@jphutchins/code-review 0.1.0-alpha.53 → 0.1.0-alpha.55

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain } from 'citty';
 import { readFileSync, writeFileSync, copyFileSync, statSync, readdirSync, appendFileSync } from 'fs';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
 import { resolve as resolve$1, join, dirname, basename, extname, sep } from 'path';
 import { Eta } from 'eta';
 import * as t from 'io-ts';
@@ -74,35 +74,43 @@ var UriString = t.refinement(
   (s) => !/\s/.test(s) && URL.canParse(s),
   "UriString"
 );
-var FindingRuleCodec = t.partial({
-  code: t.string,
+var RuleUrlCodec = t.partial({
   code_url: UriString
 });
-var FindingShape = t.intersection([
-  t.type({
-    path: t.string,
-    start_line: LineNumber,
-    end_line: LineNumber,
-    severity: SeverityCodec,
-    title: t.string,
-    description: t.string,
-    reasoning: t.string,
-    confidence: Confidence,
-    likelihood: Likelihood
-  }),
-  FindingRuleCodec,
-  t.partial({
-    side: SideCodec,
-    recommendation: t.string,
-    patch: t.string
-  })
-]);
+var FindingRequired = t.type({
+  id: t.string,
+  path: t.string,
+  start_line: LineNumber,
+  end_line: LineNumber,
+  severity: SeverityCodec,
+  title: t.string,
+  description: t.string,
+  reasoning: t.string,
+  confidence: Confidence,
+  likelihood: Likelihood
+});
+var FindingOptional = t.partial({
+  side: SideCodec,
+  recommendation: t.string,
+  patch: t.string
+});
+var FindingShape = t.intersection([FindingRequired, RuleUrlCodec, FindingOptional]);
 var EndGeStart = t.refinement(
   FindingShape,
   (f) => f.end_line >= f.start_line,
   "EndGeStart"
 );
-var FindingCodec = t.exact(EndGeStart);
+var FINDING_KEYS = /* @__PURE__ */ new Set([
+  ...Object.keys(FindingRequired.props),
+  ...Object.keys(RuleUrlCodec.props),
+  ...Object.keys(FindingOptional.props)
+]);
+var FindingStrict = t.refinement(
+  EndGeStart,
+  (f) => Object.keys(f).every((k) => FINDING_KEYS.has(k)),
+  "FindingStrict"
+);
+var FindingCodec = t.exact(FindingStrict);
 var SystemicRequired = t.type({
   title: t.string,
   description: t.string,
@@ -112,13 +120,14 @@ var SystemicRequired = t.type({
   likelihood: Likelihood
 });
 var SystemicOptional = t.partial({
-  finding_codes: t.array(t.string),
+  id: t.string,
+  finding_ids: t.array(t.string),
   paths: t.array(t.string)
 });
-var SystemicProblemShape = t.intersection([SystemicRequired, FindingRuleCodec, SystemicOptional]);
+var SystemicProblemShape = t.intersection([SystemicRequired, RuleUrlCodec, SystemicOptional]);
 var SYSTEMIC_KEYS = /* @__PURE__ */ new Set([
   ...Object.keys(SystemicRequired.props),
-  ...Object.keys(FindingRuleCodec.props),
+  ...Object.keys(RuleUrlCodec.props),
   ...Object.keys(SystemicOptional.props)
 ]);
 var SystemicProblemStrict = t.refinement(
@@ -128,7 +137,7 @@ var SystemicProblemStrict = t.refinement(
 );
 var SystemicProblemCodec = t.exact(SystemicProblemStrict);
 var RecurringShape = t.type({
-  code: t.string,
+  id: t.string,
   consecutive_rounds: t.refinement(
     t.number,
     (n) => Number.isSafeInteger(n) && n >= 1,
@@ -162,14 +171,25 @@ var RoundNumber = t.refinement(
   (n) => Number.isSafeInteger(n) && n >= 1,
   "RoundNumber"
 );
-var CodeFrequency = t.record(
-  t.string,
-  t.refinement(t.number, (n) => Number.isSafeInteger(n) && n >= 0, "CodeFrequency")
+var idFrequencyCodec = (name) => new t.Type(
+  name,
+  (u) => typeof u === "object" && u !== null && !Array.isArray(u),
+  (u, c) => {
+    if (typeof u !== "object" || u === null || Array.isArray(u)) return t.failure(u, c);
+    const entries = [];
+    for (const [k, v] of Object.entries(u)) {
+      if (typeof v !== "number" || !Number.isSafeInteger(v) || v < 0) return t.failure(v, c);
+      entries.push([k, v]);
+    }
+    return t.success(Object.fromEntries(entries));
+  },
+  (a) => a
 );
+var IdFrequency = idFrequencyCodec("IdFrequency");
 var ConvergenceRoundRequired = t.type({ round: RoundNumber });
 var ConvergenceRoundOptional = t.partial({
   score: FiniteNumber,
-  codes: CodeFrequency,
+  ids: IdFrequency,
   sha: t.string
 });
 var ConvergenceRoundShape = t.intersection([ConvergenceRoundRequired, ConvergenceRoundOptional]);
@@ -236,6 +256,188 @@ var RECOVERABLE_OPTIONAL_FIELDS = /* @__PURE__ */ new Set([
   ...PIPELINE_STAMPED_FIELDS,
   "change_size"
 ]);
