for (const comment of comments) {
+			const identity = inlineCommentIdentity(comment);
+			if (identity === void 0 || !resolved.has(identity)) continue;
+			if (yield* failOpen(host.minimizeComment(comment.nodeId).pipe(Effect.as(true)), false, `Could not minimize resolved inline comment ${comment.nodeId}`)) commentsMinimized += 1;
+			else failures += 1;
+		}
 	}
-	if (current.length > 0 && groups.length < 8) groups.push(current);
-	const units = groups.map((group, index) => unitOf(index, group));
-	const assignedShardIds = new Set(units.flatMap((unit) => unit.evidenceShards.map((shard) => shard.shardId)));
-	const assignedPaths = new Set(shards.filter(({ shard }) => assignedShardIds.has(shard.shardId)).map(({ shard }) => shard.path));
-	const unassignedPathsWithEvidence = new Set(unassigned.map(({ shard }) => shard.path));
-	return ReviewUnitPlan.make({
-		totalFiles: files.length,
-		truncated: files.length < options.totalChangedFiles,
-		units,
-		discoveryPasses: discoveryPassesFor(units),
-		undiffablePaths: undiffable.map((file) => file.path),
-		partialEvidencePaths: [...unassignedPathsWithEvidence].filter((path) => assignedPaths.has(path)),
-		unassignedEvidenceShardCount: unassigned.length,
-		unassignedEvidenceShardIds: unassigned.slice(0, 96).map(({ shard }) => shard.shardId),
-		unassignedPaths: [...unassignedPathsWithEvidence].filter((path) => !assignedPaths.has(path))
+	return ReviewRetirementReport.make({
+		reviewsRetired,
+		findingsResolved,
+		commentsMinimized,
+		failures
 	});
+});
+//#endregion
+//#region src/internal/adjudication.ts
+const PositiveLine = Schema.Int.check(Schema.isGreaterThan(0));
+/** Maximum authorized command candidates retained for one inline thread. */
+const MAX_THREAD_ADJUDICATION_COMMANDS = 100;
+/** One reply or top-level comment observed through the adjudication host. */
+var AdjudicationComment = class extends Schema.Class("@effect-agent/pr-review/AdjudicationComment")({
+	body: Schema.String.check(Schema.isMaxLength(65536)),
+	/** GitHub's author_association for the comment author, verbatim. */
+	authorAssociation: Schema.String.check(Schema.isMaxLength(40)),
+	authorLogin: Schema.NonEmptyString.check(Schema.isMaxLength(100)),
+	/** Creation time; a comment without one loses every later-wins tie. */
+	createdAt: Schema.NullOr(Schema.DateTimeUtc),
+	/** Stable zero-based order in the source listing, before thread grouping. */
+	sourceOrder: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+/** One of the action's own inline finding threads, replies in creation order. */
+var AdjudicableThread = class extends Schema.Class("@effect-agent/pr-review/AdjudicableThread")({
+	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
+	startLine: Schema.NullOr(PositiveLine),
+	endLine: Schema.NullOr(PositiveLine),
+	/** The root comment's body; its first line carries the finding title. */
+	rootBody: Schema.String.check(Schema.isMaxLength(65536)),
+	replies: Schema.Array(AdjudicationComment).check(Schema.isMaxLength(100))
+}) {};
+/** A GitHub adjudication read failed. */
+var ReviewAdjudicationFailure = class extends Schema.TaggedError()("ReviewAdjudicationFailure", {
+	operation: Schema.String,
+	reason: Schema.String
+}) {
+	get message() {
+		return `Review adjudication operation '${this.operation}' failed: ${this.reason}`;
+	}
 };
-const severityRank = {
-	blocking: 0,
-	important: 1,
-	nit: 2
+/**
+* Host-side GitHub reads used by adjudication. Domain code never reaches into
+* REST directly, and deterministic tests substitute this port. Both listings
+* return comments in creation order.
+*/
+var ReviewAdjudicationHost = class extends Context.Service()("@effect-agent/pr-review/ReviewAdjudicationHost") {};
+/** Explicit program-edge adapter for runs that intentionally perform no host reads. */
+const noReviewAdjudicationHost = ReviewAdjudicationHost.of({
+	listFindingThreads: Effect.succeed([]),
+	listIssueComments: Effect.succeed([])
+});
+/** Layer form of {@link noReviewAdjudicationHost}. */
+const noReviewAdjudicationHostLayer = Layer.succeed(ReviewAdjudicationHost)(noReviewAdjudicationHost);
+/** author_associations allowed to adjudicate; everything else is ignored. */
+const AUTHORIZED_ADJUDICATION_ASSOCIATIONS = /* @__PURE__ */ new Set([
+	"OWNER",
+	"MEMBER",
+	"COLLABORATOR"
+]);
+const AdjudicationDispositionSchema = Schema.Literals([
+	"accepted-risk",
+	"refuted",
+	"obsolete"
+]);
+const THREAD_COMMAND_PATTERN = /^\/adjudicate[ \t]+([a-z-]+)[ \t]*(?::[ \t]*(.*\S))?[ \t]*$/;
+const ISSUE_COMMAND_PATTERN = /^\/adjudicate[ \t]+([a-z-]+)[ \t]+"([^"\n]+)"[ \t]*(?::[ \t]*(.*\S))?[ \t]*$/;
+const firstLine = (body) => (body.split("\n", 1)[0] ?? "").trim();
+const boundedReason = (raw) => {
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim().slice(0, 300);
+	return trimmed.length === 0 ? void 0 : trimmed;
 };
-const anchorKey = (finding) => `${finding.path} ${finding.startLine} ${finding.endLine}`;
 /**
-* Merge the children's findings into one bounded, deterministic list: dedupe
-* findings sharing an anchor (path + line range) keeping the most severe —
-* and, at equal severity, the first in declaration order — then rank by
-* severity, path, and line, and cap at the `CodeReview` findings bound.
-* This is the merge policy the coordinator's instructions state in prose;
-* pinning it here keeps the policy itself deterministic and testable.
+* Parse one inline-thread reply: `/adjudicate <disposition>(: <reason>)?`.
+* The thread itself names the target identity. Returns undefined for a
+* non-command body and "malformed" for a command that fails the grammar.
 */
-const rankAndDedupeFindings = (findings) => {
-	const byAnchor = /* @__PURE__ */ new Map();
-	for (const finding of findings) {
-		const key = anchorKey(finding);
-		const existing = byAnchor.get(key);
-		if (existing === void 0 || severityRank[finding.severity] < severityRank[existing.severity]) byAnchor.set(key, finding);
-	}
-	return [...byAnchor.values()].sort((left, right) => {
-		const bySeverity = severityRank[left.severity] - severityRank[right.severity];
-		if (bySeverity !== 0) return bySeverity;
-		if (left.path !== right.path) return left.path < right.path ? -1 : 1;
-		return left.startLine - right.startLine;
-	}).slice(0, 20);
+const parseThreadAdjudication = (body) => {
+	const line = firstLine(body);
+	if (!line.startsWith("/adjudicate")) return void 0;
+	const match = THREAD_COMMAND_PATTERN.exec(line);
+	const disposition = match?.[1];
+	if (disposition === void 0 || !Schema.is(AdjudicationDispositionSchema)(disposition)) return "malformed";
+	return {
+		disposition,
+		reason: boundedReason(match?.[2])
+	};
 };
 /**
-* The concern analogue of `rankAndDedupeFindings`: dedupe by exact content
-* keeping the most severe duplicate, rank by severity, and cap at the
-* `CodeReview` concerns bound.
+* Parse one top-level PR comment:
+* `/adjudicate <disposition> "<exact title>"(: <reason>)?`. The quoted title
+* is required because the conversation names no finding thread; it targets
+* the title-alone identity of an unanchored concern.
 */
-const rankAndDedupeConcerns = (concerns) => {
-	const byContent = /* @__PURE__ */ new Map();
-	for (const concern of concerns) {
-		const key = `${concern.title}\u0000${concern.body}`;
-		const previous = byContent.get(key);
-		if (previous === void 0 || severityRank[concern.severity] < severityRank[previous.severity]) byContent.set(key, concern);
+const parseIssueAdjudication = (body) => {
+	const line = firstLine(body);
+	if (!line.startsWith("/adjudicate")) return void 0;
+	const match = ISSUE_COMMAND_PATTERN.exec(line);
+	const disposition = match?.[1];
+	const title = match?.[2];
+	if (disposition === void 0 || !Schema.is(AdjudicationDispositionSchema)(disposition) || title === void 0 || title.length > 120) return "malformed";
+	return {
+		disposition,
+		title,
+		reason: boundedReason(match?.[3])
+	};
+};
+/** The finding identity an inline thread names, or undefined when unparsable. */
+const threadFindingTarget = (thread) => {
+	if (thread.startLine === null || thread.endLine === null) return void 0;
+	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine(thread.rootBody))?.[1];
+	if (title === void 0 || title.length > 120) return void 0;
+	return {
+		path: thread.path,
+		startLine: thread.startLine,
+		endLine: thread.endLine,
+		title
+	};
+};
+/**
+* Derive the standing adjudications from the host's listings. Every command
+* is screened fail-closed (authorization, grammar, a parsable target); later
+* adjudications of the same identity win by comment creation order; the
+* result is capped at the ReviewState bound dropping the oldest winners.
+*/
+const deriveAdjudications = (input) => {
+	const candidates = [];
+	const ignored = [];
+	const admit = (comment, command, target) => {
+		candidates.push({
+			adjudication: StoredAdjudication.make({
+				...target.path === void 0 ? {} : { path: target.path },
+				...target.startLine === void 0 ? {} : { startLine: target.startLine },
+				...target.endLine === void 0 ? {} : { endLine: target.endLine },
+				title: target.title,
+				disposition: command.disposition,
+				...command.reason === void 0 ? {} : { reason: command.reason },
+				actor: comment.authorLogin
+			}),
+			epochMillis: comment.createdAt === null ? -1 : DateTime.toEpochMillis(comment.createdAt),
+			sourceOrder: comment.sourceOrder
+		});
+	};
+	const authorized = (comment, surface) => {
+		if (AUTHORIZED_ADJUDICATION_ASSOCIATIONS.has(comment.authorAssociation)) return true;
+		ignored.push(`${surface}: unauthorized /adjudicate from @${comment.authorLogin} (${comment.authorAssociation})`);
+		return false;
+	};
+	for (const thread of input.threads) {
+		const target = threadFindingTarget(thread);
+		for (const reply of thread.replies) {
+			const command = parseThreadAdjudication(reply.body);
+			if (command === void 0) continue;
+			const surface = `inline thread ${thread.path}`;
+			if (command === "malformed") {
+				ignored.push(`${surface}: malformed /adjudicate command from @${reply.authorLogin}`);
+				continue;
+			}
+			if (!authorized(reply, surface)) continue;
+			if (target === void 0) {
+				ignored.push(`${surface}: thread root names no parsable finding title`);
+				continue;
+			}
+			admit(reply, command, target);
+		}
 	}
-	return [...byContent.values()].sort((left, right) => severityRank[left.severity] - severityRank[right.severity]).slice(0, 10);
+	for (const comment of input.issueComments) {
+		const command = parseIssueAdjudication(comment.body);
+		if (command === void 0) continue;
+		const surface = "pull-request conversation";
+		if (command === "malformed") {
+			ignored.push(`${surface}: malformed /adjudicate command from @${comment.authorLogin}`);
+			continue;
+		}
+		if (!authorized(comment, surface)) continue;
+		if (command.title === void 0) {
+			ignored.push(`${surface}: /adjudicate without a quoted target title`);
+			continue;
+		}
+		admit(comment, command, { title: command.title });
+	}
+	const byIdentity = /* @__PURE__ */ new Map();
+	const ordered = [...candidates].sort((left, right) => left.epochMillis - right.epochMillis || left.sourceOrder - right.sourceOrder);
+	for (const candidate of ordered) {
+		const identity = adjudicationIdentity(candidate.adjudication);
+		byIdentity.delete(identity);
+		byIdentity.set(identity, candidate);
+	}
+	const winners = [...byIdentity.values()];
+	const droppedOldest = Math.max(0, winners.length - 20);
+	return {
+		adjudications: winners.slice(droppedOldest).map((candidate) => candidate.adjudication),
+		ignored,
+		droppedOldest
+	};
+};
+/** Later-wins merge of stored prior adjudications with freshly derived ones. */
+const mergeAdjudications = (prior, fresh) => {
+	const byIdentity = /* @__PURE__ */ new Map();
+	for (const adjudication of [...prior, ...fresh]) {
+		const identity = adjudicationIdentity(adjudication);
+		byIdentity.delete(identity);
+		byIdentity.set(identity, adjudication);
+	}
+	const merged = [...byIdentity.values()];
+	return merged.slice(Math.max(0, merged.length - 20));
 };
-//#endregion
-//#region src/internal/fan-out.ts
-/** One discovery pass returns at most this many anchored candidates. */
-const MAX_CHILD_FINDINGS = 6;
-/** One discovery pass returns at most this many non-anchored candidates. */
-const MAX_CHILD_CONCERNS = 3;
-/** Every unit receives independent general and specialist discovery passes. */
-const MAX_UNIT_CANDIDATES = 18;
 /**
-* General + specialist discovery for every unit, then one verifier per unit.
-* The one-retry budget doubles the worst-case child Run count, but the
-* schedule itself never exceeds this bound.
+* Collect the standing maintainer adjudications: freshly derived through the
+* host, merged later-wins over the prior state's stored set. The host is a
+* visible Effect requirement; program edges that intentionally perform no
+* reads provide {@link noReviewAdjudicationHost}. Fail-open — any listing
+* fault keeps the complete prior set and never fails the review, because NOT
+* suppressing a finding is the conservative direction.
 */
-const MAX_REVIEW_CHILDREN = 24;
-/** Bounded structured concurrency across units; passes inside a unit are sequential. */
-const REVIEW_UNIT_CONCURRENCY = 4;
-/** Structural minimum for a child that exposes no tools. */
-const MAX_FILE_REVIEW_TOOL_CALLS = 1;
-const ReviewWorkPhase = Schema.Literals(["discovery", "verification"]);
-const ReviewWorkPerspective = Schema.Literals([
-	"general",
-	"risk-specialist",
-	"candidate-verification"
-]);
-const ReviewCandidateId = Schema.NonEmptyString.check(Schema.isMaxLength(96));
-var FindingCandidate = class extends Schema.TaggedClass()("FindingCandidate", {
-	candidateId: ReviewCandidateId,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	finding: ReviewFinding,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(1))
-}) {};
-var ConcernCandidate = class extends Schema.TaggedClass()("ConcernCandidate", {
-	candidateId: ReviewCandidateId,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	concern: ReviewConcern,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
-}) {};
-const ReviewCandidate = Schema.Union([FindingCandidate, ConcernCandidate]);
-/** Deterministic host equivalence for claims repeated across discovery passes. */
-const reviewCandidateSubjectKey = (candidate) => candidate._tag === "FindingCandidate" ? `finding:${JSON.stringify(Schema.encodeSync(ReviewFinding)(candidate.finding))}` : `concern:${JSON.stringify(Schema.encodeSync(ReviewConcern)(candidate.concern))}`;
-var CandidateAssessment = class extends Schema.Class("@effect-agent/pr-review/CandidateAssessment")({
-	candidateId: ReviewCandidateId,
-	disposition: Schema.Literals(["confirmed", "rejected"]),
+const collectReviewAdjudications = Effect.fn("collectReviewAdjudications")(function* (prior) {
+	const host = yield* ReviewAdjudicationHost;
+	const listings = yield* Effect.all({
+		threads: host.listFindingThreads,
+		issueComments: host.listIssueComments
+	}).pipe(Effect.catch((error) => Effect.logWarning(`Could not collect adjudications from '${error.operation}': ${error.reason}; retaining stored adjudications unchanged.`).pipe(Effect.as(void 0))));
+	if (listings === void 0) return prior;
+	const derived = deriveAdjudications({
+		threads: listings.threads,
+		issueComments: listings.issueComments
+	});
+	for (const note of derived.ignored) yield* Effect.logDebug(`Ignored adjudication command — ${note}`);
+	if (derived.droppedOldest > 0) yield* Effect.logWarning(`Dropped ${derived.droppedOldest} oldest adjudication(s) over the 20-entry bound.`);
+	return mergeAdjudications(prior, derived.adjudications);
+});
+const lineRange = (startLine, endLine) => `${startLine}${endLine === startLine ? "" : `-${endLine}`}`;
+/** One adjudication as a bounded reviewer-prompt context line. */
+const renderAdjudicationContextLine = (adjudication) => {
+	const location = adjudication.path !== void 0 && adjudication.startLine !== void 0 && adjudication.endLine !== void 0 ? `${adjudication.path}:${lineRange(adjudication.startLine, adjudication.endLine)}` : "(unanchored)";
+	const reason = adjudication.reason === void 0 ? "" : `: ${adjudication.reason}`;
+	return `${location} "${adjudication.title}" — ${adjudication.disposition} by @${adjudication.actor}${reason}`;
+};
+/** One prior-round finding as a bounded reviewer-prompt context line. */
+const renderPriorFindingContextLine = (finding) => `${finding.path}:${lineRange(finding.startLine, finding.endLine)} [${finding.severity}] "${finding.title}" — ${finding.body.slice(0, 400)}`;
+/** Build the fan-out prior-review context from the resolved continuity data. */
+const buildPriorReviewContext = (adjudications, priorFindingsOnScope) => ({
+	adjudicated: adjudications.map((adjudication) => ({
+		path: adjudication.path,
+		line: renderAdjudicationContextLine(adjudication)
+	})),
+	priorFindings: priorFindingsOnScope.map((finding) => ({
+		path: finding.path,
+		line: renderPriorFindingContextLine(finding)
+	}))
+});
+//#endregion
+//#region src/internal/anchors.ts
+/** Why a finding cannot anchor to the current new-version diff, if any. */
+const anchorViolation = (finding, files) => {
+	const file = files.find((candidate) => candidate.path === finding.path);
+	if (file === void 0) return "path is not part of the changeset";
+	if (file.patch === void 0) return "file has no anchorable textual diff";
+	if (finding.endLine < finding.startLine) return "endLine precedes startLine";
+	if (finding.endLine - finding.startLine + 1 > 100) return "range is implausibly large";
+	const anchors = commentableLines(file.patch);
+	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!anchors.has(line)) return `line ${line} is not part of the diff`;
+};
+//#endregion
+//#region src/internal/coverage.ts
+var ReviewInputCoverage = class extends Schema.Class("@effect-agent/pr-review/ReviewInputCoverage")({
+	status: Schema.Literals(["complete", "incomplete"]),
+	requiredPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	assignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	/** Assigned paths whose model-visible diff was truncated by the evidence bound. */
+	partialPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	unassignedPaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
 	/**
-	* Exact suggestion settlement: required when the candidate finding carries
-	* a suggestion, forbidden otherwise. Untrusted child output cannot publish
-	* a GitHub replacement block by prompt compliance alone — the host keeps a
-	* confirmed finding's suggestion only on an exact "committable" settlement.
+	* Paths with neither a textual diff nor bounded base/head text (binaries,
+	* oversized files). Fail-closed: they keep the status incomplete for as
+	* long as they are part of the pull request — an unreviewable change must
+	* never authorize a green check. Exclude them deliberately with ignore
+	* globs when that is intended.
 	*/
-	suggestion: Schema.optionalKey(Schema.Literals(["committable", "not-committable"]).annotate({ description: "Required exactly when the candidate finding carries a suggestion: \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else. Forbidden for candidates without a suggestion." })),
-	rationale: Schema.NonEmptyString.check(Schema.isMaxLength(600))
+	undiffablePaths: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(512))).check(Schema.isMaxLength(300)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(20))
+}) {};
+var FailedReviewPass = class extends Schema.Class("@effect-agent/pr-review/FailedReviewPass")({
+	workId: Schema.NonEmptyString.check(Schema.isMaxLength(96)),
+	stage: Schema.Literals([
+		"discovery",
+		"specialist",
+		"verification"
+	]),
+	errorTag: Schema.NonEmptyString.check(Schema.isMaxLength(256))
 }) {};
 /**
-* Exact suggestion settlement shape: a carried suggestion must be settled and
-* nothing else may be. A verification report that violates it is treated as a
-* misbehaving pass and retried within the pass budget.