+var synthesizedId = (parts, prefix) => `${prefix}${createHash("sha256").update(parts.join("\0")).digest("base64url").slice(0, 12)}`;
+var synthesizedFindingId = (path, title) => synthesizedId([path, title], "f-");
+var synthesizedSystemicId = (title) => synthesizedId([title], "s-");
+var isSynthesizedFindingId = (id) => /^f-[A-Za-z0-9_-]{12}$/.test(id);
+var resolveFindingId = (f) => f.id !== "" ? f.id : synthesizedFindingId(f.path, f.title);
+var resolveRuleId = (rec) => rec.id !== void 0 && rec.id !== "" ? rec.id : rec.code !== void 0 && rec.code !== "" ? rec.code : rec.path !== void 0 ? synthesizedFindingId(rec.path, rec.title) : void 0;
+var usableCountsMap = (v) => {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return void 0;
+  const entries = Object.entries(v).filter(
+    (e) => typeof e[1] === "number" && Number.isSafeInteger(e[1]) && e[1] > 0
+  );
+  return entries.length === 0 ? void 0 : Object.fromEntries(entries);
+};
+var LegacyRuleCodec = t.partial({
+  code: t.string,
+  id: t.string,
+  code_url: UriString
+});
+var FindingShapeV09 = t.intersection([
+  t.type({
+    path: t.string,
+    start_line: LineNumber,
+    end_line: LineNumber,
+    severity: SeverityCodec,
+    title: t.string,
+    description: t.string,
+    reasoning: t.string,
+    confidence: Confidence,
+    likelihood: Likelihood
+  }),
+  LegacyRuleCodec,
+  t.partial({
+    side: SideCodec,
+    recommendation: t.string,
+    patch: t.string
+  })
+]);
+var EndGeStartV09 = t.refinement(
+  FindingShapeV09,
+  (f) => f.end_line >= f.start_line,
+  "EndGeStartV09"
+);
+var FindingCodecV09 = t.exact(EndGeStartV09);
+var SystemicV09Optional = t.partial({
+  finding_codes: t.array(t.string),
+  finding_ids: t.array(t.string),
+  paths: t.array(t.string)
+});
+var SystemicV09Shape = t.intersection([SystemicRequired, LegacyRuleCodec, SystemicV09Optional]);
+var SYSTEMIC_V09_KEYS = /* @__PURE__ */ new Set([
+  ...Object.keys(SystemicRequired.props),
+  ...Object.keys(LegacyRuleCodec.props),
+  ...Object.keys(SystemicV09Optional.props)
+]);
+var SystemicV09Strict = t.refinement(
+  SystemicV09Shape,
+  (s) => Object.keys(s).every((k) => SYSTEMIC_V09_KEYS.has(k)),
+  "SystemicV09Strict"
+);
+var SystemicProblemCodecV09 = t.exact(SystemicV09Strict);
+var RecurringV09Shape = t.intersection([
+  t.partial({ code: t.string, id: t.string }),
+  t.type({
+    consecutive_rounds: t.refinement(
+      t.number,
+      (n) => Number.isSafeInteger(n) && n >= 1,
+      "ConsecutiveRoundsV09"
+    ),
+    start_round: t.refinement(
+      t.number,
+      (n) => Number.isSafeInteger(n) && n >= 1,
+      "StartRoundV09"
+    )
+  })
+]);
+var ScopeMetastasisV09Shape = t.type({
+  decision_prompt: t.string,
+  recurring: t.array(RecurringV09Shape)
+});
+var SCOPE_METASTASIS_V09_KEYS = new Set(Object.keys(ScopeMetastasisV09Shape.props));
+var ScopeMetastasisV09Strict = t.refinement(
+  ScopeMetastasisV09Shape,
+  (s) => Object.keys(s).every((k) => SCOPE_METASTASIS_V09_KEYS.has(k)),
+  "ScopeMetastasisV09Strict"
+);
+var ScopeMetastasisCodecV09 = t.exact(ScopeMetastasisV09Strict);
+var CodeFrequencyV09 = idFrequencyCodec("CodeFrequencyV09");
+var ConvergenceRoundV09Shape = t.intersection([
+  t.type({ round: RoundNumber }),
+  t.partial({ score: FiniteNumber, codes: CodeFrequencyV09, ids: CodeFrequencyV09, sha: t.string })
+]);
+var CONVERGENCE_ROUND_V09_KEYS = /* @__PURE__ */ new Set(["round", "score", "codes", "ids", "sha"]);
+var ConvergenceRoundV09Strict = t.refinement(
+  ConvergenceRoundV09Shape,
+  (r) => Object.keys(r).every((k) => CONVERGENCE_ROUND_V09_KEYS.has(k)),
+  "ConvergenceRoundV09Strict"
+);
+var ConvergenceRoundCodecV09 = t.exact(ConvergenceRoundV09Strict);
+var ConvergenceV09Shape = t.intersection([
+  ConvergenceCoreShape,
+  t.partial({ rounds: t.array(ConvergenceRoundCodecV09) })
+]);
+var CONVERGENCE_V09_KEYS = /* @__PURE__ */ new Set([...Object.keys(ConvergenceCoreShape.props), "rounds"]);
+var ConvergenceV09Strict = t.refinement(
+  ConvergenceV09Shape,
+  (c) => Object.keys(c).every((k) => CONVERGENCE_V09_KEYS.has(k)),
+  "ConvergenceV09Strict"
+);
+var ConvergenceCodecV09 = t.exact(ConvergenceV09Strict);
+var FindingsV09Shape = t.intersection([
+  t.type({
+    // Any pre-0.10 minor — the registry dispatches on major.minor before decoding, so the codec
+    // accepts every legacy patch version (0.4.x through 0.9.x) through the one tolerant shape.