+* Settlement of scheduled review work. `incomplete` means reviewer-side work
+* failed after its bounded retry — a machinery gap that is carried forward and
+* retried on the next run, never a statement about the code under review.
+* `unverified` is the flat reviewer's honest constant: one pass with no
+* independent verifier is neither settled assurance nor a failure.
 */
-const assessmentSettlesSuggestionExactly = (assessment, candidate) => candidate._tag === "FindingCandidate" && candidate.finding.suggestion !== void 0 ? assessment.suggestion !== void 0 : assessment.suggestion === void 0;
+var ReviewAssurance = class extends Schema.Class("@effect-agent/pr-review/ReviewAssurance")({
+	status: Schema.Literals([
+		"settled",
+		"incomplete",
+		"unverified"
+	]),
+	requiredGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedGeneralDiscoveryPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedSpecialistPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	requiredVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	completedVerificationPasses: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	discoveredCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	confirmedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	rejectedCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	unsettledCandidates: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Discovery claims discarded for anchors/paths outside their assigned evidence. */
+	discardedInvalidFindings: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	failedPasses: Schema.Array(FailedReviewPass).check(Schema.isMaxLength(64)),
+	reasons: Schema.Array(Schema.NonEmptyString.check(Schema.isMaxLength(1e3))).check(Schema.isMaxLength(32))
+}) {};
+const toolTrace = (events) => {
+	const declared = /* @__PURE__ */ new Map();
+	const succeeded = /* @__PURE__ */ new Map();
+	const failed = /* @__PURE__ */ new Map();
+	for (const event of events) {
+		if (event._tag === "ToolCallDeclared") declared.set(event.toolCallId, event);
+		if (event._tag === "ToolCallSucceeded") succeeded.set(event.toolCallId, event);
+		if (event._tag === "ToolCallFailed") failed.set(event.toolCallId, event);
+	}
+	return {
+		declared,
+		succeeded,
+		failed
+	};
+};
+const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+/** Render a bounded, deterministic "label (n): a, b, … (+k more)" reason line. */
+const boundedListReason = (label, values) => {
+	const items = sortedUnique(values);
+	let rendered = `${label} (${items.length}): `;
+	for (let index = 0; index < items.length; index += 1) {
+		const item = items[index] ?? "";
+		const separator = index === 0 ? "" : ", ";
+		const omitted = items.length - index - 1;
+		const suffix = omitted === 0 ? "" : ` … (+${omitted} more)`;
+		if (`${rendered}${separator}${item}${suffix}`.length > 1e3) {
+			const omission = `… (+${items.length - index} more)`;
+			return `${rendered.slice(0, 1e3 - omission.length)}${omission}`;
+		}
+		rendered = `${rendered}${separator}${item}`;
+	}
+	return rendered;
+};
 /**
-* Fail-closed publication of a confirmed finding: only an exact "committable"
-* settlement keeps the suggestion; anything else publishes the finding with
-* the suggestion stripped so unverified text can never become a one-click
-* GitHub replacement block.
+* Split carried scope into paths a retry can settle and paths it never can.
+* Undiffable files are a property of the pull request, not a transient
+* reviewer-side failure: gate reasons and rendered callouts must never promise
+* they are "retried automatically" — the honest instruction is to remove them
+* from the pull request or exclude them with ignore globs.
 */
-const confirmedFindingForPublication = (assessment, candidate) => {
-	if (candidate.finding.suggestion === void 0 || assessment.suggestion === "committable") return candidate.finding;
-	const { suggestion: _stripped, ...finding } = candidate.finding;
-	return ReviewFinding.make(finding);
+const splitCarriedScope = (input) => {
+	const undiffable = new Set(input.inputCoverage?.undiffablePaths ?? []);
+	const retryablePaths = (input.unreviewedPaths ?? []).filter((path) => !undiffable.has(path));
+	const undiffablePaths = sortedUnique(undiffable);
+	const coverageGapBeyondUndiffable = input.inputCoverage?.status === "incomplete" && input.inputCoverage.reasons.length > (undiffablePaths.length > 0 ? 1 : 0);
+	return {
+		retryablePaths,
+		undiffablePaths,
+		retryableGap: input.assurance?.status === "incomplete" || retryablePaths.length > 0 || coverageGapBeyondUndiffable
+	};
 };
+const anchorSurfaceAdjusted = (inputCoverage, anchorFiles, totalAnchorFiles) => anchorFiles.length >= totalAnchorFiles ? inputCoverage : ReviewInputCoverage.make({
+	...inputCoverage,
+	status: "incomplete",
+	reasons: [...inputCoverage.reasons, `full pull-request anchor surface exposed ${anchorFiles.length} of ${totalAnchorFiles} required files`]
+});
+/** The flat reviewer's honest constant assurance: one pass, no verifier. */
+const flatAssurance = () => ReviewAssurance.make({
+	status: "unverified",
+	requiredGeneralDiscoveryPasses: 1,
+	completedGeneralDiscoveryPasses: 1,
+	requiredSpecialistPasses: 0,
+	completedSpecialistPasses: 0,
+	requiredVerificationPasses: 0,
+	completedVerificationPasses: 0,
+	discoveredCandidates: 0,
+	confirmedCandidates: 0,
+	rejectedCandidates: 0,
+	unsettledCandidates: 0,
+	discardedInvalidFindings: 0,
+	failedPasses: [],
+	reasons: ["flat review has no independent candidate-verification pass; use the fan-out pipeline for a settled assurance result"]
+});
 /**
-* Concern candidates need explicit paths internally to bind the claim to
-* scheduled evidence. The verifier receives the complete bounded unit so it
-* can use neighboring evidence to falsify the claim. The public ReviewConcern
-* remains path-free after the host confirms and projects it.
+* Assess one settled flat run from its Run event trace: which required paths
+* received successful bounded diff evidence. This observes tool INPUT
+* assignment only — the host cannot know which evidence the model weighed.
 */
-var DiscoveredConcern = class extends Schema.Class("@effect-agent/pr-review/DiscoveredConcern")({
-	concern: ReviewConcern,
-	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
-}) {};
-const UnitPaths = Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-const RiskCategories = Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6));
-const Candidates = Schema.Array(ReviewCandidate).check(Schema.isMaxLength(18));
-const EvidenceShardIds = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
-/** One complete host-selected evidence shard supplied to a review child. */
-var FileReviewEvidence = class extends Schema.Class("@effect-agent/pr-review/FileReviewEvidence")({
-	shardId: ReviewEvidenceShardId,
-	path: ChangedPath,
-	status: ChangedFileStatus,
-	reviewMode: Schema.Literals([
-		"diff",
-		"content",
-		"unavailable"
-	]),
-	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
-	annotatedPatch: Schema.String.check(Schema.isMaxLength(MAX_PATCH_CHARS))
-}) {};
-/** Host-prepared child input with complete bounded diff/content evidence. */
-var FileReviewBrief = class extends Schema.Class("@effect-agent/pr-review/FileReviewBrief")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	paths: UnitPaths,
-	evidenceShardIds: EvidenceShardIds,
-	perspective: ReviewWorkPerspective,
-	riskCategories: RiskCategories,
-	/** Empty for discovery; the exact discovered set for unit verification. */
-	candidates: Candidates,
-	evidence: Schema.Array(FileReviewEvidence).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
-}) {};
-/** Child output; phase-inapplicable collections must be empty. */
-var FileReviewReport = class extends Schema.Class("@effect-agent/pr-review/FileReviewReport")({
-	phase: ReviewWorkPhase,
-	workId: ReviewPassId,
-	unitId: ReviewUnitId,
-	findings: Schema.Array(ReviewFinding).check(Schema.isMaxLength(6)),
-	concerns: Schema.Array(DiscoveredConcern).check(Schema.isMaxLength(3)),
-	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
-	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
-}) {};
+const assessFlatReview = (input) => {
+	const trace = toolTrace(input.events);
+	const requiredPaths = sortedUnique(input.files.map((file) => file.path));
+	const assigned = /* @__PURE__ */ new Set();
+	const partial = /* @__PURE__ */ new Set();
+	const failedPaths = /* @__PURE__ */ new Set();
+	for (const [toolCallId, declaration] of trace.declared) {
+		if (declaration.toolName !== "read_file_diff") continue;
+		const query = Schema.decodeUnknownOption(FileDiffQuery)(declaration.parameters);
+		if (Option.isNone(query)) continue;
+		const success = trace.succeeded.get(toolCallId);
+		if (success !== void 0) {
+			assigned.add(query.value.path);
+			const view = Schema.decodeUnknownOption(FileDiffView)(success.result);
+			if (Option.isSome(view) && view.value.truncated) partial.add(query.value.path);
+		}
+		if (trace.failed.has(toolCallId)) failedPaths.add(query.value.path);
+	}
+	const undiffable = new Set(input.files.filter((file) => !isReviewableFile(file)).map((file) => file.path));
+	const unassigned = requiredPaths.filter((path) => !undiffable.has(path) && (!assigned.has(path) || failedPaths.has(path)));
+	const reasons = [];
+	if (input.files.length < input.totalFiles) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (undiffable.size > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", undiffable));
+	if (failedPaths.size > 0) reasons.push(boundedListReason("diff reads failed", failedPaths));
+	if (partial.size > 0) reasons.push(boundedListReason("model-visible diff evidence was truncated", partial));
+	if (unassigned.length > 0) reasons.push(boundedListReason("required paths received no successful diff input", unassigned));
+	return {
+		inputCoverage: anchorSurfaceAdjusted(ReviewInputCoverage.make({
+			status: reasons.length === 0 ? "complete" : "incomplete",
+			requiredPaths,
+			assignedPaths: sortedUnique(assigned),
+			partialPaths: sortedUnique(partial),
+			unassignedPaths: sortedUnique(unassigned),
+			undiffablePaths: sortedUnique(undiffable),
+			reasons
+		}), input.anchorFiles, input.totalAnchorFiles),
+		assurance: flatAssurance(),
+		unreviewedPaths: sortedUnique([...unassigned, ...undiffable])
+	};
+};
 /**
-* A structurally valid child report that does not answer the scheduled pass:
-* wrong identity, phase-inapplicable fields, or an inexact assessment set.
-* Retried once like any other pass fault, because it is model misbehavior,
-* not evidence about the code under review.
+* Input coverage of one host-scheduled fan-out plan: which required paths the
+* bounded plan actually assigned complete evidence for. Capacity overflow and
+* undiffable paths are both real gaps; the pipeline carries them so the check
+* stays fail-closed until they are reviewed, removed, or explicitly ignored.
 */
-var ReviewPassMisbehaved = class extends Schema.TaggedError()("ReviewPassMisbehaved", {
-	workId: ReviewPassId,
-	reason: Schema.NonEmptyString.check(Schema.isMaxLength(600))
-}) {};
-const staticGuidanceLines = (guidance) => {
-	if (guidance === void 0) return [];
-	return (typeof guidance === "string" ? [guidance] : guidance).filter((line) => line.length > 0);
-};
-const evidenceInstructions = [
-	"The host placed complete bounded review evidence shards in the input evidence array. Treat every shard as required input; ordinal/total identifies multi-shard paths.",
-	"You have no tools and cannot roam outside this evidence. If it is insufficient for a candidate, reject or omit that candidate rather than guessing.",
-	"A diff marks new-version anchors as R<number>; only those lines may anchor findings. B/H content evidence is non-anchorable."
-];
-/** Discovery and verification instructions share one child definition. */
-const makeFileReviewerInstructions = (options = {}) => (brief) => {
-	const common = [
-		`You are an attached review worker for ${brief.workId} in host-planned unit ${brief.unitId}: ${brief.paths.join(", ")}.`,
-		...staticGuidanceLines(options.guidance),
-		...evidenceInstructions
-	];
-	if (brief.phase === "verification") return [
-		...common,
-		"Independently verify every candidate in the input. You did not receive another reviewer's transcript or reasoning; use only the candidate claim and bounded evidence.",
-		"The evidence array contains the complete bounded unit, including neighboring changed code that may confirm or falsify a locally plausible claim.",
-		"For each candidate, try to falsify it first. Confirm only when the cited behavior is supported and actionable. Reject unsupported, speculative, duplicate, or non-actionable candidates.",
-		"Return ONLY JSON with phase \"verification\", the exact workId/unitId, empty findings/concerns/fileSummaries arrays, and exactly one assessment per candidateId. Each assessment is {\"candidateId\": <exact id>, \"disposition\": <\"confirmed\" | \"rejected\">, \"suggestion\": <\"committable\" | \"not-committable\", present exactly when the candidate finding carries a suggestion>, \"rationale\": <bounded evidence-based reason>}. Never add or omit an id.",
-		"Settle every carried suggestion independently of the claim: answer \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else — it compiles in context and preserves the finding's intent, never prose describing a change. Otherwise answer \"not-committable\"; the host then publishes the confirmed finding without its suggestion. Omit the assessment \"suggestion\" field for candidates without one."
-	].join("\n");
-	const focus = brief.perspective === "risk-specialist" ? brief.riskCategories.length > 0 ? `This is a fresh specialist discovery pass. Concentrate on these host-classified risks without relying on another pass: ${brief.riskCategories.join(", ")}.` : "This is a fresh specialist discovery pass. The host found no keyword-classified category, so independently scrutinize authentication/authorization, security boundaries, durability, concurrency, credentials, and external side effects rather than treating classification silence as low risk." : "This is the general discovery pass. Review broadly for correctness, security, concurrency, resource, API, and error-handling defects.";
-	return [
-		...common,
-		focus,
-		"The discovery evidence array contains every complete shard in the unit. Review every entry and every shard of a multi-shard path. A later independent verifier, not you, decides which candidates publish.",
-		"When a non-anchored concern depends on one or more unit files, list 1-3 exact evidencePaths to bind the claim to scheduled evidence.",
-		`Return ONLY JSON with phase "discovery", the exact workId/unitId, up to 6 findings, up to 3 concerns shaped as {concern, evidencePaths}, one factual file summary per path (<= 240 chars), and an empty assessments array. Empty candidate arrays are valid; do not invent defects.`,
-		"Each finding is {\"path\": <a unit file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL problem-kind label>, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement source code for exactly lines startLine..endLine, ready to commit>}.",
-		"Include \"suggestion\" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement source for every line in the range and nothing else — never prose describing the change, which belongs in \"body\"."
-	].join("\n");
-};
-const fileReviewerInstructions = makeFileReviewerInstructions();
-const FileReviewToolkit = Toolkit.empty;
-const defaultFileReviewerPolicy = AgentPolicy.make({
-	maxTurns: 6,
-	maxToolCalls: 1,
-	maxDuration: "6 minutes",
-	toolConcurrency: 2,
-	repeatedFailureLimit: 6,
-	tokenBudget: 2e5,
-	contextTokenLimit: 15e4,
-	toolResultBounds: ToolResultBounds.make({ maxBytes: REVIEW_TOOL_RESULT_MAX_BYTES }),
-	onExhaustion: "fail"
-});
-const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
-	input: FileReviewBrief,
-	output: FileReviewReport,
-	instructions: makeFileReviewerInstructions(options),
-	toolkit: FileReviewToolkit,
-	policy: defaultFileReviewerPolicy,
-	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
-	metadata: {
-		deploymentClass: "E",
-		surface: "read-only",
-		stage: "discovery-verification"
-	}
-});
-const FileReviewer = makeFileReviewerDefinition();
-const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
-/** Rebuild one unit's complete evidence from the same snapshot the plan used. */
-const unitEvidence = (unit, files) => Effect.gen(function* () {
-	const byPath = new Map(files.map((file) => [file.path, file]));
-	const evidence = [];
-	for (const shard of unit.evidenceShards) {
-		const file = byPath.get(shard.path);
-		const chunk = file === void 0 ? void 0 : fileReviewEvidenceChunks(file)[shard.ordinal - 1];
-		if (file === void 0 || chunk === void 0) return yield* Effect.die(/* @__PURE__ */ new Error(`planned evidence shard has no source: ${shard.shardId} (${shard.path})`));
-		evidence.push(FileReviewEvidence.make({
-			shardId: shard.shardId,
-			path: shard.path,
-			status: file.status,
-			reviewMode: chunk.reviewMode,
-			ordinal: shard.ordinal,
-			total: shard.total,
-			annotatedPatch: chunk.annotatedPatch
-		}));
-	}
-	return evidence;
-});
-const misbehaved = (workId, reason) => ReviewPassMisbehaved.make({
-	workId,
-	reason: reason.slice(0, 600)
-});
-/** Validate that a verification report assesses exactly the scheduled candidates. */
-const validateVerificationReport = (brief, report) => {
-	if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return misbehaved(brief.workId, "verification output contained discovery-only fields");
-	const expectedById = new Map(brief.candidates.map((candidate) => [candidate.candidateId, candidate]));
-	const assessedIds = /* @__PURE__ */ new Set();
-	for (const assessment of report.assessments) {
-		const candidate = expectedById.get(assessment.candidateId);
-		if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
-		if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return misbehaved(brief.workId, "verification output did not settle suggestion publication exactly");
-		assessedIds.add(assessment.candidateId);
+const fanOutInputCoverage = (input) => {
+	const plan = input.plan;
+	const assignedPaths = sortedUnique(plan.units.flatMap((unit) => unit.paths));
+	const unassignedPaths = sortedUnique(plan.unassignedPaths);
+	const reasons = [];
+	if (plan.truncated) reasons.push(`review range exposed ${input.files.length} of ${input.totalFiles} required files`);
+	if (plan.undiffablePaths.length > 0) reasons.push(boundedListReason("required paths have no reviewable diff or bounded text", plan.undiffablePaths));
+	if (plan.partialEvidencePaths.length > 0) reasons.push(boundedListReason("fan-out capacity left some deterministic evidence shards unassigned", plan.partialEvidencePaths));
+	if (plan.unassignedEvidenceShardCount > 0) {
+		reasons.push(`${plan.unassignedEvidenceShardCount} deterministic evidence shard(s) exceeded fan-out capacity`);
+		reasons.push(boundedListReason(`unassigned evidence shard identifier sample (${plan.unassignedEvidenceShardIds.length} of ${plan.unassignedEvidenceShardCount})`, plan.unassignedEvidenceShardIds));
 	}
-	if (assessedIds.size !== expectedById.size) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+	if (plan.unassignedPaths.length > 0) reasons.push(boundedListReason("fan-out capacity left paths unassigned", plan.unassignedPaths));
+	return anchorSurfaceAdjusted(ReviewInputCoverage.make({
+		status: reasons.length === 0 ? "complete" : "incomplete",
+		requiredPaths: sortedUnique(input.files.map((file) => file.path)),
+		assignedPaths,
+		partialPaths: plan.partialEvidencePaths,
+		unassignedPaths,
+		undiffablePaths: sortedUnique(plan.undiffablePaths),
+		reasons
+	}), input.anchorFiles, input.totalAnchorFiles);
 };
+//#endregion
+//#region src/internal/review-units.ts
+/** The delegation fan-out bound: one parent Run spawns at most this many children. */
+const MAX_REVIEW_UNITS = 8;
+/** A unit never carries more files than this, regardless of their size. */
+const MAX_UNIT_FILES = 12;
 /**
-* Run one scheduled pass: execute the child, decode its report, and enforce
-* the pass contract. Any typed fault — child failure, malformed or misdirected
-* output — is retried once; budget exhaustion is terminal because a retry
-* would fail the same way. The settled outcome is a value either way, so one
-* flaky pass can never fail the whole pipeline.
+* Bound the complete model-visible evidence assigned to one child. This is a
+* character bound rather than a token estimate because it is deterministic,
+* provider-independent, and enforced before any model call.