+    // SchemaVersion keeps the F3 strictness: a patch-less "0.4" or over-long "0.4.0.0" still fails
+    // the codec gate exactly as the ajv gate rejects it.
+    schema_version: SchemaVersion,
+    summary: t.string,
+    verdict: VerdictCodec,
+    findings: t.array(FindingCodecV09)
+  }),
+  t.partial({
+    systemic_problems: t.array(SystemicProblemCodecV09),
+    scope_metastasis: ScopeMetastasisCodecV09,
+    convergence: ConvergenceCodecV09,
+    change_size: ChangeSizeCodec
+  })
+]);
+var FindingsCodecV09 = t.exact(FindingsV09Shape);
+var normalizeV09 = (doc) => {
+  const findings = doc.findings.map(({ code, id, ...f }) => ({
+    ...f,
+    id: resolveRuleId({ id, code, path: f.path, title: f.title }) ?? synthesizedFindingId(f.path, f.title)
+  }));
+  const systemic_problems = doc.systemic_problems?.map(
+    ({ code, id, finding_codes, finding_ids, ...s }) => ({
+      ...s,
+      id: resolveRuleId({ id, code, title: s.title }) ?? synthesizedSystemicId(s.title),
+      ...finding_ids !== void 0 && finding_ids.length > 0 ? { finding_ids } : finding_codes !== void 0 ? { finding_ids: finding_codes } : {}
+    })
+  );
+  const scope_metastasis = doc.scope_metastasis === void 0 ? void 0 : {
+    decision_prompt: doc.scope_metastasis.decision_prompt,
+    // A legacy recurring item carrying neither code nor id names nothing — drop it rather than
+    // synthesize an id with nothing to key it on.
+    recurring: doc.scope_metastasis.recurring.flatMap((r) => {
+      const carried = r.id !== void 0 && r.id !== "" ? r.id : r.code;
+      return carried === void 0 || carried === "" ? [] : [
+        {
+          id: carried,
+          consecutive_rounds: r.consecutive_rounds,
+          start_round: r.start_round
+        }
+      ];
+    })
+  };
+  const convergence = doc.convergence === void 0 ? void 0 : {
+    score: doc.convergence.score,
+    threshold: doc.convergence.threshold,
+    converged: doc.convergence.converged,
+    ...doc.convergence.rounds !== void 0 ? {
+      rounds: doc.convergence.rounds.map((r) => {
+        const ids = usableCountsMap(r.ids) ?? usableCountsMap(r.codes);
+        return {
+          round: r.round,
+          ...r.score !== void 0 ? { score: r.score } : {},
+          ...ids !== void 0 ? { ids } : {},
+          ...r.sha !== void 0 ? { sha: r.sha } : {}
+        };
+      })
+    } : {}
+  };
+  return {
+    schema_version: DEFAULT_SCHEMA_VERSION,
+    summary: doc.summary,
+    verdict: doc.verdict,
+    findings,
+    ...systemic_problems !== void 0 ? { systemic_problems } : {},
+    ...scope_metastasis !== void 0 ? { scope_metastasis } : {},
+    ...convergence !== void 0 ? { convergence } : {},
+    ...doc.change_size !== void 0 ? { change_size: doc.change_size } : {}
+  };
+};
 var TriageCodec = t.type({
   safe: t.boolean,
   reasons: t.string
@@ -344,7 +546,7 @@ var TestSummaryCodec = t.intersection([
     failures: t.array(TestFailureCodec)
   })
 ]);
-var DEFAULT_SCHEMA_VERSION = "0.9.0";
+var DEFAULT_SCHEMA_VERSION = "0.10.0";
 var incompleteFindings = (summary) => ({
   schema_version: DEFAULT_SCHEMA_VERSION,
   summary,
@@ -568,6 +770,7 @@ var findingPayload = (finding, schemaVersion) => Buffer.from(
   JSON.stringify({ schema_version: schemaVersion, findings: [finding] }),
   "utf-8"
 ).toString("base64");
+var lineRange = (startLine, endLine, separator) => startLine === endLine ? String(startLine) : `${String(startLine)}${separator}${String(endLine)}`;
 var findingPointer = (finding, schemaVersion, jsonUrl) => {
   const payload = findingPayload(finding, schemaVersion);
   if (payload.length > INLINE_EMBED_LIMIT_CHARS) {
@@ -616,24 +819,21 @@ var isSeverityCounts = (u) => typeof u === "object" && u !== null && SEVERITIES.