 */
-const runReviewPass = (binding, brief, budget) => Effect.gen(function* () {
-	const result = yield* AgentRuntime.run(binding, brief, {
-		...budget === void 0 ? {} : { budget },
-		estimateCostMicrousd: () => Effect.succeed(500)
-	});
-	const report = yield* Schema.decodeUnknownEffect(FileReviewReport)(result.output).pipe(Effect.mapError((error) => misbehaved(brief.workId, `child report failed to decode: ${error.message}`)));
-	if (report.phase !== brief.phase || report.workId !== brief.workId || report.unitId !== brief.unitId) return yield* misbehaved(brief.workId, "child report identity does not match the scheduled pass");
-	if (brief.phase === "verification") {
-		const violation = validateVerificationReport(brief, report);
-		if (violation !== void 0) return yield* violation;
-	} else if (report.assessments.length > 0) return yield* misbehaved(brief.workId, "discovery output contained verification-only assessments");
-	return {
-		report,
-		turns: result.turns
-	};
-}).pipe(Effect.scoped, Effect.retry({
-	times: 1,
-	while: (error) => error._tag !== "BudgetExceeded"
-}), Effect.map((settled) => ({
-	_tag: "settled",
-	...settled
-})), Effect.catch((error) => Effect.succeed({
-	_tag: "failed",
-	errorTag: String(error._tag).slice(0, 256)
-})));
+const UNIT_EVIDENCE_CHAR_BUDGET = 24e4;
+/** Maximum complete evidence shards placed in one child brief. */
+const MAX_UNIT_EVIDENCE_SHARDS = 12;
 /**
-* Keep only findings anchored inside the pass's exact assigned evidence and
-* concerns bound to unit paths. Everything else is discarded and counted —
-* an invalid anchor invalidates one claim, never the pass that produced it.
+* Keep overflow diagnostics bounded to one plan's total assignment capacity.
+* The plan separately records the exact overflow count and every affected
+* path, so identifiers are a deterministic diagnostic sample rather than the
+* authority for whether input coverage is complete.
 */
-const harvestDiscovery = (pass, unit, files, anchorFiles, report) => {
-	const allowed = new Set(pass.paths);
-	let discarded = 0;
-	const keptFindings = [];
-	for (const finding of report.findings) {
-		if (!allowed.has(finding.path) || anchorViolation(finding, anchorFiles) !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) {
-			discarded += 1;
-			continue;
-		}
-		keptFindings.push(finding);
-	}
-	const keptConcerns = [];
-	for (const candidate of report.concerns) {
-		if (candidate.evidencePaths.some((path) => !allowed.has(path))) {
-			discarded += 1;
-			continue;
-		}
-		keptConcerns.push(candidate);
+const MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS = 96;
+/** The merged review never exceeds the `CodeReview` findings bound. */
+const MAX_MERGED_FINDINGS = 20;
+const ReviewUnitId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** High-risk surfaces that receive an explicit specialist focus label. */
+const ReviewRiskCategory = Schema.Literals([
+	"authentication-authorization",
+	"security-boundary",
+	"persistence-durability",
+	"concurrency",
+	"credential-handling",
+	"external-side-effects"
+]);
+const ReviewDiscoveryPerspective = Schema.Literals(["general", "risk-specialist"]);
+const ReviewPassId = Schema.NonEmptyString.check(Schema.isMaxLength(64));
+const ReviewEvidenceShardId = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** One complete bounded slice of a changed path's model-visible evidence. */
+var ReviewEvidenceShard = class extends Schema.Class("@effect-agent/pr-review/ReviewEvidenceShard")({
+	shardId: ReviewEvidenceShardId,
+	path: ChangedPath,
+	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(MAX_PATCH_CHARS))
+}) {};
+const EvidenceShardIds$1 = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** One required, independently scoped discovery attempt. */
+var ReviewDiscoveryPass = class extends Schema.Class("@effect-agent/pr-review/ReviewDiscoveryPass")({
+	passId: ReviewPassId,
+	unitId: ReviewUnitId,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	evidenceShardIds: EvidenceShardIds$1,
+	perspective: ReviewDiscoveryPerspective,
+	/** Empty for the general pass; explicit deterministic focus for specialists. */
+	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
+}) {};
+/** One bounded slice of the changeset delegated to one child reviewer. */
+var ReviewUnit = class extends Schema.Class("@effect-agent/pr-review/ReviewUnit")({
+	unitId: ReviewUnitId,
+	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	evidenceShards: Schema.Array(ReviewEvidenceShard).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	/** additions + deletions across the unit's files, for honest sizing. */
+	changedLines: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Complete model-visible diff/content evidence assigned to each child. */
+	evidenceChars: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).check(Schema.isLessThanOrEqualTo(UNIT_EVIDENCE_CHAR_BUDGET)),
+	/** Host-classified focus labels for the unit's redundant specialist pass. */
+	riskCategories: Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6))
+}) {};
+/** The complete deterministic fan-out plan over one changeset. */
+var ReviewUnitPlan = class extends Schema.Class("@effect-agent/pr-review/ReviewUnitPlan")({
+	totalFiles: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** True when the source returned fewer files than the pull request has. */
+	truncated: Schema.Boolean,
+	units: Schema.Array(ReviewUnit).check(Schema.isMaxLength(8)),
+	/** Exact discovery calls the coordinator must make. */
+	discoveryPasses: Schema.Array(ReviewDiscoveryPass).check(Schema.isMaxLength(16)),
+	/** Changed files with neither a textual diff nor bounded base/head text. */
+	undiffablePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
+	/** Assigned paths with one or more evidence shards beyond plan capacity. */
+	partialEvidencePaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300)),
+	/** Exact number of shards beyond the bounded unit capacity. */
+	unassignedEvidenceShardCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Bounded deterministic prefix of the unassigned shard identifiers. */
+	unassignedEvidenceShardIds: Schema.Array(ReviewEvidenceShardId).check(Schema.isMaxLength(96)),
+	/**
+	* Diffable files beyond the fan-out capacity (MAX_REVIEW_UNITS units of
+	* MAX_UNIT_FILES files). Never silently dropped: the coordinator must name
+	* them as unreviewed in its summary.
+	*/
+	unassignedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(300))
+}) {};
+const riskRules = [
+	{
+		category: "authentication-authorization",
+		patterns: [
+			/auth/,
+			/authoriz/,
+			/permission/,
+			/principal/,
+			/access[-_ ]?control/,
+			/role\b/
+		]
+	},
+	{
+		category: "security-boundary",
+		patterns: [
+			/security/,
+			/sandbox/,
+			/untrusted/,
+			/schema\.decode/,
+			/validation/,
+			/injection/,
+			/csrf/,
+			/xss/,
+			/path traversal/
+		]
+	},
+	{
+		category: "persistence-durability",
+		patterns: [
+			/durab/,
+			/persist/,
+			/storage/,
+			/database/,
+			/\bsql\b/,
+			/journal/,
+			/ledger/,
+			/checkpoint/,
+			/migration/,
+			/transaction/
+		]
+	},
+	{
+		category: "concurrency",
+		patterns: [
+			/concurr/,
+			/semaphore/,
+			/\bfiber/,
+			/race/,
+			/mutex/,
+			/\block\b/,
+			/queue/,
+			/parallel/,
+			/interrupt/
+		]
+	},
+	{
+		category: "credential-handling",
+		patterns: [
+			/credential/,
+			/secret/,
+			/password/,
+			/api[-_ ]?key/,
+			/bearer/,
+			/hmac/,
+			/signature/
+		]
+	},
+	{
+		category: "external-side-effects",
+		patterns: [
+			/publish/,
+			/webhook/,
+			/github/,
+			/fetch\(/,
+			/http/,
+			/send[-_ ]?(email|message)/,
+			/write[-_ ]?(file|record)/,
+			/delete/,
+			/mutation/,
+			/side[-_ ]?effect/,
+			/spawn/,
+			/exec/
+		]
 	}
-	return {
-		candidates: [...keptFindings.map((finding, index) => FindingCandidate.make({
-			candidateId: `${pass.passId}:finding:${candidateOrdinal(index)}`,
-			workId: pass.passId,
-			unitId: pass.unitId,
-			finding,
-			evidencePaths: [finding.path]
-		})), ...keptConcerns.map((candidate, index) => ConcernCandidate.make({
-			candidateId: `${pass.passId}:concern:${candidateOrdinal(index)}`,
-			workId: pass.passId,
-			unitId: pass.unitId,
-			concern: candidate.concern,
-			evidencePaths: candidate.evidencePaths
-		}))],
-		fileSummaries: report.fileSummaries.filter((entry) => allowed.has(entry.path)),
-		discarded
-	};
+];
+/**
+* Deterministic host policy for specialist assignment. It intentionally
+* favors false positives: an extra bounded pass costs work, while a missed
+* high-risk classification removes redundancy. This is not a claim that the
+* keyword policy recognizes every semantically risky change.
+*/
+const classifyReviewRisks = (file) => {
+	const text = [
+		file.path,
+		file.previousPath ?? "",
+		file.patch ?? "",
+		file.reviewBaseContent ?? "",
+		file.reviewHeadContent ?? ""
+	].join("\n").toLowerCase();
+	return riskRules.filter((rule) => rule.patterns.some((pattern) => pattern.test(text))).map((rule) => rule.category);
 };
-const reviewUnit = (binding, unit, passes, input) => Effect.gen(function* () {
-	const evidence = yield* unitEvidence(unit, input.files);
-	const failedPasses = [];
-	const candidates = [];
-	const subjects = /* @__PURE__ */ new Set();
-	const walkthrough = [];
-	let discardedFindings = 0;
-	let turns = 0;
-	let completedGeneralPasses = 0;
-	let completedSpecialistPasses = 0;
-	for (const pass of passes) {
-		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
-		const brief = FileReviewBrief.make({
-			phase: "discovery",
-			workId: pass.passId,
-			unitId: pass.unitId,
-			paths: pass.paths,
-			evidenceShardIds: pass.evidenceShardIds,
-			perspective: pass.perspective,
-			riskCategories: pass.riskCategories,
-			candidates: [],
-			evidence
-		});
-		const outcome = yield* runReviewPass(binding, brief, input.budget);
-		if (outcome._tag === "failed") {
-			failedPasses.push(FailedReviewPass.make({
-				workId: pass.passId,
-				stage,
-				errorTag: outcome.errorTag
-			}));
-			continue;
-		}
-		turns += outcome.turns;
-		if (stage === "specialist") completedSpecialistPasses += 1;
-		else completedGeneralPasses += 1;
-		const harvest = harvestDiscovery(pass, unit, input.files, input.anchorFiles, outcome.report);
-		discardedFindings += harvest.discarded;
-		if (pass.perspective === "general") walkthrough.push(...harvest.fileSummaries);
-		for (const candidate of harvest.candidates) {
-			const subject = reviewCandidateSubjectKey(candidate);
-			if (subjects.has(subject)) continue;
-			subjects.add(subject);
-			candidates.push(candidate);
-		}
-	}
-	const confirmed = [];
-	let rejectedCandidates = 0;
-	let unsettledCandidates = 0;
-	let completedVerificationPasses = 0;
-	const requiredVerificationPasses = candidates.length > 0 ? 1 : 0;
-	if (candidates.length > 0) {
-		const workId = `${unit.unitId}-verification`;
-		const brief = FileReviewBrief.make({
-			phase: "verification",
-			workId,
-			unitId: unit.unitId,
-			paths: unit.paths,
-			evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
-			perspective: "candidate-verification",
-			riskCategories: unit.riskCategories,
-			candidates,
-			evidence
-		});
-		const outcome = yield* runReviewPass(binding, brief, input.budget);
-		if (outcome._tag === "failed") {
-			unsettledCandidates = candidates.length;
-			failedPasses.push(FailedReviewPass.make({
-				workId,
-				stage: "verification",
-				errorTag: outcome.errorTag
-			}));
-		} else {
-			turns += outcome.turns;
-			completedVerificationPasses = 1;
-			const byId = new Map(candidates.map((candidate) => [candidate.candidateId, candidate]));
-			for (const assessment of outcome.report.assessments) {
-				const candidate = byId.get(assessment.candidateId);
-				if (candidate === void 0) continue;
-				if (assessment.disposition === "confirmed") confirmed.push({
-					assessment,
-					candidate
-				});
-				else rejectedCandidates += 1;
-			}
+/**
+* Whether every claimed finding anchor was present in the exact bounded
+* evidence shards assigned to one unit. This is stricter than checking the
+* full pull-request diff when an oversized path spans multiple units.
+*/
+const findingAnchorInUnitEvidence = (finding, unit, files) => {
+	const file = files.find((candidate) => candidate.path === finding.path);
+	if (file?.patch === void 0 || finding.endLine < finding.startLine) return false;
+	const assignedOrdinals = new Set(unit.evidenceShards.filter((shard) => shard.path === finding.path).map((shard) => shard.ordinal));
+	const visibleLines = /* @__PURE__ */ new Set();
+	const chunks = fileReviewEvidenceChunks(file);
+	for (let index = 0; index < chunks.length; index += 1) {
+		if (!assignedOrdinals.has(index + 1)) continue;
+		for (const line of chunks[index]?.annotatedPatch.split("\n") ?? []) {
+			const match = /^R(\d+) /.exec(line);
+			if (match?.[1] !== void 0) visibleLines.add(Number(match[1]));
 		}
 	}
-	return {
-		failedPasses,
-		discoveredCandidates: candidates.length,
-		confirmed,
-		rejectedCandidates,
-		unsettledCandidates,
-		discardedFindings,
-		walkthrough,
-		turns,
-		completedGeneralPasses,
-		completedSpecialistPasses,
-		requiredVerificationPasses,
-		completedVerificationPasses,
-		unreviewedPaths: failedPasses.length > 0 ? unit.paths : [],
-		unreviewedPasses: failedPasses.map((pass) => ({
-			stage: pass.stage,
-			paths: unit.paths
-		}))
-	};
-});
-const countNoun = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
-const composeSummary = (plan, assurance) => {
-	const requiredDiscovery = assurance.requiredGeneralDiscoveryPasses + assurance.requiredSpecialistPasses;
-	const completedDiscovery = assurance.completedGeneralDiscoveryPasses + assurance.completedSpecialistPasses;
-	const parts = [`Reviewed ${countNoun(plan.totalFiles, "changed file")} across ${countNoun(plan.units.length, "bounded unit")}: ${completedDiscovery}/${requiredDiscovery} discovery and ${assurance.completedVerificationPasses}/${assurance.requiredVerificationPasses} verification pass(es) settled; ${assurance.confirmedCandidates} of ${countNoun(assurance.discoveredCandidates, "discovered candidate")} confirmed by independent verification.`];
-	if (assurance.failedPasses.length > 0) parts.push(`${countNoun(assurance.failedPasses.length, "pass")} did not settle; the affected paths are carried forward and retried on the next run. This is a reviewer-side gap, not a code defect.`);
-	if (assurance.discardedInvalidFindings > 0) parts.push(`${countNoun(assurance.discardedInvalidFindings, "candidate")} discarded for anchors or paths outside the assigned evidence.`);
-	if (plan.undiffablePaths.length > 0) parts.push(`${countNoun(plan.undiffablePaths.length, "path")} had no reviewable textual evidence and keep input coverage incomplete; exclude such paths with ignore globs when that is intended.`);
-	if (plan.unassignedPaths.length > 0 || plan.unassignedEvidenceShardCount > 0) parts.push("The changeset exceeded the bounded fan-out capacity; unassigned scope is reported under input coverage.");
-	parts.push("No configured pipeline can prove absence of defects; this describes settled work only.");
-	return parts.join(" ").slice(0, 4e3);
+	for (let line = finding.startLine; line <= finding.endLine; line += 1) if (!visibleLines.has(line)) return false;
+	return true;
 };
-const remapPlanUnitIds = (plan, offset) => {
-	if (offset === 0) return plan;
-	const units = plan.units.map((unit, index) => ReviewUnit.make({
-		...unit,
-		unitId: `unit-${String(offset + index + 1).padStart(3, "0")}`
-	}));
-	const mappedIds = /* @__PURE__ */ new Map();
-	for (const [index, unit] of plan.units.entries()) {
-		const remapped = units[index];
-		if (remapped !== void 0) mappedIds.set(unit.unitId, remapped.unitId);
-	}
-	return ReviewUnitPlan.make({
-		...plan,
-		units,
-		discoveryPasses: plan.discoveryPasses.map((pass) => {
-			const unitId = mappedIds.get(pass.unitId) ?? pass.unitId;
-			return ReviewDiscoveryPass.make({
-				...pass,
-				unitId,
-				passId: `${unitId}${pass.passId.slice(pass.unitId.length)}`
+const uniquePaths = (shards) => [...new Set(shards.map(({ shard }) => shard.path))];
+const plannedEvidenceShards = (files) => {
+	const planned = [];
+	let shardIndex = 0;
+	for (const file of files) {
+		const chunks = fileReviewEvidenceChunks(file);
+		for (let index = 0; index < chunks.length; index += 1) {
+			const chunk = chunks[index];
+			if (chunk === void 0) continue;
+			shardIndex += 1;
+			planned.push({
+				shard: ReviewEvidenceShard.make({
+					shardId: `shard-${String(shardIndex).padStart(4, "0")}`,
+					path: file.path,
+					ordinal: index + 1,
+					total: chunks.length,
+					evidenceChars: chunk.annotatedPatch.length
+				}),
+				file,
+				changedLines: index === 0 ? file.additions + file.deletions : 0
 			});
-		})
-	});
-};
-const scheduleFanOutWork = (input) => {
-	const retryPathSet = new Set(input.retry?.paths ?? []);
-	const retryStages = new Set(input.retry?.stages ?? []);
-	if (retryPathSet.size === 0) {
-		const plan = planReviewUnits(input.files, { totalChangedFiles: input.totalChangedFiles });
-		const passesByUnit = /* @__PURE__ */ new Map();
-		for (const pass of plan.discoveryPasses) {
-			const passes = passesByUnit.get(pass.unitId) ?? [];
-			passes.push(pass);
-			passesByUnit.set(pass.unitId, passes);
 		}
-		return {
-			plan,
-			passesByUnit,
-			overflowRetryPaths: []
-		};
 	}
-	const freshFiles = input.files.filter((file) => !retryPathSet.has(file.path));
-	const retryFiles = input.files.filter((file) => retryPathSet.has(file.path));
-	const freshPlan = planReviewUnits(freshFiles, { totalChangedFiles: input.totalChangedFiles });
-	const retryPlan = remapPlanUnitIds(planReviewUnits(retryFiles, { totalChangedFiles: input.totalChangedFiles }), freshPlan.units.length);
-	const acceptedFresh = freshPlan.units.slice(0, 8);
-	const acceptedRetry = retryPlan.units.slice(0, Math.max(0, 8 - acceptedFresh.length));
-	const overflowRetryPaths = retryPlan.units.slice(acceptedRetry.length).flatMap((unit) => [...unit.paths]);
-	const retryPassFilter = (pass) => {
-		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
-		return retryStages.has(stage);
-	};
-	const acceptedRetryIds = new Set(acceptedRetry.map((unit) => unit.unitId));
-	let retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId) && retryPassFilter(pass));
-	if (retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId));
-	const acceptedFreshIds = new Set(acceptedFresh.map((unit) => unit.unitId));
-	const discoveryPasses = [...freshPlan.discoveryPasses.filter((pass) => acceptedFreshIds.has(pass.unitId)), ...retryPasses];
-	const plan = ReviewUnitPlan.make({
-		totalFiles: input.files.length,
-		truncated: freshPlan.truncated || retryPlan.truncated,
-		units: [...acceptedFresh, ...acceptedRetry],
-		discoveryPasses,
-		undiffablePaths: [.../* @__PURE__ */ new Set([...freshPlan.undiffablePaths, ...retryPlan.undiffablePaths])].sort(),
-		partialEvidencePaths: [.../* @__PURE__ */ new Set([...freshPlan.partialEvidencePaths, ...retryPlan.partialEvidencePaths])].sort(),
-		unassignedEvidenceShardCount: freshPlan.unassignedEvidenceShardCount + retryPlan.unassignedEvidenceShardCount,
-		unassignedEvidenceShardIds: [...freshPlan.unassignedEvidenceShardIds, ...retryPlan.unassignedEvidenceShardIds].slice(0, 96),
-		unassignedPaths: [.../* @__PURE__ */ new Set([
-			...freshPlan.unassignedPaths,
-			...retryPlan.unassignedPaths,
-			...overflowRetryPaths
-		])].sort()
+	return planned;
+};
+const unitOf = (index, shards) => ReviewUnit.make({
+	unitId: `unit-${String(index + 1).padStart(3, "0")}`,
+	paths: uniquePaths(shards),
+	evidenceShards: shards.map(({ shard }) => shard),
+	changedLines: shards.reduce((total, shard) => total + shard.changedLines, 0),
+	evidenceChars: shards.reduce((total, { shard }) => total + shard.evidenceChars, 0),
+	riskCategories: [...new Set(shards.flatMap(({ file }) => classifyReviewRisks(file)))]
+});
+const discoveryPassesFor = (units) => units.flatMap((unit) => [ReviewDiscoveryPass.make({
+	passId: `${unit.unitId}-general`,
+	unitId: unit.unitId,
+	paths: unit.paths,
+	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+	perspective: "general",
+	riskCategories: []
+}), ReviewDiscoveryPass.make({
+	passId: `${unit.unitId}-specialist`,
+	unitId: unit.unitId,
+	paths: unit.paths,
+	evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+	perspective: "risk-specialist",
+	riskCategories: unit.riskCategories
+})]);
+/**
+* Group the changeset into at most `MAX_REVIEW_UNITS` review units.
+*
+* Deterministic by construction: files are ordered by path (so files sharing
+* a directory become neighbors — directory affinity without a heuristic),
+* then split into complete line-bounded evidence shards and packed greedily
+* under the hard evidence and per-unit shard bounds. Capacity is finite and
+* explicit:
+*
+* - files without a textual diff are still delegated when the source
+*   recovered complete bounded UTF-8 base/head content. Findings from that
+*   evidence cannot anchor inline and are reported as concerns;
+* - files with neither form of textual evidence surface in
+*   `undiffablePaths` instead of laundering missing coverage;
+* - an oversized path spans as many deterministic shards and units as needed;
+* - shards beyond `MAX_REVIEW_UNITS` full units surface explicitly, so a path
+*   is partial only when finite plan capacity is genuinely exhausted.
+*/
+const planReviewUnits = (files, options) => {
+	const ordered = [...files].sort((left, right) => left.path < right.path ? -1 : 1);
+	const reviewable = ordered.filter(isReviewableFile);
+	const undiffable = ordered.filter((file) => !isReviewableFile(file));
+	const shards = plannedEvidenceShards(reviewable);
+	const groups = [];
+	const unassigned = [];
+	let current = [];
+	let currentEvidenceChars = 0;
+	for (const shard of shards) {
+		const nextPaths = /* @__PURE__ */ new Set([...uniquePaths(current), shard.shard.path]);
+		if (current.length >= 12 || nextPaths.size > 12 || current.length > 0 && currentEvidenceChars + shard.shard.evidenceChars > 24e4) {
+			groups.push(current);
+			current = [];
+			currentEvidenceChars = 0;
+		}
+		if (groups.length >= 8) {
+			unassigned.push(shard);
+			continue;
+		}
+		current.push(shard);
+		currentEvidenceChars += shard.shard.evidenceChars;
+	}
+	if (current.length > 0 && groups.length < 8) groups.push(current);
+	const units = groups.map((group, index) => unitOf(index, group));
+	const assignedShardIds = new Set(units.flatMap((unit) => unit.evidenceShards.map((shard) => shard.shardId)));
+	const assignedPaths = new Set(shards.filter(({ shard }) => assignedShardIds.has(shard.shardId)).map(({ shard }) => shard.path));
+	const unassignedPathsWithEvidence = new Set(unassigned.map(({ shard }) => shard.path));
+	return ReviewUnitPlan.make({
+		totalFiles: files.length,
+		truncated: files.length < options.totalChangedFiles,
+		units,
+		discoveryPasses: discoveryPassesFor(units),
+		undiffablePaths: undiffable.map((file) => file.path),
+		partialEvidencePaths: [...unassignedPathsWithEvidence].filter((path) => assignedPaths.has(path)),
+		unassignedEvidenceShardCount: unassigned.length,
+		unassignedEvidenceShardIds: unassigned.slice(0, 96).map(({ shard }) => shard.shardId),
+		unassignedPaths: [...unassignedPathsWithEvidence].filter((path) => !assignedPaths.has(path))
 	});
-	const passesByUnit = /* @__PURE__ */ new Map();
-	for (const pass of discoveryPasses) {
-		const passes = passesByUnit.get(pass.unitId) ?? [];
-		passes.push(pass);
-		passesByUnit.set(pass.unitId, passes);
+};
+const severityRank = {
+	blocking: 0,
+	important: 1,
+	nit: 2
+};
+const anchorKey = (finding) => `${finding.path} ${finding.startLine} ${finding.endLine}`;
+/**
+* Merge the children's findings into one bounded, deterministic list: dedupe
+* findings sharing an anchor (path + line range) keeping the most severe —
+* and, at equal severity, the first in declaration order — then rank by
+* severity, path, and line, and cap at the `CodeReview` findings bound.
+* This is the merge policy the coordinator's instructions state in prose;
+* pinning it here keeps the policy itself deterministic and testable.
+*/
+const rankAndDedupeFindings = (findings) => {
+	const byAnchor = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const key = anchorKey(finding);
+		const existing = byAnchor.get(key);
+		if (existing === void 0 || severityRank[finding.severity] < severityRank[existing.severity]) byAnchor.set(key, finding);
 	}
-	return {
-		plan,
-		passesByUnit,
-		overflowRetryPaths
-	};
+	return [...byAnchor.values()].sort((left, right) => {
+		const bySeverity = severityRank[left.severity] - severityRank[right.severity];
+		if (bySeverity !== 0) return bySeverity;
+		if (left.path !== right.path) return left.path < right.path ? -1 : 1;
+		return left.startLine - right.startLine;
+	}).slice(0, 20);
 };
 /**
-* Run the complete host-scheduled fan-out pipeline over one selected
-* changeset snapshot: plan, independent discovery, exact verification, and a
-* deterministic host-composed CodeReview from verifier-confirmed candidates
-* only. The verdict is derived from confirmed severities, never model prose.
+* Stable identity for one concern. The paths are part of the claim: identical
+* prose about two independent files must not collapse into one item.
 */
-const runFanOutReview = (binding, input) => Effect.gen(function* () {
-	const { plan, passesByUnit, overflowRetryPaths } = scheduleFanOutWork(input);
-	const outcomes = yield* Effect.forEach(plan.units, (unit) => reviewUnit(binding, unit, passesByUnit.get(unit.unitId) ?? [], input), { concurrency: 4 });
-	const failedPasses = outcomes.flatMap((outcome) => outcome.failedPasses);
-	const unsettledCandidates = outcomes.reduce((total, outcome) => total + outcome.unsettledCandidates, 0);
-	const reasons = [];
-	if (failedPasses.length > 0) reasons.push(boundedListReason("configured review passes did not settle", failedPasses.map((pass) => `${pass.workId} (${pass.errorTag})`)));
-	if (unsettledCandidates > 0) reasons.push(`${unsettledCandidates} discovered candidate(s) did not receive exact verification`);
-	const requiredSpecialistPasses = plan.discoveryPasses.filter((pass) => pass.perspective === "risk-specialist").length;
-	const confirmed = outcomes.flatMap((outcome) => outcome.confirmed);
-	const assurance = ReviewAssurance.make({
-		status: reasons.length === 0 ? "settled" : "incomplete",
-		requiredGeneralDiscoveryPasses: plan.discoveryPasses.length - requiredSpecialistPasses,
-		completedGeneralDiscoveryPasses: outcomes.reduce((total, outcome) => total + outcome.completedGeneralPasses, 0),
-		requiredSpecialistPasses,
-		completedSpecialistPasses: outcomes.reduce((total, outcome) => total + outcome.completedSpecialistPasses, 0),
-		requiredVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.requiredVerificationPasses, 0),
-		completedVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.completedVerificationPasses, 0),
-		discoveredCandidates: outcomes.reduce((total, outcome) => total + outcome.discoveredCandidates, 0),
-		confirmedCandidates: confirmed.length,
-		rejectedCandidates: outcomes.reduce((total, outcome) => total + outcome.rejectedCandidates, 0),
-		unsettledCandidates,
-		discardedInvalidFindings: outcomes.reduce((total, outcome) => total + outcome.discardedFindings, 0),
-		failedPasses,
-		reasons
-	});
-	const findings = rankAndDedupeFindings(confirmed.flatMap(({ assessment, candidate }) => candidate._tag === "FindingCandidate" ? [confirmedFindingForPublication(assessment, candidate)] : []));
-	const concerns = rankAndDedupeConcerns(confirmed.flatMap(({ candidate }) => candidate._tag === "ConcernCandidate" ? [candidate.concern] : []));
-	const walkthrough = outcomes.flatMap((outcome) => outcome.walkthrough);
-	const blocking = findings.some((finding) => finding.severity === "blocking") || concerns.some((concern) => concern.severity === "blocking");
-	return {
-		review: CodeReview.make({
-			summary: composeSummary(plan, assurance),
-			verdict: blocking ? "request-changes" : findings.length > 0 || concerns.length > 0 ? "comment" : "approve",
-			findings,
-			...concerns.length === 0 ? {} : { concerns },
-			...walkthrough.length === 0 ? {} : { walkthrough }
-		}),
-		assurance,
-		plan,
-		unreviewedPaths: [.../* @__PURE__ */ new Set([
-			...outcomes.flatMap((outcome) => outcome.unreviewedPaths),
-			...plan.unassignedPaths,
-			...plan.partialEvidencePaths,
-			...plan.undiffablePaths
-		])].sort(),
-		unreviewedPasses: [...outcomes.flatMap((outcome) => outcome.unreviewedPasses), ...overflowRetryPaths.length === 0 ? [] : (input.retry?.stages.length ? input.retry.stages : [
-			"discovery",
-			"specialist",
-			"verification"
-		]).map((stage) => ({
-			stage,
-			paths: overflowRetryPaths
-		}))],
-		turns: outcomes.reduce((total, outcome) => total + outcome.turns, 0)
-	};
-});
-//#endregion
-//#region src/internal/fingerprint.ts
-const MARKER_PREFIX = "<!-- effect-agent-pr-review fingerprint=sha256:";
-const MARKER_SUFFIX = " -->";
-const MARKER_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:([0-9a-f]{64}) -->/g;
-/** Render the invisible review-body marker for one fingerprint. */
-const renderFingerprintMarker = (fingerprint) => `${MARKER_PREFIX}${fingerprint}${MARKER_SUFFIX}`;
-/** The rendered marker length is fixed; publication reserves room for it. */
-const FINGERPRINT_MARKER_LENGTH = renderFingerprintMarker("0".repeat(64)).length;
-/** Extract the last fingerprint marker in one review body, if any. */
-const extractFingerprint = (body) => {
-	let last;
-	for (const match of body.matchAll(MARKER_PATTERN)) last = match[1];
-	return last;
+const reviewConcernKey = (concern) => `${(concern.evidencePaths ?? []).join("\0")}\u0001${concern.title}\u0000${concern.body}`;
+/**
+* The concern analogue of `rankAndDedupeFindings`: dedupe by exact scoped
+* content keeping the most severe duplicate, rank by severity, and cap at the
+* `CodeReview` concerns bound.
+*/
+const rankAndDedupeConcerns = (concerns) => {
+	const byContent = /* @__PURE__ */ new Map();
+	for (const concern of concerns) {
+		const key = reviewConcernKey(concern);
+		const previous = byContent.get(key);
+		if (previous === void 0 || severityRank[concern.severity] < severityRank[previous.severity]) byContent.set(key, concern);
+	}
+	return [...byContent.values()].sort((left, right) => severityRank[left.severity] - severityRank[right.severity]).slice(0, 10);
 };
-/** SHA-256 via `Crypto.Crypto`; unavailable crypto is a defect, not an expected failure. */
-const sha256Hex = Effect.fn("sha256Hex")(function* (text) {
-	const digest = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(text)).pipe(Effect.orDie);
-	return Encoding.encodeHex(digest);
-});
-const FIELD = "\0";
-const RECORD = "
";
-const SECTION = "";
+//#endregion
+//#region src/internal/fan-out.ts
+/** One discovery pass returns at most this many anchored candidates. */
+const MAX_CHILD_FINDINGS = 6;
+/** One discovery pass returns at most this many non-anchored candidates. */
+const MAX_CHILD_CONCERNS = 3;
+/** Every unit receives independent general and specialist discovery passes. */
+const MAX_UNIT_CANDIDATES = 18;
 /**
-* Unified-diff hunk coordinates describe where a patch applies, not what it
-* changes. A content-equivalent rebase can shift both coordinates while
-* leaving every context/addition/deletion line unchanged, so exclude only
-* those coordinates from the canonical patch representation.
+* General + specialist discovery for every unit, then one verifier per unit.
+* The one-retry budget doubles the worst-case child Run count, but the
+* schedule itself never exceeds this bound.
 */
-const canonicalPatch = (patch) => patch.replace(/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/gm, "@@ -_ +_ @@");
+const MAX_REVIEW_CHILDREN = 24;
+/** Bounded structured concurrency across units; passes inside a unit are sequential. */
+const REVIEW_UNIT_CONCURRENCY = 4;
+/** Structural minimum for a child that exposes no tools. */
+const MAX_FILE_REVIEW_TOOL_CALLS = 1;
+const ReviewWorkPhase = Schema.Literals(["discovery", "verification"]);
+const ReviewWorkPerspective = Schema.Literals([
+	"general",
+	"risk-specialist",
+	"candidate-verification"
+]);
+const ReviewCandidateId = Schema.NonEmptyString.check(Schema.isMaxLength(96));
+var FindingCandidate = class extends Schema.TaggedClass()("FindingCandidate", {
+	candidateId: ReviewCandidateId,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	finding: ReviewFinding,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(1))
+}) {};
+var ConcernCandidate = class extends Schema.TaggedClass()("ConcernCandidate", {
+	candidateId: ReviewCandidateId,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	concern: ReviewConcern,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
+}) {};
+const ReviewCandidate = Schema.Union([FindingCandidate, ConcernCandidate]);
+/** Deterministic host equivalence for claims repeated across discovery passes. */
+const reviewCandidateSubjectKey = (candidate) => candidate._tag === "FindingCandidate" ? `finding:${JSON.stringify(Schema.encodeSync(ReviewFinding)(candidate.finding))}` : `concern:${JSON.stringify(Schema.encodeSync(ReviewConcern)(candidate.concern))}`;
+var CandidateAssessment = class extends Schema.Class("@effect-agent/pr-review/CandidateAssessment")({
+	candidateId: ReviewCandidateId,
+	disposition: Schema.Literals(["confirmed", "rejected"]),
+	/**
+	* Exact suggestion settlement: required when the candidate finding carries
+	* a suggestion, forbidden otherwise. Untrusted child output cannot publish
+	* a GitHub replacement block by prompt compliance alone — the host keeps a
+	* confirmed finding's suggestion only on an exact "committable" settlement.
+	*/
+	suggestion: Schema.optionalKey(Schema.Literals(["committable", "not-committable"]).annotate({ description: "Required exactly when the candidate finding carries a suggestion: \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else. Forbidden for candidates without a suggestion." })),
+	rationale: Schema.NonEmptyString.check(Schema.isMaxLength(600))
+}) {};
 /**
-* Canonical changeset encoding: sorted by path so provider ordering never
-* matters, with every review-relevant field of every file.
+* Exact suggestion settlement shape: a carried suggestion must be settled and
+* nothing else may be. A verification report that violates it is treated as a
+* misbehaving pass and retried within the pass budget.
 */
-const canonicalChangeset = (files) => files.map((file) => `${file.path}${FIELD}${file.status}${FIELD}${String(file.additions)}${FIELD}${String(file.deletions)}${FIELD}${file.patch === void 0 ? "" : canonicalPatch(file.patch)}${FIELD}${file.reviewBaseContent ?? ""}${FIELD}${file.reviewHeadContent ?? ""}`).sort().join(RECORD);
+const assessmentSettlesSuggestionExactly = (assessment, candidate) => candidate._tag === "FindingCandidate" && candidate.finding.suggestion !== void 0 ? assessment.suggestion !== void 0 : assessment.suggestion === void 0;
 /**
-* Fingerprint one review's complete input surface: the (already
-* ignore-filtered) changeset plus the caller's prompt signature — the
-* rendered instructions and any review-shaping options the instructions do
-* not carry.
+* Fail-closed publication of a confirmed finding: only an exact "committable"
+* settlement keeps the suggestion; anything else publishes the finding with
+* the suggestion stripped so unverified text can never become a one-click
+* GitHub replacement block.
 */
-const computeChangesetFingerprint = (files, signature) => sha256Hex(`${canonicalChangeset(files)}${SECTION}${signature}`);
-/** Profile fingerprints are SHA-256 over configuration-only signatures. */
-const computeProfileFingerprint = (signature) => sha256Hex(signature);
-//#endregion
-//#region src/internal/review-state.ts
-const ReviewMode = Schema.Literals(["incremental", "final"]);
-const ReviewScopeMode = Schema.Literals(["incremental", "full"]);
-const GitCommitSha = Schema.NonEmptyString.check(Schema.isMaxLength(64), Schema.isPattern(/^[0-9a-f]{40,64}$/));
-const Fingerprint = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
-const StoredText = Schema.NonEmptyString.check(Schema.isMaxLength(800));
-/** A compact unresolved finding suitable for the bounded review-body marker. */
-var StoredReviewFinding = class extends Schema.Class("@effect-agent/pr-review/StoredReviewFinding")({
+const confirmedFindingForPublication = (assessment, candidate) => {
+	if (candidate.finding.suggestion === void 0 || assessment.suggestion === "committable") return candidate.finding;
+	const { suggestion: _stripped, ...finding } = candidate.finding;
+	return ReviewFinding.make(finding);
+};
+/**
+* Concern candidates need explicit paths internally to bind the claim to
+* scheduled evidence. The verifier receives the complete bounded unit so it
+* can use neighboring evidence to falsify the claim. The host copies these
+* validated paths onto a confirmed public concern for incremental continuity.