   const v = u[k];
   return typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
 });
-var MAX_CODES_PER_ROUND = 8;
-var hasCode = (codes, code) => codes !== void 0 && Object.prototype.hasOwnProperty.call(codes, code);
+var MAX_IDS_PER_ROUND = 8;
+var hasId = (ids, code) => ids !== void 0 && Object.prototype.hasOwnProperty.call(ids, code);
 var escapeCodeBackticks = (code) => code.replace(/`/g, "-").replace(/\r?\n/g, " ");
-var normalizeCodeCounts = (codes, priorCodes) => {
-  if (typeof codes !== "object" || codes === null || Array.isArray(codes)) return void 0;
-  const entries = Object.entries(codes).filter(
-    (e) => typeof e[1] === "number" && Number.isSafeInteger(e[1]) && e[1] > 0
-  );
+var normalizeIdCounts = (ids, priorCodes) => {
+  const entries = Object.entries(usableCountsMap(ids) ?? {});
   if (entries.length === 0) return void 0;
   const sorted = entries.sort((a, b) => {
     if (b[1] !== a[1]) return b[1] - a[1];
-    const aPrior = hasCode(priorCodes, a[0]) ? 1 : 0;
-    const bPrior = hasCode(priorCodes, b[0]) ? 1 : 0;
+    const aPrior = hasId(priorCodes, a[0]) ? 1 : 0;
+    const bPrior = hasId(priorCodes, b[0]) ? 1 : 0;
     if (aPrior !== bPrior) return bPrior - aPrior;
     return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0;
   });
-  const base = sorted.slice(0, MAX_CODES_PER_ROUND);
-  const priorKept = sorted.slice(MAX_CODES_PER_ROUND).filter(([code]) => hasCode(priorCodes, code)).slice(0, MAX_CODES_PER_ROUND);
+  const base = sorted.slice(0, MAX_IDS_PER_ROUND);
+  const priorKept = sorted.slice(MAX_IDS_PER_ROUND).filter(([code]) => hasId(priorCodes, code)).slice(0, MAX_IDS_PER_ROUND);
   return Object.fromEntries([...base, ...priorKept]);
 };
 var parseRounds = (body) => {
@@ -645,13 +845,13 @@ var parseRounds = (body) => {
   let priorCodes;
   for (const u of decoded.filter(isSeverityCounts)) {
     const rec = u;
-    const codes = normalizeCodeCounts(rec["codes"], priorCodes);
+    const codes = normalizeIdCounts(rec["ids"], priorCodes) ?? normalizeIdCounts(rec["codes"], priorCodes);
     priorCodes = codes;
     const sha = rec["sha"];
     const shaStr = typeof sha === "string" && sha !== "" ? sha : void 0;
     const round = rec["round"];
     const roundNum = typeof round === "number" && Number.isSafeInteger(round) && round >= 1 ? round : void 0;
-    const base = codes === void 0 ? { critical: u.critical, major: u.major, minor: u.minor, nit: u.nit } : { critical: u.critical, major: u.major, minor: u.minor, nit: u.nit, codes };
+    const base = codes === void 0 ? { critical: u.critical, major: u.major, minor: u.minor, nit: u.nit } : { critical: u.critical, major: u.major, minor: u.minor, nit: u.nit, ids: codes };
     const record3 = shaStr === void 0 ? base : { ...base, sha: shaStr };
     kept.push(roundNum === void 0 ? record3 : { ...record3, round: roundNum });
   }
@@ -665,29 +865,31 @@ var roundsSummary = (rounds, count = rounds.length) => {
   const trajectory = cells.length === 0 ? "" : rounds.length > TRAJECTORY_SCORES ? `\u2026 \u2192 ${cells.join(" \u2192 ")}` : cells.join(" \u2192 ");
   return trajectory === "" ? `**Round ${String(count)}**` : `**Round ${String(count)}** \xB7 ${trajectory}`;
 };
-var computeCodeCounts = (findings, systemic = []) => {
+var computeIdCounts = (findings, systemic = []) => {
   const counts = /* @__PURE__ */ new Map();
   for (const code of [
-    ...findings.map((f) => f.code),
-    ...systemic.flatMap((s) => [s.code, ...s.finding_codes ?? []])
+    // resolveFindingId: an EMPTY id counts under the same synthesized key the answered match uses —
+    // one finding can never be simultaneously tracked (dropped-by-synthesis) and uncounted.