+*/
+var DiscoveredConcern = class extends Schema.Class("@effect-agent/pr-review/DiscoveredConcern")({
+	concern: ReviewConcern,
+	evidencePaths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(3))
+}) {};
+const UnitPaths = Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** Bounded prior-review context lines injected into discovery instructions. */
+const UnitContextLines = Schema.Array(Schema.String.check(Schema.isMaxLength(1200))).check(Schema.isMaxLength(20));
+const RiskCategories = Schema.Array(ReviewRiskCategory).check(Schema.isMaxLength(6));
+const Candidates = Schema.Array(ReviewCandidate).check(Schema.isMaxLength(18));
+const EvidenceShardIds = Schema.Array(ReviewEvidenceShardId).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12));
+/** One complete host-selected evidence shard supplied to a review child. */
+var FileReviewEvidence = class extends Schema.Class("@effect-agent/pr-review/FileReviewEvidence")({
+	shardId: ReviewEvidenceShardId,
 	path: ChangedPath,
-	startLine: Schema.Int.check(Schema.isGreaterThan(0)),
-	endLine: Schema.Int.check(Schema.isGreaterThan(0)),
-	severity: FindingSeverity,
-	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
-	body: StoredText
+	status: ChangedFileStatus,
+	reviewMode: Schema.Literals([
+		"diff",
+		"content",
+		"unavailable"
+	]),
+	ordinal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	total: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+	annotatedPatch: Schema.String.check(Schema.isMaxLength(MAX_PATCH_CHARS))
 }) {};
-/** A compact unresolved non-anchored concern carried until a final audit. */
-var StoredReviewConcern = class extends Schema.Class("@effect-agent/pr-review/StoredReviewConcern")({
-	severity: FindingSeverity,
-	title: Schema.NonEmptyString.check(Schema.isMaxLength(120)),
-	body: StoredText
+/** Host-prepared child input with complete bounded diff/content evidence. */
+var FileReviewBrief = class extends Schema.Class("@effect-agent/pr-review/FileReviewBrief")({
+	phase: ReviewWorkPhase,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	paths: UnitPaths,
+	evidenceShardIds: EvidenceShardIds,
+	perspective: ReviewWorkPerspective,
+	riskCategories: RiskCategories,
+	/** Empty for discovery; the exact discovered set for unit verification. */
+	candidates: Candidates,
+	evidence: Schema.Array(FileReviewEvidence).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12)),
+	/** Maintainer-adjudicated identities on this unit; do not re-raise. */
+	adjudicatedContext: Schema.optionalKey(UnitContextLines),
+	/** Prior-round findings on this unit's re-reviewed paths. */
+	priorFindingContext: Schema.optionalKey(UnitContextLines)
 }) {};
-/** The carried-scope bound; a run that cannot fit its leftovers publishes no state. */
-const MAX_STORED_UNREVIEWED_PATHS = 100;
-/** Failed-pass records stored beside the leftover paths; one per unit stage. */
-const MAX_STORED_UNREVIEWED_PASSES = 24;
-/** Stages a leftover path may need retried without a second general discovery. */
-const UnreviewedStage = Schema.Literals([
-	"discovery",
-	"specialist",
-	"verification"
-]);
-/** One failed fan-out pass whose paths should be retried, not rediscovered. */
-var StoredUnreviewedPass = class extends Schema.Class("@effect-agent/pr-review/StoredUnreviewedPass")({
-	stage: UnreviewedStage,
-	paths: Schema.Array(ChangedPath).check(Schema.isMinLength(1)).check(Schema.isMaxLength(12))
+/** Child output; phase-inapplicable collections must be empty. */
+var FileReviewReport = class extends Schema.Class("@effect-agent/pr-review/FileReviewReport")({
+	phase: ReviewWorkPhase,
+	workId: ReviewPassId,
+	unitId: ReviewUnitId,
+	findings: Schema.Array(ReviewFinding).check(Schema.isMaxLength(6)),
+	concerns: Schema.Array(DiscoveredConcern).check(Schema.isMaxLength(3)),
+	fileSummaries: Schema.Array(WalkthroughEntry).check(Schema.isMaxLength(12)),
+	assessments: Schema.Array(CandidateAssessment).check(Schema.isMaxLength(18))
 }) {};
 /**
-* Versioned state embedded after EVERY completed run that can be signed. The
-* head plus full-scope fingerprint forms an incremental baseline; an absent
-* unresolved item never means the path is defect-free. `unreviewedPaths`
-* carries retryable review gaps (failed passes) forward so the next
-* incremental run re-reviews exactly them plus the new delta — the baseline
-* advances monotonically instead of freezing on one flaky pass and reopening
-* the whole post-baseline scope. The `acceptedScopeFingerprint` name is
-* retained for wire compatibility. Storing hundreds of path strings
-* separately would not fit GitHub's bounded review body in the worst case.
+* A structurally valid child report that does not answer the scheduled pass:
+* wrong identity, phase-inapplicable fields, or an inexact assessment set.
+* Retried once like any other pass fault, because it is model misbehavior,
+* not evidence about the code under review.
 */
-var ReviewState = class extends Schema.Class("@effect-agent/pr-review/ReviewState")({
-	version: Schema.Literal(2),
-	repository: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
-	pullRequestNumber: Schema.Int.check(Schema.isGreaterThan(0)),
-	baseRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	baseSha: GitCommitSha,
-	headRef: Schema.NonEmptyString.check(Schema.isMaxLength(300)),
-	reviewedHeadSha: GitCommitSha,
-	profileFingerprint: Fingerprint,
-	acceptedScopeFingerprint: Fingerprint,
-	reviewedPathCount: Schema.Int.check(Schema.isBetween({
-		minimum: 0,
-		maximum: 300
-	})),
-	unresolvedFindings: Schema.Array(StoredReviewFinding).check(Schema.isMaxLength(20)),
-	unresolvedConcerns: Schema.Array(StoredReviewConcern).check(Schema.isMaxLength(10)),
-	/** Retryable review gaps carried into the next incremental run's scope. */
-	unreviewedPaths: Schema.Array(ChangedPath).check(Schema.isMaxLength(100)),
-	/**
-	* Which failed pass produced those leftovers. Absent on state-v2 markers
-	* written before this field existed; those leftovers still re-enter scope
-	* but cannot skip rediscovery. Present (including empty) on new markers.
-	*/
-	unreviewedPasses: Schema.optionalKey(Schema.Array(StoredUnreviewedPass).check(Schema.isMaxLength(24))),
-	/**
-	* True only when the producing run had complete input coverage, no
-	* unsettled pass, and nothing carried. Skip-unchanged authority: an
-	* unchanged patch may skip re-review only over a settled state.
-	*/
-	settled: Schema.Boolean,
-	lastReviewMode: ReviewScopeMode
-}) {};
-const toStoredFinding = (finding) => StoredReviewFinding.make({
-	path: finding.path,
-	startLine: finding.startLine,
-	endLine: finding.endLine,
-	severity: finding.severity,
-	title: finding.title,
-	body: finding.body.slice(0, 800)
-});
-const fromStoredFinding = (finding) => ReviewFinding.make({
-	path: finding.path,
-	startLine: finding.startLine,
-	endLine: finding.endLine,
-	severity: finding.severity,
-	title: finding.title,
-	body: finding.body
-});
-const toStoredConcern = (concern) => StoredReviewConcern.make({
-	severity: concern.severity,
-	title: concern.title,
-	body: concern.body.slice(0, 800)
-});
-const fromStoredConcern = (concern) => ReviewConcern.make({
-	severity: concern.severity,
-	title: concern.title,
-	body: concern.body
-});
-const STATE_MARKER_PREFIX = "<!-- effect-agent-pr-review state-v2:";
-const STATE_MARKER_SUFFIX = " -->";
-const STATE_MARKER_PATTERN = /(?:^|\n)<!-- effect-agent-pr-review state-v2:([A-Za-z0-9+/]+={0,2})\.([0-9a-f]{64}) -->$/;
-const STATE_SIGNATURE_DOMAIN = "effect-agent-pr-review/state-v2\0";
-const MAX_REVIEW_STATE_MARKER_CHARS = 24e3;
-const ReviewStateMarker = Schema.NonEmptyString.check(Schema.isMaxLength(MAX_REVIEW_STATE_MARKER_CHARS), Schema.isPattern(/^<!-- effect-agent-pr-review state-v2:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->$/)).pipe(Schema.brand("@effect-agent/pr-review/ReviewStateMarker"));
-var ReviewStateAuthenticationFailure = class extends Schema.TaggedError()("ReviewStateAuthenticationFailure", {
-	operation: Schema.Literals(["sign", "verify"]),
-	reason: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
-}) {};
-var ReviewStateMarkerTooLarge = class extends Schema.TaggedError()("ReviewStateMarkerTooLarge", {
-	observedChars: Schema.Int.check(Schema.isGreaterThan(0)),
-	maximumChars: Schema.Int.check(Schema.isGreaterThan(0))
+var ReviewPassMisbehaved = class extends Schema.TaggedError()("ReviewPassMisbehaved", {
+	workId: ReviewPassId,
+	reason: Schema.NonEmptyString.check(Schema.isMaxLength(600))
 }) {};
-var ReviewStateAuthenticator = class extends Context.Service()("@effect-agent/pr-review/ReviewStateAuthenticator") {};
-const authenticationFailure = (operation, cause) => ReviewStateAuthenticationFailure.make({
-	operation,
-	reason: String(cause).slice(0, 2048)
+const staticGuidanceLines = (guidance) => {
+	if (guidance === void 0) return [];
+	return (typeof guidance === "string" ? [guidance] : guidance).filter((line) => line.length > 0);
+};
+const evidenceInstructions = [
+	"The host placed complete bounded review evidence shards in the input evidence array. Treat every shard as required input; ordinal/total identifies multi-shard paths.",
+	"You have no tools and cannot roam outside this evidence. If it is insufficient for a candidate, reject or omit that candidate rather than guessing.",
+	"A diff marks new-version anchors as R<number>; only those lines may anchor findings. B/H content evidence is non-anchorable."
+];
+/** Discovery and verification instructions share one child definition. */
+const makeFileReviewerInstructions = (options = {}) => (brief) => {
+	const common = [
+		`You are an attached review worker for ${brief.workId} in host-planned unit ${brief.unitId}: ${brief.paths.join(", ")}.`,
+		...staticGuidanceLines(options.guidance),
+		...evidenceInstructions
+	];
+	if (brief.phase === "verification") return [
+		...common,
+		"Independently verify every candidate in the input. You did not receive another reviewer's transcript or reasoning; use only the candidate claim and bounded evidence.",
+		"The evidence array contains the complete bounded unit, including neighboring changed code that may confirm or falsify a locally plausible claim.",
+		"For each candidate, try to falsify it first. Confirm only when the cited behavior is supported and actionable. Reject unsupported, speculative, duplicate, or non-actionable candidates.",
+		"Return ONLY JSON with phase \"verification\", the exact workId/unitId, empty findings/concerns/fileSummaries arrays, and exactly one assessment per candidateId. Each assessment is {\"candidateId\": <exact id>, \"disposition\": <\"confirmed\" | \"rejected\">, \"suggestion\": <\"committable\" | \"not-committable\", present exactly when the candidate finding carries a suggestion>, \"rationale\": <bounded evidence-based reason>}. Never add or omit an id.",
+		"Settle every carried suggestion independently of the claim: answer \"committable\" only when its text is the full replacement source for exactly lines startLine..endLine and nothing else — it compiles in context and preserves the finding's intent, never prose describing a change. Otherwise answer \"not-committable\"; the host then publishes the confirmed finding without its suggestion. Omit the assessment \"suggestion\" field for candidates without one."
+	].join("\n");
+	const focus = brief.perspective === "risk-specialist" ? brief.riskCategories.length > 0 ? `This is a fresh specialist discovery pass. Concentrate on these host-classified risks without relying on another pass: ${brief.riskCategories.join(", ")}.` : "This is a fresh specialist discovery pass. The host found no keyword-classified category, so independently scrutinize authentication/authorization, security boundaries, durability, concurrency, credentials, and external side effects rather than treating classification silence as low risk." : "This is the general discovery pass. Review broadly for correctness, security, concurrency, resource, API, and error-handling defects.";
+	const adjudicated = brief.adjudicatedContext ?? [];
+	const priorFindings = brief.priorFindingContext ?? [];
+	return [
+		...common,
+		focus,
+		...adjudicated.length === 0 ? [] : ["A maintainer has adjudicated these previously raised items on this unit (disposition, reason). Do not re-raise them unless you have materially new evidence, and if you do, say explicitly what changed since the adjudication:", ...adjudicated.map((line) => `- ${line}`)],
+		...priorFindings.length === 0 ? [] : ["A previous review round raised these findings on this unit's paths. For each, either confirm it still holds, state that it is fixed, or withdraw it; do not demand the opposite of that prior guidance without explicitly acknowledging the reversal:", ...priorFindings.map((line) => `- ${line}`)],
+		"The discovery evidence array contains every complete shard in the unit. Review every entry and every shard of a multi-shard path. A later independent verifier, not you, decides which candidates publish.",
+		"Every non-anchored concern must list 1-3 exact evidencePaths to bind the claim to scheduled evidence. Report one root concern once; never split it into differently worded restatements.",
+		`Return ONLY JSON with phase "discovery", the exact workId/unitId, up to 6 findings, up to 3 concerns shaped as {concern, evidencePaths}, one factual file summary per path (<= 240 chars), and an empty assessments array. Empty candidate arrays are valid; do not invent defects.`,
+		"Each finding is {\"path\": <a unit file path>, \"startLine\": <integer, an R-marked new-file line>, \"endLine\": <integer, >= startLine, same file, R-marked>, \"severity\": <\"blocking\" | \"important\" | \"nit\">, \"category\": <OPTIONAL problem-kind label>, \"title\": <string, <= 120 chars>, \"body\": <string, why it matters and what to do>, \"suggestion\": <string, OPTIONAL: replacement source code for exactly lines startLine..endLine, ready to commit>}.",
+		"Include \"suggestion\" only when you are confident the replacement compiles and preserves intent; its text must contain the full replacement source for every line in the range and nothing else — never prose describing the change, which belongs in \"body\"."
+	].join("\n");
+};
+const fileReviewerInstructions = makeFileReviewerInstructions();
+const FileReviewToolkit = Toolkit.empty;
+const defaultFileReviewerPolicy = AgentPolicy.make({
+	maxTurns: 6,
+	maxToolCalls: 1,
+	maxDuration: "6 minutes",
+	toolConcurrency: 2,
+	repeatedFailureLimit: 6,
+	tokenBudget: 2e5,
+	contextTokenLimit: 15e4,
+	toolResultBounds: ToolResultBounds.make({ maxBytes: REVIEW_TOOL_RESULT_MAX_BYTES }),
+	onExhaustion: "fail"
 });
-const hmacKey = (secret, operation) => Effect.tryPromise({
-	try: () => globalThis.crypto.subtle.importKey("raw", new TextEncoder().encode(Redacted.value(secret)), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign", "verify"]),
-	catch: (cause) => authenticationFailure(operation, cause)
+const makeFileReviewerDefinition = (options = {}) => Agent.define("pr-review-worker", {
+	input: FileReviewBrief,
+	output: FileReviewReport,
+	instructions: makeFileReviewerInstructions(options),
+	toolkit: FileReviewToolkit,
+	policy: defaultFileReviewerPolicy,
+	description: "Perform one bounded discovery or independent candidate-verification pass over host-supplied pull-request evidence.",
+	metadata: {
+		deploymentClass: "E",
+		surface: "read-only",
+		stage: "discovery-verification"
+	}
 });
-const signatureBytes = (signature) => {
-	const pairs = signature.match(/../g) ?? [];
-	const buffer = new ArrayBuffer(pairs.length);
-	const bytes = new Uint8Array(buffer);
-	for (let index = 0; index < pairs.length; index += 1) bytes[index] = Number.parseInt(pairs[index] ?? "", 16);
-	return buffer;
-};
-/** Validated WebCrypto adapter selected at the Action composition root. */
-const webCryptoReviewStateAuthenticatorLayer = (secret) => Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
-	status: "available",
-	unavailableReason: void 0,
-	render: (state) => Effect.gen(function* () {
-		const json = yield* Schema.encodeUnknownEffect(Schema.fromJsonString(ReviewState))(state).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
-		const payload = Encoding.encodeBase64(json);
-		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
-		const key = yield* hmacKey(secret, "sign");
-		const signature = yield* Effect.tryPromise({
-			try: () => globalThis.crypto.subtle.sign("HMAC", key, message),
-			catch: (cause) => authenticationFailure("sign", cause)
-		});
-		const hex = Array.from(new Uint8Array(signature)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-		const marker = `${STATE_MARKER_PREFIX}${payload}.${hex}${STATE_MARKER_SUFFIX}`;
-		if (marker.length > 24e3) return yield* ReviewStateMarkerTooLarge.make({
-			observedChars: marker.length,
-			maximumChars: MAX_REVIEW_STATE_MARKER_CHARS
-		});
-		return yield* Schema.decodeUnknownEffect(ReviewStateMarker)(marker).pipe(Effect.mapError((cause) => authenticationFailure("sign", cause)));
-	}),
-	extract: (body) => {
-		if (body.length > 6e4) return Effect.succeed(Option.none());
-		const match = STATE_MARKER_PATTERN.exec(body);
-		const payload = match?.[1];
-		const signature = match?.[2];
-		if (payload === void 0 || signature === void 0) return Effect.succeed(Option.none());
-		const marker = `${STATE_MARKER_PREFIX}${payload}.${signature}${STATE_MARKER_SUFFIX}`;
-		if (!Schema.is(ReviewStateMarker)(marker)) return Effect.succeed(Option.none());
-		const json = Result.getOrUndefined(Encoding.decodeBase64String(payload));
-		if (json === void 0) return Effect.succeed(Option.none());
-		const decoded = Schema.decodeUnknownOption(Schema.fromJsonString(ReviewState))(json);
-		if (Option.isNone(decoded)) return Effect.succeed(Option.none());
-		const message = new TextEncoder().encode(`${STATE_SIGNATURE_DOMAIN}${payload}`);
-		return Effect.gen(function* () {
-			const key = yield* hmacKey(secret, "verify");
-			return (yield* Effect.tryPromise({
-				try: () => globalThis.crypto.subtle.verify("HMAC", key, signatureBytes(signature), message),
-				catch: (cause) => authenticationFailure("verify", cause)
-			})) ? Option.some(decoded.value) : Option.none();
-		});
+const FileReviewer = makeFileReviewerDefinition();
+const candidateOrdinal = (index) => String(index + 1).padStart(3, "0");
+/** Rebuild one unit's complete evidence from the same snapshot the plan used. */
+const unitEvidence = (unit, files) => Effect.gen(function* () {
+	const byPath = new Map(files.map((file) => [file.path, file]));
+	const evidence = [];
+	for (const shard of unit.evidenceShards) {
+		const file = byPath.get(shard.path);
+		const chunk = file === void 0 ? void 0 : fileReviewEvidenceChunks(file)[shard.ordinal - 1];
+		if (file === void 0 || chunk === void 0) return yield* Effect.die(/* @__PURE__ */ new Error(`planned evidence shard has no source: ${shard.shardId} (${shard.path})`));
+		evidence.push(FileReviewEvidence.make({
+			shardId: shard.shardId,
+			path: shard.path,
+			status: file.status,
+			reviewMode: chunk.reviewMode,
+			ordinal: shard.ordinal,
+			total: shard.total,
+			annotatedPatch: chunk.annotatedPatch
+		}));
 	}
-}));
-/** Explicit no-state implementation for hosts without a stable authentication secret. */
-const unavailableReviewStateAuthenticatorLayer = (reason) => {
-	const safeReason = reason === "" ? "review-state authentication is unavailable" : reason;
-	return Layer.succeed(ReviewStateAuthenticator)(ReviewStateAuthenticator.of({
-		status: "unavailable",
-		unavailableReason: safeReason.slice(0, 1e3),
-		render: () => Effect.fail(ReviewStateAuthenticationFailure.make({
-			operation: "sign",
-			reason: safeReason.slice(0, 2048)
-		})),
-		extract: () => Effect.succeed(Option.none())
-	}));
-};
-/** The bounded result of GitHub's previous-head...current-head comparison. */
-var ReviewHeadComparison = class extends Schema.Class("@effect-agent/pr-review/ReviewHeadComparison")({
-	status: Schema.Literals([
-		"ahead",
-		"behind",
-		"diverged",
-		"identical"
-	]),
-	baseSha: GitCommitSha,
-	headSha: GitCommitSha,
-	mergeBaseSha: GitCommitSha,
-	files: Schema.Array(ChangedFile).check(Schema.isMaxLength(300)),
-	/** GitHub caps compare-file payloads at 300; equality is conservatively truncated. */
-	truncated: Schema.Boolean
-}) {};
-const fullSelection = (input) => ({
-	mode: "full",
-	reason: input.reason,
-	files: input.files,
-	affectedPaths: input.files.flatMap((file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath]),
-	retryPaths: [],
-	retryStages: [],
-	totalFiles: input.totalFiles,
-	baselineSha: void 0,
-	priorState: void 0,
-	profileFingerprint: input.profileFingerprint
+	return evidence;
 });
-/** Three-dot lineage from the reviewed head to the current head is usable. */
-const isLineageAncestor = (comparison, priorState, currentHeadSha) => comparison.baseSha === priorState.reviewedHeadSha && comparison.headSha === currentHeadSha && comparison.mergeBaseSha === priorState.reviewedHeadSha && !comparison.truncated && (comparison.status === "ahead" || comparison.status === "identical");
+const misbehaved = (workId, reason) => ReviewPassMisbehaved.make({
+	workId,
+	reason: reason.slice(0, 600)
+});
+/** Validate that a verification report assesses exactly the scheduled candidates. */
+const validateVerificationReport = (brief, report) => {
+	if (report.findings.length > 0 || report.concerns.length > 0 || report.fileSummaries.length > 0) return misbehaved(brief.workId, "verification output contained discovery-only fields");
+	const expectedById = new Map(brief.candidates.map((candidate) => [candidate.candidateId, candidate]));
+	const assessedIds = /* @__PURE__ */ new Set();
+	for (const assessment of report.assessments) {
+		const candidate = expectedById.get(assessment.candidateId);
+		if (candidate === void 0 || assessedIds.has(assessment.candidateId)) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+		if (!assessmentSettlesSuggestionExactly(assessment, candidate)) return misbehaved(brief.workId, "verification output did not settle suggestion publication exactly");
+		assessedIds.add(assessment.candidateId);
+	}
+	if (assessedIds.size !== expectedById.size) return misbehaved(brief.workId, "verification output did not assess the exact candidate set");
+};
 /**
-* Validate that persisted state belongs to this exact PR/base lineage and the
-* same review profile. A mismatch is a full-review reason, never an error that
-* silently suppresses review work.
+* Run one scheduled pass: execute the child, decode its report, and enforce
+* the pass contract. Any typed fault — child failure, malformed or misdirected
+* output — is retried once; budget exhaustion is terminal because a retry
+* would fail the same way. The settled outcome is a value either way, so one
+* flaky pass can never fail the whole pipeline.
 */
-const validateReviewState = (state, current, profileFingerprint) => {
-	if (state.repository !== current.repository || state.pullRequestNumber !== current.number) return "stored state belongs to a different pull request";
-	if (current.baseSha === void 0) return "the current base commit is unavailable";
-	if (state.baseRef !== current.baseRef) return "the pull request base ref changed";
-	if (state.headRef !== current.headRef) return "the pull request head ref changed";
-	if (state.profileFingerprint !== profileFingerprint) return "the reviewer profile or model configuration changed";
-};
-const filePaths = (file) => file.previousPath === void 0 ? [file.path] : [file.path, file.previousPath];
-const incrementalFromDelta = (input) => {
-	const currentPaths = new Set(input.fullFiles.flatMap(filePaths));
-	const affectedPaths = /* @__PURE__ */ new Set([...input.deltaFiles.flatMap(filePaths), ...input.extraAffectedPaths ?? []]);
-	const selectedByPath = /* @__PURE__ */ new Map();
-	for (const file of input.deltaFiles) if (currentPaths.has(file.path) || file.previousPath !== void 0 && currentPaths.has(file.previousPath)) selectedByPath.set(file.path, file);
-	const carriedPaths = input.priorState.unreviewedPaths.filter((path) => currentPaths.has(path));
-	const surgical = input.priorState.unreviewedPasses !== void 0;
-	const retryOnly = /* @__PURE__ */ new Set();
-	const retryStages = /* @__PURE__ */ new Set();
-	for (const path of carriedPaths) {
-		if (affectedPaths.has(path)) continue;
-		retryOnly.add(path);
-		if (surgical) {
-			for (const pass of input.priorState.unreviewedPasses ?? []) if (pass.paths.includes(path)) retryStages.add(pass.stage);
-		} else affectedPaths.add(path);
-	}
-	if (surgical && retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) {
-		retryStages.add("discovery");
-		retryStages.add("specialist");
-	}
-	if (surgical && retryOnly.size > 0 && retryStages.size === 0) {
-		for (const path of retryOnly) affectedPaths.add(path);
-		retryStages.add("discovery");
-		retryStages.add("specialist");
-		retryStages.add("verification");
+const runReviewPass = (binding, brief, budget) => Effect.gen(function* () {
+	const result = yield* AgentRuntime.run(binding, brief, {
+		...budget === void 0 ? {} : { budget },
+		estimateCostMicrousd: () => Effect.succeed(500)
+	});
+	const report = yield* Schema.decodeUnknownEffect(FileReviewReport)(result.output).pipe(Effect.mapError((error) => misbehaved(brief.workId, `child report failed to decode: ${error.message}`)));
+	if (report.phase !== brief.phase || report.workId !== brief.workId || report.unitId !== brief.unitId) return yield* misbehaved(brief.workId, "child report identity does not match the scheduled pass");
+	if (brief.phase === "verification") {
+		const violation = validateVerificationReport(brief, report);
+		if (violation !== void 0) return yield* violation;
+	} else if (report.assessments.length > 0) return yield* misbehaved(brief.workId, "discovery output contained verification-only assessments");
+	return {
+		report,
+		turns: result.turns
+	};
+}).pipe(Effect.scoped, Effect.retry({
+	times: 1,
+	while: (error) => error._tag !== "BudgetExceeded"
+}), Effect.map((settled) => ({
+	_tag: "settled",
+	...settled
+})), Effect.catch((error) => Effect.succeed({
+	_tag: "failed",
+	errorTag: String(error._tag).slice(0, 256)
+})));
+/**
+* Keep only findings anchored inside the pass's exact assigned evidence and
+* concerns bound to unit paths. Everything else is discarded and counted —
+* an invalid anchor invalidates one claim, never the pass that produced it.
+*/
+const harvestDiscovery = (pass, unit, files, anchorFiles, report) => {
+	const allowed = new Set(pass.paths);
+	let discarded = 0;
+	const keptFindings = [];
+	for (const finding of report.findings) {
+		if (!allowed.has(finding.path) || anchorViolation(finding, anchorFiles) !== void 0 || !findingAnchorInUnitEvidence(finding, unit, files)) {
+			discarded += 1;
+			continue;
+		}
+		keptFindings.push(finding);
 	}
-	if (carriedPaths.length > 0 || (input.extraAffectedPaths?.length ?? 0) > 0) {
-		for (const file of input.fullFiles) if (affectedPaths.has(file.path) || file.previousPath !== void 0 && affectedPaths.has(file.previousPath) || retryOnly.has(file.path) || file.previousPath !== void 0 && retryOnly.has(file.previousPath)) selectedByPath.set(file.path, file);
+	const keptConcerns = [];
+	for (const candidate of report.concerns) {
+		if (candidate.evidencePaths.some((path) => !allowed.has(path))) {
+			discarded += 1;
+			continue;
+		}
+		keptConcerns.push(candidate);
 	}
-	const selectedFiles = [...selectedByPath.values()].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
-	const leftoverCount = [...retryOnly].filter((path) => !affectedPaths.has(path)).length;
-	const carriedReason = leftoverCount > 0 && surgical ? `; retrying ${leftoverCount} unchanged leftover path(s) without rediscovery` : carriedPaths.length > 0 ? `; retrying ${carriedPaths.length} carried unreviewed path(s)` : "";
 	return {
-		mode: "incremental",
-		reason: `${input.reason}${carriedReason}`,
-		files: selectedFiles,
-		affectedPaths: [...affectedPaths].sort(),
-		retryPaths: [...retryOnly].filter((path) => !affectedPaths.has(path)).sort(),
-		retryStages: [...retryStages].sort(),
-		totalFiles: selectedFiles.length,
-		baselineSha: input.priorState.reviewedHeadSha,
-		priorState: input.priorState,
-		profileFingerprint: input.profileFingerprint
+		candidates: [...keptFindings.map((finding, index) => FindingCandidate.make({
+			candidateId: `${pass.passId}:finding:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
+			finding,
+			evidencePaths: [finding.path]
+		})), ...keptConcerns.map((candidate, index) => ConcernCandidate.make({
+			candidateId: `${pass.passId}:concern:${candidateOrdinal(index)}`,
+			workId: pass.passId,
+			unitId: pass.unitId,
+			concern: candidate.concern,
+			evidencePaths: candidate.evidencePaths
+		}))],
+		fileSummaries: report.fileSummaries.filter((entry) => allowed.has(entry.path)),
+		discarded
 	};
 };
-/** Pure, deterministic range selection with conservative full-review fallbacks. */
-const selectReviewRange = (input) => {
-	const full = (reason) => fullSelection({
-		reason,
-		files: input.fullFiles,
-		totalFiles: input.current.totalChangedFiles,
-		profileFingerprint: input.profileFingerprint
-	});
-	if (input.requestedMode === "final") return full("explicit final full-diff audit requested");
-	if (input.lookupFailure !== void 0) return full(`stored review state could not be recovered: ${input.lookupFailure}`);
-	if (input.priorState === void 0) return full("no compatible stored review state was found");
-	const invalid = validateReviewState(input.priorState, input.current, input.profileFingerprint);
-	if (invalid !== void 0) return full(invalid);
-	const comparison = input.comparison;
-	if (comparison !== void 0 && isLineageAncestor(comparison, input.priorState, input.current.headSha)) {
-		const extraAffected = [];
-		let baseReason = "";
-		if (input.priorState.baseSha !== input.current.baseSha) {
-			const baseComparison = input.baseComparison;
-			if (baseComparison === void 0) return full("the pull request base changed and its lineage comparison was unavailable");
-			if (baseComparison.baseSha !== input.priorState.baseSha || baseComparison.headSha !== input.current.baseSha || baseComparison.mergeBaseSha !== input.priorState.baseSha || baseComparison.status !== "ahead" && baseComparison.status !== "identical" || baseComparison.truncated) return full("the pull request base changed materially or exceeded the comparison bound");
-			for (const file of baseComparison.files) extraAffected.push(...filePaths(file));
-			baseReason = `; base advanced from ${input.priorState.baseSha.slice(0, 7)} and overlapping PR paths were included`;
+const reviewUnit = (binding, unit, passes, input) => Effect.gen(function* () {
+	const evidence = yield* unitEvidence(unit, input.files);
+	const failedPasses = [];
+	const candidates = [];
+	const subjects = /* @__PURE__ */ new Set();
+	const walkthrough = [];
+	let discardedFindings = 0;
+	let turns = 0;
+	let completedGeneralPasses = 0;
+	let completedSpecialistPasses = 0;
+	const unitPaths = new Set(unit.paths);
+	const adjudicatedContext = (input.priorContext?.adjudicated ?? []).filter((entry) => entry.path === void 0 || unitPaths.has(entry.path)).map((entry) => entry.line).slice(0, 20);
+	const priorFindingContext = (input.priorContext?.priorFindings ?? []).filter((entry) => unitPaths.has(entry.path)).map((entry) => entry.line).slice(0, 20);
+	for (const pass of passes) {
+		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
+		const brief = FileReviewBrief.make({
+			phase: "discovery",
+			workId: pass.passId,
+			unitId: pass.unitId,
+			paths: pass.paths,
+			evidenceShardIds: pass.evidenceShardIds,
+			perspective: pass.perspective,
+			riskCategories: pass.riskCategories,
+			candidates: [],
+			evidence,
+			...adjudicatedContext.length === 0 ? {} : { adjudicatedContext },
+			...priorFindingContext.length === 0 ? {} : { priorFindingContext }
+		});
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			failedPasses.push(FailedReviewPass.make({
+				workId: pass.passId,
+				stage,
+				errorTag: outcome.errorTag
+			}));
+			continue;
 		}
-		return incrementalFromDelta({
-			current: input.current,
-			fullFiles: input.fullFiles,
-			profileFingerprint: input.profileFingerprint,
-			priorState: input.priorState,
-			deltaFiles: comparison.files,
-			extraAffectedPaths: extraAffected,
-			reason: `changes since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}${baseReason}`
+		turns += outcome.turns;
+		if (stage === "specialist") completedSpecialistPasses += 1;
+		else completedGeneralPasses += 1;
+		const harvest = harvestDiscovery(pass, unit, input.files, input.anchorFiles, outcome.report);
+		discardedFindings += harvest.discarded;
+		if (pass.perspective === "general") walkthrough.push(...harvest.fileSummaries);
+		for (const candidate of harvest.candidates) {
+			const subject = reviewCandidateSubjectKey(candidate);
+			if (subjects.has(subject)) continue;
+			subjects.add(subject);
+			candidates.push(candidate);
+		}
+	}
+	const confirmed = [];
+	let rejectedCandidates = 0;
+	let unsettledCandidates = 0;
+	let completedVerificationPasses = 0;
+	const requiredVerificationPasses = candidates.length > 0 ? 1 : 0;
+	if (candidates.length > 0) {
+		const workId = `${unit.unitId}-verification`;
+		const brief = FileReviewBrief.make({
+			phase: "verification",
+			workId,
+			unitId: unit.unitId,
+			paths: unit.paths,
+			evidenceShardIds: unit.evidenceShards.map((shard) => shard.shardId),
+			perspective: "candidate-verification",
+			riskCategories: unit.riskCategories,
+			candidates,
+			evidence
 		});
+		const outcome = yield* runReviewPass(binding, brief, input.budget);
+		if (outcome._tag === "failed") {
+			unsettledCandidates = candidates.length;
+			failedPasses.push(FailedReviewPass.make({
+				workId,
+				stage: "verification",
+				errorTag: outcome.errorTag
+			}));
+		} else {
+			turns += outcome.turns;
+			completedVerificationPasses = 1;
+			const byId = new Map(candidates.map((candidate) => [candidate.candidateId, candidate]));
+			for (const assessment of outcome.report.assessments) {
+				const candidate = byId.get(assessment.candidateId);
+				if (candidate === void 0) continue;
+				if (assessment.disposition === "confirmed") confirmed.push({
+					assessment,
+					candidate
+				});
+				else rejectedCandidates += 1;
+			}
+		}
 	}
-	const contentComparison = input.contentComparison;
-	if (contentComparison !== void 0 && !contentComparison.truncated) return incrementalFromDelta({
-		current: input.current,
-		fullFiles: input.fullFiles,
-		profileFingerprint: input.profileFingerprint,
-		priorState: input.priorState,
-		deltaFiles: contentComparison.files,
-		reason: `rewritten history; contents changed since reviewed head ${input.priorState.reviewedHeadSha.slice(0, 7)}`
-	});
-	if (comparison === void 0) return full("the incremental head comparison was unavailable");
-	if (comparison.truncated) return full("the incremental comparison exceeded GitHub's file bound");
-	return full("the prior reviewed head is not an ancestor of the current head");
-};
-/** Per-run context consumed by orchestration and publication, not by the model. */
-var ReviewExecutionContext = class extends Context.Service()("@effect-agent/pr-review/ReviewExecutionContext") {};
-/**
-* Decorate the full source with the selected review range. Full anchor files
-* remain available to host-side publication validation; model tools see only
-* the selected delta and may read head context only for that delta's paths.
-*/
-const selectedPullRequestSourceLayer = (selection) => Layer.effect(PullRequestSource)(Effect.gen(function* () {
-	const source = yield* PullRequestSource;
-	const selectedPaths = new Set(selection.files.map((file) => file.path));
-	const selectedFiles = source.changedFiles.pipe(Effect.map((fullFiles) => {
-		const fullByPath = new Map(fullFiles.map((file) => [file.path, file]));
-		return selection.files.map((file) => {
-			if (file.patch !== void 0) return file;
-			const full = fullByPath.get(file.path);
-			return full === void 0 ? file : ChangedFile.make({
-				...file,
-				...full.reviewBaseContent === void 0 ? {} : { reviewBaseContent: full.reviewBaseContent },
-				...full.reviewHeadContent === void 0 ? {} : { reviewHeadContent: full.reviewHeadContent }
-			});
-		});
-	}));
-	return PullRequestSource.of({
-		metadata: source.metadata,
-		changedFiles: selectedFiles,
-		anchorFiles: source.anchorFiles,
-		readFile: (path) => selectedPaths.has(path) ? source.readFile(path) : Effect.fail(ReviewInputViolation.make({
-			input: path,
-			reason: "Path is outside this incremental review range."
+	return {
+		failedPasses,
+		discoveredCandidates: candidates.length,
+		confirmed,
+		rejectedCandidates,
+		unsettledCandidates,
+		discardedFindings,
+		walkthrough,
+		turns,
+		completedGeneralPasses,
+		completedSpecialistPasses,
+		requiredVerificationPasses,
+		completedVerificationPasses,
+		unreviewedPaths: failedPasses.length > 0 ? unit.paths : [],
+		unreviewedPasses: failedPasses.map((pass) => ({
+			stage: pass.stage,
+			paths: unit.paths
 		}))
-	});
-}));
-/** Build the full-surface mission used only to resolve profile guidance. */
-const buildProfileMission = (metadata, files) => ReviewMission.make({
-	repository: metadata.repository,
-	number: metadata.number,
-	title: metadata.title,
-	body: metadata.body,
-	baseRef: metadata.baseRef,
-	headRef: metadata.headRef,
-	changedFileCount: files.length
+	};
 });
-//#endregion
-//#region src/internal/retirement.ts
-const PositiveLine = Schema.Int.check(Schema.isGreaterThan(0));
-/** One previously posted review as observed through the retirement host. */
-var RetirableReview = class extends Schema.Class("@effect-agent/pr-review/RetirableReview")({
-	reviewId: Schema.Int.check(Schema.isGreaterThan(0)),
-	body: Schema.String.check(Schema.isMaxLength(6e4)),
-	commitSha: Schema.NonEmptyString.check(Schema.isMaxLength(64)),
-	authorNodeId: Schema.NullOr(Schema.NonEmptyString.check(Schema.isMaxLength(200))),
-	submittedAt: Schema.NullOr(Schema.DateTimeUtc)
-}) {};
-/** One inline comment attached to a previously posted review. */
-var RetirableReviewComment = class extends Schema.Class("@effect-agent/pr-review/RetirableReviewComment")({
-	nodeId: Schema.NonEmptyString.check(Schema.isMaxLength(200)),
-	path: Schema.NonEmptyString.check(Schema.isMaxLength(500)),
-	startLine: Schema.NullOr(PositiveLine),
-	endLine: Schema.NullOr(PositiveLine),
-	body: Schema.String.check(Schema.isMaxLength(65536))
-}) {};
-/** A GitHub retirement read or mutation failed. */
-var ReviewRetirementFailure = class extends Schema.TaggedError()("ReviewRetirementFailure", {
-	operation: Schema.String,
-	reason: Schema.String
-}) {
-	get message() {
-		return `Review retirement operation '${this.operation}' failed: ${this.reason}`;
-	}
-};
-/**
-* Host-side GitHub operations used by retirement. Domain code never reaches
-* into REST or GraphQL directly, and deterministic tests substitute this port.