+    ...findings.map((f) => resolveFindingId(f)),
+    ...systemic.flatMap((s) => [s.id, ...s.finding_ids ?? []])
   ]) {
     if (code === void 0 || code === "") continue;
     counts.set(code, (counts.get(code) ?? 0) + 1);
   }
   return Object.fromEntries(counts);
 };
-var consecutiveCodeStreaks = (rounds) => {
+var consecutiveIdStreaks = (rounds) => {
   const entries = [];
   if (rounds.length === 0) return {};
-  const lastCodes = rounds[rounds.length - 1]?.codes;
+  const lastCodes = rounds[rounds.length - 1]?.ids;
   if (lastCodes === void 0) return {};
   for (const code of Object.keys(lastCodes)) {
     let streak = 0;
     let startIndex = rounds.length;
     for (let i = rounds.length - 1; i >= 0; i--) {
-      const codes = rounds[i]?.codes;
-      if (codes === void 0 || !hasCode(codes, code)) break;
-      if (i > 0 && rounds[i]?.sha !== void 0 && rounds[i]?.sha === rounds[i - 1]?.sha && hasCode(rounds[i - 1]?.codes, code)) {
+      const codes = rounds[i]?.ids;
+      if (codes === void 0 || !hasId(codes, code)) break;
+      if (i > 0 && rounds[i]?.sha !== void 0 && rounds[i]?.sha === rounds[i - 1]?.sha && hasId(rounds[i - 1]?.ids, code)) {
         continue;
       }
       streak += 1;
@@ -701,12 +903,12 @@ var consecutiveCodeStreaks = (rounds) => {
 };
 var DEFAULT_METASTASIS_STREAK = 3;
 var SCOPE_METASTASIS_DECISION_PROMPT = "Findings keep recurring in the same mechanism across consecutive rounds \u2014 each fix keeps enabling the next finding in that machinery. This is a decision, not a directive: state in your summary whether you are committing to the expanding scope (plan the remaining facets of the recurring mechanism(s) above as one unit) or narrowing the scope so the recurrence stops.";
-var flaggedCodeStreaks = (rounds, minStreak) => Object.entries(consecutiveCodeStreaks(rounds)).filter(([, s]) => s.streak >= minStreak).sort((a, b) => b[1].streak - a[1].streak).map(([code, streak]) => ({ code, streak }));
+var flaggedIdStreaks = (rounds, minStreak) => Object.entries(consecutiveIdStreaks(rounds)).filter(([, s]) => s.streak >= minStreak).sort((a, b) => b[1].streak - a[1].streak).map(([id, streak]) => ({ id, streak }));
 var metastasisNote = (rounds, minStreak = DEFAULT_METASTASIS_STREAK) => {
-  const flagged = flaggedCodeStreaks(rounds, minStreak);
+  const flagged = flaggedIdStreaks(rounds, minStreak);
   if (flagged.length === 0) return "";
   const lines = flagged.map(
-    ({ code, streak }) => `> **\`${escapeCodeBackticks(code)}\`** \u2014 findings in ${String(streak.streak)} consecutive rounds.`
+    ({ id, streak }) => `> **\`${escapeCodeBackticks(id)}\`** \u2014 findings in ${String(streak.streak)} consecutive rounds.`
   );
   return [
     "> [!WARNING]",
@@ -715,27 +917,27 @@ var metastasisNote = (rounds, minStreak = DEFAULT_METASTASIS_STREAK) => {
   ].join("\n");
 };
 var computeScopeMetastasis = (rounds, minStreak = DEFAULT_METASTASIS_STREAK) => {
-  const flagged = flaggedCodeStreaks(rounds, minStreak);
+  const flagged = flaggedIdStreaks(rounds, minStreak);
   if (flagged.length === 0) return null;
   return {
     decision_prompt: SCOPE_METASTASIS_DECISION_PROMPT,
-    recurring: flagged.map(({ code, streak }) => ({
-      code,
+    recurring: flagged.map(({ id, streak }) => ({
+      id,
       consecutive_rounds: streak.streak,
       start_round: streak.startRound
     }))
   };
 };
 var computeSameRootNotes = (priorRounds, findings, currentSha) => {
-  const codes = findings.map((f) => f.code).filter((c) => c !== void 0 && c !== "");
+  const codes = findings.map((f) => resolveFindingId(f));
   const entries = [];
   for (const code of codes) {
     let lastRound = 0;
     for (let i = priorRounds.length - 1; i >= 0; i--) {
       if (currentSha !== void 0 && priorRounds[i]?.sha === currentSha) continue;
-      if (i > 0 && priorRounds[i]?.sha !== void 0 && priorRounds[i]?.sha === priorRounds[i - 1]?.sha && hasCode(priorRounds[i - 1]?.codes, code))
+      if (i > 0 && priorRounds[i]?.sha !== void 0 && priorRounds[i]?.sha === priorRounds[i - 1]?.sha && hasId(priorRounds[i - 1]?.ids, code))
         continue;
-      const count = priorRounds[i]?.codes?.[code];
+      const count = priorRounds[i]?.ids?.[code];
       if (count !== void 0 && count > 0) {
         lastRound = priorRounds[i]?.round ?? i + 1;
         break;
@@ -769,13 +971,13 @@ var convergenceScore = (doc, threshold) => round2(
     0
   )
 );
-var buildConvergence = (doc, threshold = DEFAULT_CONVERGENCE_THRESHOLD, priorRounds = [], round = 1, codes = {}, sha) => {