-*/
-var ReviewRetirementHost = class extends Context.Service()("@effect-agent/pr-review/ReviewRetirementHost") {};
-/** Observable cosmetic work completed by one fail-open retirement pass. */
-var ReviewRetirementReport = class extends Schema.Class("@effect-agent/pr-review/ReviewRetirementReport")({
-	reviewsRetired: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	findingsResolved: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	commentsMinimized: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	failures: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
-}) {};
-const findingIdentity = (finding) => `${finding.path}\u0000${finding.startLine}\u0000${finding.endLine}\u0000${finding.title}`;
-const REVIEW_METADATA_PATTERN = /<!-- effect-agent-pr-review metadata\n[\s\S]*?\n-->/g;
-const FINGERPRINT_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:[0-9a-f]{64} -->/g;
-const STATE_PATTERN = /<!-- effect-agent-pr-review state-v\d+:[A-Za-z0-9+/]+={0,2}\.[0-9a-f]{64} -->/g;
-const RETIRED_ORIGINAL_PATTERN = /<!-- effect-agent-pr-review retired-original:start -->\n([\s\S]*?)\n<!-- effect-agent-pr-review retired-original:end -->/;
-const MACHINE_COMMENT_PATTERN = new RegExp(`${REVIEW_METADATA_PATTERN.source}|${FINGERPRINT_PATTERN.source}|${STATE_PATTERN.source}`, "g");
-const VERDICT_CALLOUT_PATTERN = /^(?:> \[!(?:CAUTION|IMPORTANT)\]\n> [^\n]*(?:\n> [^\n]*)*|> (?:ℹ️|✅)[^\n]*)\n*/;
-const INLINE_FINDING_TITLE_PATTERN = /^\*\*\[(?:🛑 blocking|⚠️ important|💅 nit)(?: · [a-z-]+)?\] ([^\n]+)\*\*$/;
-const MAX_REVIEW_BODY_CHARS = 6e4;
-/** The host-authored metadata marker is the authority gate for any edit. */
-const hasReviewMetadataMarker = (body) => /<!-- effect-agent-pr-review metadata\n/.test(body);
-const machineComments = (body) => Array.from(body.matchAll(MACHINE_COMMENT_PATTERN), (match) => match[0]);
-const originalVisibleBody = (body) => {
-	const retired = RETIRED_ORIGINAL_PATTERN.exec(body)?.[1];
-	if (retired !== void 0) return retired;
-	return body.replace(MACHINE_COMMENT_PATTERN, "").trim().replace(VERDICT_CALLOUT_PATTERN, "");
+const countNoun = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+const composeSummary = (plan, assurance) => {
+	const requiredDiscovery = assurance.requiredGeneralDiscoveryPasses + assurance.requiredSpecialistPasses;
+	const completedDiscovery = assurance.completedGeneralDiscoveryPasses + assurance.completedSpecialistPasses;
+	const parts = [`Reviewed ${countNoun(plan.totalFiles, "changed file")} across ${countNoun(plan.units.length, "bounded unit")}: ${completedDiscovery}/${requiredDiscovery} discovery and ${assurance.completedVerificationPasses}/${assurance.requiredVerificationPasses} verification pass(es) settled; ${assurance.confirmedCandidates} of ${countNoun(assurance.discoveredCandidates, "discovered candidate")} confirmed by independent verification.`];
+	if (assurance.failedPasses.length > 0) parts.push(`${countNoun(assurance.failedPasses.length, "pass")} did not settle; the affected paths are carried forward and retried on the next run. This is a reviewer-side gap, not a code defect.`);
+	if (assurance.discardedInvalidFindings > 0) parts.push(`${countNoun(assurance.discardedInvalidFindings, "candidate")} discarded for anchors or paths outside the assigned evidence.`);
+	if (plan.undiffablePaths.length > 0) parts.push(`${countNoun(plan.undiffablePaths.length, "path")} had no reviewable textual evidence and keep input coverage incomplete; exclude such paths with ignore globs when that is intended.`);
+	if (plan.unassignedPaths.length > 0 || plan.unassignedEvidenceShardCount > 0) parts.push("The changeset exceeded the bounded fan-out capacity; unassigned scope is reported under input coverage.");
+	parts.push("No configured pipeline can prove absence of defects; this describes settled work only.");
+	return parts.join(" ").slice(0, 4e3);
 };
-const findingLocation = (finding) => `${finding.path}:${finding.startLine}${finding.endLine === finding.startLine ? "" : `-${finding.endLine}`}`;
-const renderRetiredBody = (input) => {
-	const shortSha = input.currentState.reviewedHeadSha.slice(0, 7);
-	const comments = machineComments(input.priorBody);
-	const original = originalVisibleBody(input.priorBody);
-	const resolved = input.resolvedFindings.length === 0 ? [] : [
-		"### Findings resolved by later review",
-		"",
-		...input.resolvedFindings.map((finding) => `- \`${findingLocation(finding)}\` ~~${finding.title}~~ · resolved at \`${shortSha}\``),
-		""
-	];
-	const prefix = [
-		`> ℹ️ Superseded — ${input.resolvedFindings.length} of ${input.priorState.unresolvedFindings.length} findings resolved at \`${shortSha}\`; see [the latest review](${input.currentReviewUrl}).`,
-		"",
-		"<details>",
-		"<summary>Previous review details</summary>",
-		"",
-		...resolved,
-		"<!-- effect-agent-pr-review retired-original:start -->"
-	];
-	const suffix = [
-		"<!-- effect-agent-pr-review retired-original:end -->",
-		"",
-		"</details>",
-		...comments.length === 0 ? [] : ["", ...comments]
-	];
-	const render = (visible) => [
-		...prefix,
-		visible,
-		...suffix
-	].join("\n");
-	if (render(original).length <= MAX_REVIEW_BODY_CHARS) return render(original);
-	const truncationNotice = "\n\n_Original review content truncated during retirement._";
-	const budget = Math.max(0, MAX_REVIEW_BODY_CHARS - render(truncationNotice).length);
-	return render(`${original.slice(0, budget)}${truncationNotice}`);
+const remapPlanUnitIds = (plan, offset) => {
+	if (offset === 0) return plan;
+	const units = plan.units.map((unit, index) => ReviewUnit.make({
+		...unit,
+		unitId: `unit-${String(offset + index + 1).padStart(3, "0")}`
+	}));
+	const mappedIds = /* @__PURE__ */ new Map();
+	for (const [index, unit] of plan.units.entries()) {
+		const remapped = units[index];
+		if (remapped !== void 0) mappedIds.set(unit.unitId, remapped.unitId);
+	}
+	return ReviewUnitPlan.make({
+		...plan,
+		units,
+		discoveryPasses: plan.discoveryPasses.map((pass) => {
+			const unitId = mappedIds.get(pass.unitId) ?? pass.unitId;
+			return ReviewDiscoveryPass.make({
+				...pass,
+				unitId,
+				passId: `${unitId}${pass.passId.slice(pass.unitId.length)}`
+			});
+		})
+	});
 };
-/** Compute one prior review's resolved subset and deterministic retired body. */
-const decideReviewRetirement = (input) => {
-	const current = new Set(input.currentState.unresolvedFindings.map(findingIdentity));
-	const resolvedFindings = input.priorState.unresolvedFindings.filter((finding) => !current.has(findingIdentity(finding)));
-	return {
-		body: renderRetiredBody({
-			...input,
-			resolvedFindings
-		}),
-		resolvedFindings,
-		priorFindingCount: input.priorState.unresolvedFindings.length
+const scheduleFanOutWork = (input) => {
+	const retryPathSet = new Set(input.retry?.paths ?? []);
+	const retryStages = new Set(input.retry?.stages ?? []);
+	if (retryPathSet.size === 0) {
+		const plan = planReviewUnits(input.files, { totalChangedFiles: input.totalChangedFiles });
+		const passesByUnit = /* @__PURE__ */ new Map();
+		for (const pass of plan.discoveryPasses) {
+			const passes = passesByUnit.get(pass.unitId) ?? [];
+			passes.push(pass);
+			passesByUnit.set(pass.unitId, passes);
+		}
+		return {
+			plan,
+			passesByUnit,
+			overflowRetryPaths: []
+		};
+	}
+	const freshFiles = input.files.filter((file) => !retryPathSet.has(file.path));
+	const retryFiles = input.files.filter((file) => retryPathSet.has(file.path));
+	const freshPlan = planReviewUnits(freshFiles, { totalChangedFiles: input.totalChangedFiles });
+	const retryPlan = remapPlanUnitIds(planReviewUnits(retryFiles, { totalChangedFiles: input.totalChangedFiles }), freshPlan.units.length);
+	const acceptedFresh = freshPlan.units.slice(0, 8);
+	const acceptedRetry = retryPlan.units.slice(0, Math.max(0, 8 - acceptedFresh.length));
+	const overflowRetryPaths = retryPlan.units.slice(acceptedRetry.length).flatMap((unit) => [...unit.paths]);
+	const retryPassFilter = (pass) => {
+		const stage = pass.perspective === "risk-specialist" ? "specialist" : "discovery";
+		return retryStages.has(stage);
 	};
-};
-const inlineCommentIdentity = (comment) => {
-	if (comment.startLine === null || comment.endLine === null) return void 0;
-	const firstLine = comment.body.split("\n", 1)[0] ?? "";
-	const title = INLINE_FINDING_TITLE_PATTERN.exec(firstLine)?.[1];
-	return title === void 0 ? void 0 : findingIdentity({
-		path: comment.path,
-		startLine: comment.startLine,
-		endLine: comment.endLine,
-		title
+	const acceptedRetryIds = new Set(acceptedRetry.map((unit) => unit.unitId));
+	let retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId) && retryPassFilter(pass));
+	if (retryStages.has("verification") && !retryStages.has("discovery") && !retryStages.has("specialist")) retryPasses = retryPlan.discoveryPasses.filter((pass) => acceptedRetryIds.has(pass.unitId));
+	const acceptedFreshIds = new Set(acceptedFresh.map((unit) => unit.unitId));
+	const discoveryPasses = [...freshPlan.discoveryPasses.filter((pass) => acceptedFreshIds.has(pass.unitId)), ...retryPasses];
+	const plan = ReviewUnitPlan.make({
+		totalFiles: input.files.length,
+		truncated: freshPlan.truncated || retryPlan.truncated,
+		units: [...acceptedFresh, ...acceptedRetry],
+		discoveryPasses,
+		undiffablePaths: [.../* @__PURE__ */ new Set([...freshPlan.undiffablePaths, ...retryPlan.undiffablePaths])].sort(),
+		partialEvidencePaths: [.../* @__PURE__ */ new Set([...freshPlan.partialEvidencePaths, ...retryPlan.partialEvidencePaths])].sort(),
+		unassignedEvidenceShardCount: freshPlan.unassignedEvidenceShardCount + retryPlan.unassignedEvidenceShardCount,
+		unassignedEvidenceShardIds: [...freshPlan.unassignedEvidenceShardIds, ...retryPlan.unassignedEvidenceShardIds].slice(0, 96),
+		unassignedPaths: [.../* @__PURE__ */ new Set([
+			...freshPlan.unassignedPaths,
+			...retryPlan.unassignedPaths,
+			...overflowRetryPaths
+		])].sort()
 	});
-};
-const failOpen = (effect, fallback, message) => effect.pipe(Effect.catch((error) => Effect.logWarning(`${message}: ${String(error)}`).pipe(Effect.as(fallback))));
-const isStrictlyOlderReview = (review, input) => {
-	if (review.submittedAt === null) return false;
-	const submittedAt = DateTime.toEpochMillis(review.submittedAt);
-	const currentSubmittedAt = DateTime.toEpochMillis(input.currentSubmittedAt);
-	return submittedAt < currentSubmittedAt || submittedAt === currentSubmittedAt && review.reviewId < input.currentReviewId;
+	const passesByUnit = /* @__PURE__ */ new Map();
+	for (const pass of discoveryPasses) {
+		const passes = passesByUnit.get(pass.unitId) ?? [];
+		passes.push(pass);
+		passesByUnit.set(pass.unitId, passes);
+	}
+	return {
+		plan,
+		passesByUnit,
+		overflowRetryPaths
+	};
 };
 /**
-* Retire every marker-bearing prior review against the newest posted state.
-* Every lookup, edit, and minimization is isolated: retirement is cosmetic
-* and can never change the run or check outcome.
+* Run the complete host-scheduled fan-out pipeline over one selected
+* changeset snapshot: plan, independent discovery, exact verification, and a
+* deterministic host-composed CodeReview from verifier-confirmed candidates
+* only. The verdict is derived from confirmed severities, never model prose.
 */
-const retireStaleReviews = Effect.fn("retireStaleReviews")(function* (input) {
-	const host = yield* ReviewRetirementHost;
-	const authenticator = yield* ReviewStateAuthenticator;
-	if (authenticator.status !== "available") {
-		yield* Effect.logWarning("Skipping stale-review retirement because authenticated review state is unavailable.");
-		return ReviewRetirementReport.make({
-			reviewsRetired: 0,
-			findingsResolved: 0,
-			commentsMinimized: 0,
-			failures: 0
-		});
-	}
-	let failures = 0;
-	let reviewsRetired = 0;
-	let findingsResolved = 0;
-	let commentsMinimized = 0;
-	const reviews = yield* failOpen(host.listReviews, void 0, "Could not list prior reviews");
-	if (reviews === void 0) return ReviewRetirementReport.make({
-		reviewsRetired,
-		findingsResolved,
-		commentsMinimized,
-		failures: 1
-	});
-	for (const review of reviews) {
-		if (review.authorNodeId !== input.currentAuthorNodeId || !isStrictlyOlderReview(review, input) || !hasReviewMetadataMarker(review.body)) continue;
-		const priorState = yield* failOpen(authenticator.extract(review.body), Option.none(), `Could not authenticate prior review ${review.reviewId}`);
-		if (Option.isNone(priorState)) continue;
-		const decision = decideReviewRetirement({
-			priorBody: review.body,
-			priorState: priorState.value,
-			currentState: input.currentState,
-			currentReviewUrl: input.currentReviewUrl
-		});
-		if (yield* failOpen(host.updateBody(review.reviewId, decision.body).pipe(Effect.as(true)), false, `Could not retire prior review ${review.reviewId}`)) {
-			reviewsRetired += 1;
-			findingsResolved += decision.resolvedFindings.length;
-		} else failures += 1;
-		if (decision.resolvedFindings.length === 0) continue;
-		const comments = yield* failOpen(host.listComments(review.reviewId), void 0, `Could not list inline comments for prior review ${review.reviewId}`);
-		if (comments === void 0) {
-			failures += 1;
-			continue;
-		}
-		const resolved = new Set(decision.resolvedFindings.map(findingIdentity));
-		for (const comment of comments) {
-			const identity = inlineCommentIdentity(comment);
-			if (identity === void 0 || !resolved.has(identity)) continue;
-			if (yield* failOpen(host.minimizeComment(comment.nodeId).pipe(Effect.as(true)), false, `Could not minimize resolved inline comment ${comment.nodeId}`)) commentsMinimized += 1;
-			else failures += 1;
-		}
-	}
-	return ReviewRetirementReport.make({
-		reviewsRetired,
-		findingsResolved,
-		commentsMinimized,
-		failures
+const runFanOutReview = (binding, input) => Effect.gen(function* () {
+	const { plan, passesByUnit, overflowRetryPaths } = scheduleFanOutWork(input);
+	const outcomes = yield* Effect.forEach(plan.units, (unit) => reviewUnit(binding, unit, passesByUnit.get(unit.unitId) ?? [], input), { concurrency: 4 });
+	const failedPasses = outcomes.flatMap((outcome) => outcome.failedPasses);
+	const unsettledCandidates = outcomes.reduce((total, outcome) => total + outcome.unsettledCandidates, 0);
+	const reasons = [];
+	if (failedPasses.length > 0) reasons.push(boundedListReason("configured review passes did not settle", failedPasses.map((pass) => `${pass.workId} (${pass.errorTag})`)));
+	if (unsettledCandidates > 0) reasons.push(`${unsettledCandidates} discovered candidate(s) did not receive exact verification`);
+	const requiredSpecialistPasses = plan.discoveryPasses.filter((pass) => pass.perspective === "risk-specialist").length;
+	const confirmed = outcomes.flatMap((outcome) => outcome.confirmed);
+	const assurance = ReviewAssurance.make({
+		status: reasons.length === 0 ? "settled" : "incomplete",
+		requiredGeneralDiscoveryPasses: plan.discoveryPasses.length - requiredSpecialistPasses,
+		completedGeneralDiscoveryPasses: outcomes.reduce((total, outcome) => total + outcome.completedGeneralPasses, 0),
+		requiredSpecialistPasses,
+		completedSpecialistPasses: outcomes.reduce((total, outcome) => total + outcome.completedSpecialistPasses, 0),
+		requiredVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.requiredVerificationPasses, 0),
+		completedVerificationPasses: outcomes.reduce((total, outcome) => total + outcome.completedVerificationPasses, 0),
+		discoveredCandidates: outcomes.reduce((total, outcome) => total + outcome.discoveredCandidates, 0),
+		confirmedCandidates: confirmed.length,
+		rejectedCandidates: outcomes.reduce((total, outcome) => total + outcome.rejectedCandidates, 0),
+		unsettledCandidates,
+		discardedInvalidFindings: outcomes.reduce((total, outcome) => total + outcome.discardedFindings, 0),
+		failedPasses,
+		reasons
 	});
+	const findings = rankAndDedupeFindings(confirmed.flatMap(({ assessment, candidate }) => candidate._tag === "FindingCandidate" ? [confirmedFindingForPublication(assessment, candidate)] : []));
+	const concerns = rankAndDedupeConcerns(confirmed.flatMap(({ candidate }) => candidate._tag === "ConcernCandidate" ? [ReviewConcern.make({
+		...candidate.concern,
+		evidencePaths: [...new Set(candidate.evidencePaths)].sort()
+	})] : []));
+	const walkthrough = outcomes.flatMap((outcome) => outcome.walkthrough);
+	const blocking = findings.some((finding) => finding.severity === "blocking") || concerns.some((concern) => concern.severity === "blocking");
+	return {
+		review: CodeReview.make({
+			summary: composeSummary(plan, assurance),
+			verdict: blocking ? "request-changes" : findings.length > 0 || concerns.length > 0 ? "comment" : "approve",
+			findings,
+			...concerns.length === 0 ? {} : { concerns },
+			...walkthrough.length === 0 ? {} : { walkthrough }
+		}),
+		assurance,
+		plan,
+		unreviewedPaths: [.../* @__PURE__ */ new Set([
+			...outcomes.flatMap((outcome) => outcome.unreviewedPaths),
+			...plan.unassignedPaths,
+			...plan.partialEvidencePaths,
+			...plan.undiffablePaths
+		])].sort(),
+		unreviewedPasses: [...outcomes.flatMap((outcome) => outcome.unreviewedPasses), ...overflowRetryPaths.length === 0 ? [] : (input.retry?.stages.length ? input.retry.stages : [
+			"discovery",
+			"specialist",
+			"verification"
+		]).map((stage) => ({
+			stage,
+			paths: overflowRetryPaths
+		}))],
+		turns: outcomes.reduce((total, outcome) => total + outcome.turns, 0)
+	};
+});
+//#endregion
+//#region src/internal/fingerprint.ts
+const MARKER_PREFIX = "<!-- effect-agent-pr-review fingerprint=sha256:";
+const MARKER_SUFFIX = " -->";
+const MARKER_PATTERN = /<!-- effect-agent-pr-review fingerprint=sha256:([0-9a-f]{64}) -->/g;
+/** Render the invisible review-body marker for one fingerprint. */
+const renderFingerprintMarker = (fingerprint) => `${MARKER_PREFIX}${fingerprint}${MARKER_SUFFIX}`;
+/** The rendered marker length is fixed; publication reserves room for it. */
+const FINGERPRINT_MARKER_LENGTH = renderFingerprintMarker("0".repeat(64)).length;
+/** Extract the last fingerprint marker in one review body, if any. */
+const extractFingerprint = (body) => {
+	let last;
+	for (const match of body.matchAll(MARKER_PATTERN)) last = match[1];
+	return last;
+};
+/** SHA-256 via `Crypto.Crypto`; unavailable crypto is a defect, not an expected failure. */
+const sha256Hex = Effect.fn("sha256Hex")(function* (text) {
+	const digest = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(text)).pipe(Effect.orDie);
+	return Encoding.encodeHex(digest);
 });
+const FIELD = "\0";
+const RECORD = "
";
+const SECTION = "";
+/**
+* Unified-diff hunk coordinates describe where a patch applies, not what it
+* changes. A content-equivalent rebase can shift both coordinates while
+* leaving every context/addition/deletion line unchanged, so exclude only
+* those coordinates from the canonical patch representation.
+*/
+const canonicalPatch = (patch) => patch.replace(/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/gm, "@@ -_ +_ @@");
+/**
+* Canonical changeset encoding: sorted by path so provider ordering never
+* matters, with every review-relevant field of every file.
+*/
+const canonicalChangeset = (files) => files.map((file) => `${file.path}${FIELD}${file.status}${FIELD}${String(file.additions)}${FIELD}${String(file.deletions)}${FIELD}${file.patch === void 0 ? "" : canonicalPatch(file.patch)}${FIELD}${file.reviewBaseContent ?? ""}${FIELD}${file.reviewHeadContent ?? ""}`).sort().join(RECORD);
+/**
+* Fingerprint one review's complete input surface: the (already
+* ignore-filtered) changeset plus the caller's prompt signature — the
+* rendered instructions and any review-shaping options the instructions do
+* not carry.