+var buildConvergence = (doc, threshold = DEFAULT_CONVERGENCE_THRESHOLD, priorRounds = [], round = 1, ids = {}, sha) => {
   const score = convergenceScore(doc, threshold);
-  const normalized = normalizeCodeCounts(codes, priorRounds[priorRounds.length - 1]?.codes);
+  const normalized = normalizeIdCounts(ids, priorRounds[priorRounds.length - 1]?.ids);
   const current = {
     round,
     score,
-    ...normalized !== void 0 ? { codes: { ...normalized } } : {},
+    ...normalized !== void 0 ? { ids: { ...normalized } } : {},
     ...sha !== void 0 ? { sha } : {}
   };
   const rounds = [...priorRounds, current].slice(-64);
@@ -794,11 +996,16 @@ var priorBelowFloorNits = (priorDoc, floor = DEFAULT_NIT_VISIBILITY_FLOOR) => {
     if (!isBelowVisibilityFloor(rec, floor)) continue;
     const title = rec["title"];
     if (typeof title !== "string") continue;
-    const code = typeof rec["code"] === "string" && rec["code"] !== "" ? rec["code"] : void 0;
     const path = typeof rec["path"] === "string" ? rec["path"] : void 0;
+    const id = resolveRuleId({
+      id: typeof rec["id"] === "string" ? rec["id"] : void 0,
+      code: typeof rec["code"] === "string" ? rec["code"] : void 0,
+      path,
+      title
+    });
     nits.push({
       title,
-      ...code !== void 0 ? { code } : {},
+      ...id !== void 0 ? { id } : {},
       ...path !== void 0 ? { path } : {}
     });
   }
@@ -851,8 +1058,33 @@ var parseSurfaceSignal = (doc) => {
     convergence: { score: c["score"], threshold: c["threshold"], converged: c["converged"] }
   };
 };
+var withLegacyConvergenceIds = (raw) => {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return raw;
+  const rec = raw;
+  const rounds = rec["rounds"];
+  if (!Array.isArray(rounds)) return raw;
+  const needsMigration = (r) => {
+    if (typeof r !== "object" || r === null) return false;
+    const round = r;
+    return round["codes"] !== void 0 || usableCountsMap(round["ids"]) === void 0;
+  };
+  if (!rounds.some(needsMigration)) return raw;
+  const mapped = rounds.map((r) => {
+    if (typeof r !== "object" || r === null) return r;
+    const round = r;
+    const ids = usableCountsMap(round["ids"]) ?? usableCountsMap(round["codes"]);
+    if (ids === void 0) {
+      return round["ids"] !== void 0 || round["codes"] !== void 0 ? Object.fromEntries(Object.entries(round).filter(([k]) => k !== "ids" && k !== "codes")) : round;
+    }
+    const rest = Object.fromEntries(
+      Object.entries(round).filter(([k]) => k !== "ids" && k !== "codes")
+    );
+    return { ...rest, ids };
+  });
+  return { ...rec, rounds: mapped };
+};
 var validStampedConvergence = (raw) => {
-  const decoded = ConvergenceCodec.decode(raw);
+  const decoded = ConvergenceCodec.decode(withLegacyConvergenceIds(raw));
   return decoded._tag === "Right" && decoded.right.rounds !== void 0 && decoded.right.rounds.length > 0 ? decoded.right : null;
 };
 var parseConvergence = (priorDoc) => {
@@ -877,7 +1109,7 @@ var parseConvergenceMarker = (body) => {
 };
 var roundRecordsToConvergenceRounds = (records) => records.map((r, i) => ({
   round: r.round ?? i + 1,
-  ...r.codes !== void 0 ? { codes: { ...r.codes } } : {},
+  ...r.ids !== void 0 ? { ids: { ...r.ids } } : {},
   ...r.sha !== void 0 ? { sha: r.sha } : {}
 }));
 var priorTrajectory = (priorDoc, priorBody) => parseConvergence(priorDoc)?.rounds ?? parseConvergenceMarker(priorBody)?.rounds ?? roundRecordsToConvergenceRounds(parseRounds(priorBody));
@@ -1111,12 +1343,22 @@ var answeredRegistryFrom = (comments, botLogin) => {
     const title = first["title"];
     const description = first["description"];
     const reasoning = first["reasoning"];
-    const code = first["code"];
+    const id = first["id"];
+    const legacyCode = first["code"];
     const severity = first["severity"];
     const path = first["path"];
     const patch = first["patch"];
     return typeof title === "string" && typeof description === "string" && typeof reasoning === "string" && typeof path === "string" && (severity === "critical" || severity === "major" || severity === "minor" || severity === "nit") ? {
-      code: typeof code === "string" ? code : "",
+      // resolveRuleId: the ONE legacy-spelling precedence the upcast, this reader, and the
+      // below-floor nit reader share — a pre-id marker (or one written before the migration)
+      // carries `code`; a codeless one resolves to the same synthesized id the registry's
+      // legacy upcast derives, so the entry keys to the identical claim on the next round.
+      code: resolveRuleId({
+        id: typeof id === "string" ? id : void 0,
+        code: typeof legacyCode === "string" ? legacyCode : void 0,
+        path,
+        title
+      }) ?? synthesizedFindingId(path, title),
       title,
       description,
       reasoning,
@@ -1158,29 +1400,31 @@ var answeredRegistryFrom = (comments, botLogin) => {
   for (const entry of [...entries].sort(
     (a, b) => (b.repliedAt ?? "").localeCompare(a.repliedAt ?? "") || b.replyId - a.replyId
   )) {
-    const key2 = answeredNoteKey(entry);
+    const key2 = answeredNoteKey({ id: entry.code, title: entry.title });
     if (!byKey.has(key2)) byKey.set(key2, entry);
   }
   return [...byKey.values()];
 };
-var matches = (f, e) => f.code !== void 0 && f.code !== "" ? e.code === f.code : e.code === "" && e.title === f.title;
+var matches = (f, e) => e.code === resolveFindingId(f) || isSynthesizedFindingId(e.code) && e.title === f.title;
 var isVerbatimReRaise = (f, e) => f.title === e.title && f.description === e.description && f.reasoning === e.reasoning && f.severity === e.severity && f.path === e.path && (f.patch ?? null) === e.patch;
 var isAnsweredDrop = (f, e) => matches(f, e) && isVerbatimReRaise(f, e) && f.severity !== "critical";
-var answeredNoteKey = (f) => f.code !== void 0 && f.code !== "" ? f.code : `title:${f.title}`;
+var answeredNoteKey = (f) => f.id !== "" ? f.id : `title:${f.title}`;
 var answeredNote = (e) => `Re-raised; prior answer at ${e.replyUrl} by ${e.replyAuthor} \u2014 cite the new evidence that invalidates it.`;
 var applyAnswered = (findings, registry) => {
   const kept = [];
   const noteEntries = [];
-  const droppedByKey = /* @__PURE__ */ new Map();
+  const droppedByEntry = /* @__PURE__ */ new Map();
+  const droppedFindingIds = [];
   let droppedCount = 0;
   for (const f of findings) {
-    const entry = registry.find((e) => matches(f, e));
+    const entry = registry.find((e) => e.code === resolveFindingId(f)) ?? registry.find((e) => isSynthesizedFindingId(e.code) && e.title === f.title);
     if (entry === void 0) {
       kept.push(f);
       continue;
     }
     if (isAnsweredDrop(f, entry)) {
-      droppedByKey.set(answeredNoteKey(f), entry);
+      droppedByEntry.set(entry.replyId, entry);
+      droppedFindingIds.push(resolveFindingId(f));
       droppedCount += 1;
     } else {
       kept.push(f);
@@ -1190,7 +1434,8 @@ var applyAnswered = (findings, registry) => {
   return {
     findings: kept,
     reRaisedNotes: Object.fromEntries(noteEntries),
-    verbatimReRaised: [...droppedByKey.values()],
+    verbatimReRaised: [...droppedByEntry.values()],
+    droppedFindingIds,
     droppedCount
   };
 };
@@ -1232,17 +1477,42 @@ var fetchThreadComments = async (ghApi, repo, prNumber) => {
 
 // src/render.ts
 var escapePipes = (text) => text.replace(/\|/g, "\\|");
-var linkSafeUrl = (url) => escapeCodeBackticks(url).replace(/\(/g, "%28").replace(/\)/g, "%29");
+var encodeAutolinkParens = (url) => url.replace(/\(/g, "%28").replace(/\)/g, "%29");
+var linkSafeUrl = (url) => encodeAutolinkParens(escapeCodeBackticks(url));
+var permalinkFor = (base, f, anchor) => {
+  if (f.path === "" || f.side === "LEFT") return void 0;
+  const path = f.path.split("/").map(
+    (segment) => encodeAutolinkParens(
+      encodeURIComponent(
+        segment.replace(
+          /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,
+          "\uFFFD"
+        )
+      )
+      // Markdown emphasis/syntax characters: `__` runs split the bare URL across CommonMark
+      // nodes and truncate the autolink, and a path-only link ending in one of these loses its
+      // tail to the autolinker's trailing-punctuation trim (issue #231 r4).