+*/
+const computeChangesetFingerprint = (files, signature) => sha256Hex(`${canonicalChangeset(files)}${SECTION}${signature}`);
+/** Profile fingerprints are SHA-256 over configuration-only signatures. */
+const computeProfileFingerprint = (signature) => sha256Hex(signature);
 //#endregion
 //#region src/internal/github.ts
 const defaultGraphqlUrl = (apiUrl) => apiUrl === "https://api.github.com" ? "https://api.github.com/graphql" : apiUrl.replace(/\/api\/v3$/, "/api/graphql");
@@ -2669,6 +3021,137 @@ const gitHubReviewRetirementHostLayer = Layer.effect(ReviewRetirementHost)(Effec
 		})
 	});
 }));
+const MAX_ADJUDICATION_PAGES = 5;
+const GitHubThreadCommentWire = Schema.Struct({
+	id: Schema.Int,
+	in_reply_to_id: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	path: Schema.String,
+	body: Schema.String,
+	author_association: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	user: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+	created_at: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	original_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	start_line: Schema.optionalKey(Schema.NullOr(Schema.Int)),
+	original_start_line: Schema.optionalKey(Schema.NullOr(Schema.Int))
+});
+const GitHubThreadCommentsPageWire = Schema.Array(GitHubThreadCommentWire);
+const GitHubIssueCommentWire = Schema.Struct({
+	body: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	author_association: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	user: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+	created_at: Schema.optionalKey(Schema.NullOr(Schema.String))
+});
+const GitHubIssueCommentsPageWire = Schema.Array(GitHubIssueCommentWire);
+const toAdjudicationComment = (wire, sourceOrder) => {
+	const login = wire.user?.login;
+	if (login === void 0 || login.length === 0) return void 0;
+	return AdjudicationComment.make({
+		body: (wire.body ?? "").slice(0, 65536),
+		authorAssociation: (wire.author_association ?? "NONE").slice(0, 40),
+		authorLogin: login.slice(0, 100),
+		createdAt: parseGitHubSubmittedAt(wire.created_at ?? null),
+		sourceOrder
+	});
+};
+/**
+* GitHub-backed host reads for maintainer adjudication, installed by
+* `gitHubReviewLayers` in `github-env.ts` at the public composition root: this action's own
+* inline finding threads (roots authored by the configured review author)
+* with their replies, and the pull request's top-level conversation comments.
+* Both listings are creation-ordered.
+*/
+const gitHubReviewAdjudicationHostLayer = Layer.effect(ReviewAdjudicationHost)(Effect.gen(function* () {
+	const target = yield* GitHubReviewTarget;
+	const client = yield* HttpClient.HttpClient;
+	const reviewAuthorLogin = (target.reviewAuthorLogin ?? "github-actions[bot]").toLowerCase();
+	const asAdjudicationFailure = (operation) => (error) => ReviewAdjudicationFailure.make({
+		operation,
+		reason: `${error._tag}: ${error.message ?? "request failed"}`.slice(0, 2048)
+	});
+	const decodeAdjudication = (schema, operation) => {
+		const decode = Schema.decodeUnknownEffect(schema);
+		return (response) => response.json.pipe(Effect.mapError(asAdjudicationFailure(operation)), Effect.flatMap((body) => decode(body).pipe(Effect.mapError(asAdjudicationFailure(operation)))));
+	};
+	const listPaged = (input) => Effect.gen(function* () {
+		const values = [];
+		const perPage = 100;
+		for (let page = 1; page <= MAX_ADJUDICATION_PAGES; page += 1) {
+			const response = yield* client.execute(withCommonHeaders(HttpClientRequest.get(input.url).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setUrlParams({
+				per_page: String(perPage),
+				page: String(page),
+				sort: "created",
+				direction: "asc"
+			})), target.token)).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.mapError(asAdjudicationFailure(input.operation)));
+			const pageValues = yield* input.decode(response);
+			values.push(...pageValues);
+			if (pageValues.length < perPage) return values;
+		}
+		return yield* ReviewAdjudicationFailure.make({
+			operation: input.operation,
+			reason: `history exceeds the bounded ${MAX_ADJUDICATION_PAGES * 100}-item lookup`
+		});
+	});
+	const listFindingThreads = Effect.gen(function* () {
+		const wires = yield* listPaged({
+			operation: "listReviewCommentsForAdjudication",
+			url: `${target.apiUrl}/repos/${target.repository}/pulls/${target.number}/comments`,
+			decode: decodeAdjudication(GitHubThreadCommentsPageWire, "listReviewCommentsForAdjudication")
+		});
+		const positiveLine = (value) => value !== void 0 && value !== null && value > 0 ? value : null;
+		const threads = /* @__PURE__ */ new Map();
+		for (const wire of wires) {
+			if (wire.in_reply_to_id !== void 0 && wire.in_reply_to_id !== null) continue;
+			if (wire.user?.login.toLowerCase() !== reviewAuthorLogin) continue;
+			threads.set(wire.id, {
+				root: wire,
+				replies: []
+			});
+		}
+		for (const [sourceOrder, wire] of wires.entries()) {
+			if (wire.in_reply_to_id === void 0 || wire.in_reply_to_id === null) continue;
+			const thread = threads.get(wire.in_reply_to_id);
+			if (thread === void 0) continue;
+			const reply = toAdjudicationComment(wire, sourceOrder);
+			if (reply === void 0) continue;
+			if (parseThreadAdjudication(reply.body) === void 0) continue;
+			if (!AUTHORIZED_ADJUDICATION_ASSOCIATIONS.has(reply.authorAssociation)) {
+				yield* Effect.logDebug(`Ignored inline adjudication command from @${reply.authorLogin} (${reply.authorAssociation}).`);
+				continue;
+			}
+			if (thread.replies.length >= 100) return yield* ReviewAdjudicationFailure.make({
+				operation: "listReviewCommentsForAdjudication",
+				reason: `inline thread ${wire.in_reply_to_id} exceeds the bounded 100-command adjudication lookup`
+			});
+			thread.replies.push(reply);
+		}
+		return [...threads.values()].filter((thread) => thread.root.path.length > 0 && thread.root.path.length <= 500).map(({ root, replies }) => {
+			const endLine = positiveLine(root.line ?? root.original_line);
+			const startLine = positiveLine(root.start_line ?? root.original_start_line) ?? endLine;
+			return AdjudicableThread.make({
+				path: root.path,
+				startLine,
+				endLine,
+				rootBody: root.body.slice(0, 65536),
+				replies
+			});
+		});
+	});
+	const listIssueComments = Effect.gen(function* () {
+		return (yield* listPaged({
+			operation: "listIssueCommentsForAdjudication",
+			url: `${target.apiUrl}/repos/${target.repository}/issues/${target.number}/comments`,
+			decode: decodeAdjudication(GitHubIssueCommentsPageWire, "listIssueCommentsForAdjudication")
+		})).flatMap((wire, sourceOrder) => {
+			const comment = toAdjudicationComment(wire, sourceOrder);
+			return comment === void 0 ? [] : [comment];
+		});
+	});
+	return ReviewAdjudicationHost.of({
+		listFindingThreads,
+		listIssueComments
+	});
+}));
 /** Reading the pull request's previously posted reviews failed. */
 var PriorReviewLookupFailure = class extends Schema.TaggedError()("PriorReviewLookupFailure", { reason: Schema.String }) {
 	get message() {
@@ -2776,6 +3259,6 @@ const fingerprintUnchanged = (current) => Effect.gen(function* () {
 	return Option.isSome(latest) && latest.value === current;
 });
 //#endregion
-export { extractFingerprint as $, ChangedFileStatus as $n, ReviewAssurance as $t, ReviewState as A, ReviewToolkit as An, MAX_MERGED_FINDINGS as At, fromStoredConcern as B, readFileDiffHandler as Bn, ReviewRiskCategory as Bt, MAX_REVIEW_STATE_MARKER_CHARS as C, PullRequestReviewer as Cn, defaultFileReviewerPolicy as Ct, ReviewHeadComparison as D, ReviewConcern as Dn, reviewCandidateSubjectKey as Dt, ReviewExecutionContext as E, ReadFileDiff as En, makeFileReviewerInstructions as Et, StoredReviewConcern as F, defaultReviewPolicy as Fn, ReviewDiscoveryPass as Ft, toStoredConcern as G, MAX_FILE_CHARS as Gn, UNIT_EVIDENCE_CHAR_BUDGET as Gt, isLineageAncestor as H, resolveGuidance as Hn, ReviewUnitId as Ht, StoredReviewFinding as I, fileDiffView as In, ReviewDiscoveryPerspective as It, validateReviewState as J, PullRequestSourceFailure as Jn, planReviewUnits as Jt, toStoredFinding as K, PullRequestMetadata as Kn, classifyReviewRisks as Kt, StoredUnreviewedPass as L, fileReviewEvidenceChunks as Ln, ReviewEvidenceShard as Lt, ReviewStateAuthenticator as M, ReviewVerdict as Mn, MAX_REVIEW_UNITS as Mt, ReviewStateMarker as N, WalkthroughEntry as Nn, MAX_UNIT_EVIDENCE_SHARDS as Nt, ReviewMode as O, ReviewFinding as On, runFanOutReview as Ot, ReviewStateMarkerTooLarge as P, clampMaxFindings as Pn, MAX_UNIT_FILES as Pt, computeProfileFingerprint as Q, ChangedFile as Qn, FailedReviewUnit as Qt, UnreviewedStage as R, listChangedFilesHandler as Rn, ReviewEvidenceShardId as Rt, GitCommitSha as S, MAX_WALKTHROUGH_SUMMARY_CHARS as Sn, confirmedFindingForPublication as St, MAX_STORED_UNREVIEWED_PATHS as T, ReadFile as Tn, makeFileReviewerDefinition as Tt, selectReviewRange as U, reviewInstructions as Un, ReviewUnitPlan as Ut, fromStoredFinding as V, readFileHandler as Vn, ReviewUnit as Vt, selectedPullRequestSourceLayer as W, MAX_CHANGED_FILES as Wn, UNIT_CHANGED_LINE_BUDGET as Wt, FINGERPRINT_MARKER_LENGTH as X, normalizeRepoRelativePath as Xn, rankAndDedupeFindings as Xt, webCryptoReviewStateAuthenticatorLayer as Y, ReviewInputViolation as Yn, rankAndDedupeConcerns as Yt, computeChangesetFingerprint as Z, anchorViolation as Zn, FailedReviewPass as Zt, ReviewRetirementHost as _, ListChangedFilesQuery as _n, ReviewCandidateId as _t, PriorReviews as a, fanOutInputCoverage as an, isReviewableFile as ar, FileReviewEvidence as at, hasReviewMetadataMarker as b, MAX_PATCH_CHARS as bn, ReviewWorkPhase as bt, fingerprintUnchanged as c, ChangedFilesView as cn, FileReviewer as ct, gitHubReviewPublisherLayer as d, FileDiffView as dn, MAX_CHILD_FINDINGS as dt, ReviewCoverage as en, ChangedPath as er, renderFingerprintMarker as et, gitHubReviewRetirementHostLayer as f, FileSlice as fn, MAX_FILE_REVIEW_TOOL_CALLS as ft, ReviewRetirementFailure as g, ListChangedFiles as gn, ReviewCandidate as gt, RetirableReviewComment as h, FindingSeverity as hn, REVIEW_UNIT_CONCURRENCY as ht, PriorReviewLookupFailure as i, compatibilityCoverage as in, hasReviewableContent as ir, FileReviewBrief as it, ReviewStateAuthenticationFailure as j, ReviewToolkitLayer as jn, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as jt, ReviewScopeMode as k, ReviewMission as kn, MAX_FILE_EVIDENCE_CHARS as kt, gitHubPriorReviewsLayer as l, CodeReview as ln, FindingCandidate as lt, RetirableReview as m, FindingCategory as mn, MAX_UNIT_CANDIDATES as mt, GitHubApiFailure as n, assessFlatReview as nn, annotatePatch as nr, ConcernCandidate as nt, PublishedReview as o, flatAssurance as on, parsePatch as or, FileReviewReport as ot, parseGitHubSubmittedAt as p, FileSliceQuery as pn, MAX_REVIEW_CHILDREN as pt, unavailableReviewStateAuthenticatorLayer as q, PullRequestSource as qn, findingAnchorInUnitEvidence as qt, GitHubReviewTarget as r, boundedListReason as rn, commentableLines as rr, DiscoveredConcern as rt, ReviewPublisher as s, ChangedFileSummary as sn, renderReviewContent as sr, FileReviewToolkit as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, ReviewInputCoverage as tn, MAX_REVIEW_CONTENT_CHARS as tr, CandidateAssessment as tt, gitHubPullRequestSourceLayer as u, FileDiffQuery as un, MAX_CHILD_CONCERNS as ut, ReviewRetirementReport as v, MAX_CONCERNS as vn, ReviewPassMisbehaved as vt, MAX_STORED_UNREVIEWED_PASSES as w, REVIEW_TOOL_RESULT_MAX_BYTES as wn, fileReviewerInstructions as wt, retireStaleReviews as x, MAX_WALKTHROUGH_ENTRIES as xn, assessmentSettlesSuggestionExactly as xt, decideReviewRetirement as y, MAX_FINDINGS as yn, ReviewWorkPerspective as yt, buildProfileMission as z, makeReviewInstructions as zn, ReviewPassId as zt };
+export { ReviewDiscoveryPass as $, ReviewFinding as $n, MAX_STORED_ADJUDICATIONS as $t, MAX_CHILD_FINDINGS as A, validateReviewState as An, parsePatch as Ar, buildPriorReviewContext as At, assessmentSettlesSuggestionExactly as B, FindingSeverity as Bn, threadFindingTarget as Bt, FileReviewBrief as C, fullReviewSelection as Cn, ChangedFileStatus as Cr, anchorViolation as Ct, FileReviewer as D, toStoredConcern as Dn, commentableLines as Dr, MAX_THREAD_ADJUDICATION_COMMANDS as Dt, FileReviewToolkit as E, selectedPullRequestSourceLayer as En, annotatePatch as Er, AdjudicationComment as Et, ReviewCandidate as F, FileDiffQuery as Fn, noReviewAdjudicationHostLayer as Ft, makeFileReviewerInstructions as G, MAX_PATCH_CHARS as Gn, ReviewRetirementHost as Gt, defaultFileReviewerPolicy as H, ListChangedFilesQuery as Hn, RetirableReview as Ht, ReviewCandidateId as I, FileDiffView as In, parseIssueAdjudication as It, MAX_MERGED_FINDINGS as J, PullRequestReviewer as Jn, hasReviewMetadataMarker as Jt, reviewCandidateSubjectKey as K, MAX_WALKTHROUGH_ENTRIES as Kn, ReviewRetirementReport as Kt, ReviewPassMisbehaved as L, FileSlice as Ln, parseThreadAdjudication as Lt, MAX_REVIEW_CHILDREN as M, ChangedFileSummary as Mn, deriveAdjudications as Mt, MAX_UNIT_CANDIDATES as N, ChangedFilesView as Nn, mergeAdjudications as Nt, FindingCandidate as O, toStoredFinding as On, hasReviewableContent as Or, ReviewAdjudicationFailure as Ot, REVIEW_UNIT_CONCURRENCY as P, CodeReview as Pn, noReviewAdjudicationHost as Pt, MAX_UNIT_FILES as Q, ReviewConcern as Qn, MAX_REVIEW_STATE_MARKER_CHARS as Qt, ReviewWorkPerspective as R, FileSliceQuery as Rn, renderAdjudicationContextLine as Rt, DiscoveredConcern as S, fullReviewExecutionContextLayer as Sn, ChangedFile as Sr, splitCarriedScope as St, FileReviewReport as T, selectReviewRange as Tn, MAX_REVIEW_CONTENT_CHARS as Tr, AdjudicableThread as Tt, fileReviewerInstructions as U, MAX_CONCERNS as Un, RetirableReviewComment as Ut, confirmedFindingForPublication as V, ListChangedFiles as Vn, INLINE_FINDING_TITLE_PATTERN as Vt, makeFileReviewerDefinition as W, MAX_FINDINGS as Wn, ReviewRetirementFailure as Wt, MAX_REVIEW_UNITS as X, ReadFile as Xn, AdjudicationDisposition as Xt, MAX_REPORTED_UNASSIGNED_EVIDENCE_SHARDS as Y, REVIEW_TOOL_RESULT_MAX_BYTES as Yn, retireStaleReviews as Yt, MAX_UNIT_EVIDENCE_SHARDS as Z, ReadFileDiff as Zn, GitCommitSha as Zt, computeProfileFingerprint as _, buildProfileMission as _n, PullRequestMetadata as _r, ReviewInputCoverage as _t, PriorReviews as a, ReviewScopeMode as an, clampMaxFindings as ar, ReviewUnit as at, CandidateAssessment as b, fromStoredConcern as bn, ReviewInputViolation as br, fanOutInputCoverage as bt, fingerprintUnchanged as c, ReviewStateAuthenticator as cn, fileReviewEvidenceChunks as cr, UNIT_EVIDENCE_CHAR_BUDGET as ct, gitHubReviewAdjudicationHostLayer as d, StoredAdjudication as dn, readFileDiffHandler as dr, planReviewUnits as dt, MAX_STORED_UNREVIEWED_PASSES as en, ReviewMission as er, ReviewDiscoveryPerspective as et, gitHubReviewPublisherLayer as f, StoredReviewConcern as fn, readFileHandler as fr, rankAndDedupeConcerns as ft, computeChangesetFingerprint as g, adjudicationIdentity as gn, MAX_FILE_CHARS as gr, ReviewAssurance as gt, FINGERPRINT_MARKER_LENGTH as h, UnreviewedStage as hn, MAX_CHANGED_FILES as hr, FailedReviewPass as ht, PriorReviewLookupFailure as i, ReviewMode as in, WalkthroughEntry as ir, ReviewRiskCategory as it, MAX_FILE_REVIEW_TOOL_CALLS as j, webCryptoReviewStateAuthenticatorLayer as jn, renderReviewContent as jr, collectReviewAdjudications as jt, MAX_CHILD_CONCERNS as k, unavailableReviewStateAuthenticatorLayer as kn, isReviewableFile as kr, ReviewAdjudicationHost as kt, gitHubPriorReviewsLayer as l, ReviewStateMarker as ln, listChangedFilesHandler as lr, classifyReviewRisks as lt, parseGitHubSubmittedAt as m, StoredUnreviewedPass as mn, reviewInstructions as mr, reviewConcernKey as mt, GitHubApiFailure as n, ReviewExecutionContext as nn, ReviewToolkitLayer as nr, ReviewEvidenceShardId as nt, PublishedReview as o, ReviewState as on, defaultReviewPolicy as or, ReviewUnitId as ot, gitHubReviewRetirementHostLayer as p, StoredReviewFinding as pn, resolveGuidance as pr, rankAndDedupeFindings as pt, runFanOutReview as q, MAX_WALKTHROUGH_SUMMARY_CHARS as qn, decideReviewRetirement as qt, GitHubReviewTarget as r, ReviewHeadComparison as rn, ReviewVerdict as rr, ReviewPassId as rt, ReviewPublisher as s, ReviewStateAuthenticationFailure as sn, fileDiffView as sr, ReviewUnitPlan as st, DEFAULT_GITHUB_REVIEW_AUTHOR_LOGIN as t, MAX_STORED_UNREVIEWED_PATHS as tn, ReviewToolkit as tr, ReviewEvidenceShard as tt, gitHubPullRequestSourceLayer as u, ReviewStateMarkerTooLarge as un, makeReviewInstructions as ur, findingAnchorInUnitEvidence as ut, extractFingerprint as v, concernIdentity as vn, PullRequestSource as vr, assessFlatReview as vt, FileReviewEvidence as w, isLineageAncestor as wn, ChangedPath as wr, AUTHORIZED_ADJUDICATION_ASSOCIATIONS as wt, ConcernCandidate as x, fromStoredFinding as xn, normalizeRepoRelativePath as xr, flatAssurance as xt, renderFingerprintMarker as y, findingIdentity as yn, PullRequestSourceFailure as yr, boundedListReason as yt, ReviewWorkPhase as z, FindingCategory as zn, renderPriorFindingContextLine as zt };
 
-//# sourceMappingURL=github-C6jrBLA2.mjs.map
+//# sourceMappingURL=github-NjgxGqwM.mjs.map