+    ).replace(/_/g, "%5F").replace(/\*/g, "%2A").replace(/'/g, "%27").replace(/!/g, "%21")
+  ).join("/");
+  return anchor ? `${base}${path}#L${lineRange(f.start_line, f.end_line, "-L")}` : `${base}${path}`;
+};
 var CARRIED_TOTAL_CHARS = 4e4;
 var SUPPRESSED_NIT_BLOCK_OVERHEAD = 280;
-var sanitizeFinding = (f, answeredNotes) => {
+var sanitizeFinding = (f, answeredNotes, permalinkBase, unanchored) => {
   const key2 = answeredNoteKey(f);
+  const anchored = permalinkBase !== void 0 && !(unanchored?.has(f) ?? false);
+  const permalink = permalinkBase === void 0 ? void 0 : permalinkFor(permalinkBase, f, anchored);
   return {
     ...f,
     title: escapePipes(f.title),
     path: escapeCodeBackticks(f.path),
-    ...f.code !== void 0 ? { code: escapeCodeBackticks(f.code), codeKey: f.code } : {},
+    id: escapeCodeBackticks(f.id),
+    // The RESOLVED id: the same-root notes are keyed on resolveFindingId (an empty id resolves to
+    // its synthesized key), so the lookup must not miss the note on the raw id.
+    idKey: resolveFindingId(f),
     ...f.code_url !== void 0 ? { code_url: linkSafeUrl(f.code_url) } : {},
+    rangeLabel: lineRange(f.start_line, f.end_line, "\u2013"),
+    ...permalink !== void 0 ? { permalink, permalinkAnchored: anchored } : {},
     patchProjection: projectPatch(f.patch, "comment-body"),
     answeredNote: answeredNotes !== void 0 && Object.prototype.hasOwnProperty.call(answeredNotes, key2) ? answeredNotes[key2] ?? "" : ""
   };
@@ -1250,7 +1520,7 @@ var sanitizeFinding = (f, answeredNotes) => {
 var commentSafe = (text) => text.replace(/--+(?=>)/g, (dashes) => `${dashes}\u200B`);
 var sanitizeSuppressedNit = (f) => ({
   title: escapeCodeBackticks(f.title),
-  ...f.code !== void 0 ? { code: escapeCodeBackticks(f.code) } : {},
+  id: escapeCodeBackticks(f.id),
   ...f.code_url !== void 0 ? { codeUrl: linkSafeUrl(f.code_url) } : {},
   path: commentSafe(escapeCodeBackticks(f.path)),
   startLine: f.start_line,
@@ -1271,10 +1541,10 @@ var carriedLines = (f) => [
 var sanitizeSystemic = (s) => ({
   ...s,
   title: escapePipes(s.title),
-  ...s.code !== void 0 ? { code: escapeCodeBackticks(s.code) } : {},
+  ...s.id !== void 0 ? { id: escapeCodeBackticks(s.id) } : {},
   ...s.code_url !== void 0 ? { code_url: linkSafeUrl(s.code_url) } : {},
   ...s.paths !== void 0 ? { paths: s.paths.map(escapeCodeBackticks) } : {},
-  ...s.finding_codes !== void 0 ? { finding_codes: s.finding_codes.map(escapeCodeBackticks) } : {}
+  ...s.finding_ids !== void 0 ? { finding_ids: s.finding_ids.map(escapeCodeBackticks) } : {}
 });
 var emptySeverityCounts = () => ({
   critical: 0,
@@ -1307,12 +1577,14 @@ var render = (input) => {
   const advisoryAllowed = isFullReviewRound;
   const suppressedBudget = (input.suppressedNits ?? []).map(sanitizeSuppressedNit).reduce(
     (acc, n) => {
-      const size = n.carried.reduce((sum, line) => sum + line.length + 3, 0) + SUPPRESSED_NIT_BLOCK_OVERHEAD + n.title.length + n.path.length * 2 + (n.code?.length ?? 0) + (n.codeUrl?.length ?? 0) + String(n.startLine).length * 2 + String(n.endLine).length + (n.side !== void 0 ? n.side.length + 2 : 0) + // The summary line's wrappers: backticks around the code and the [](...) around the link.
-      (n.code !== void 0 ? n.code.length + 2 : 0) + (n.codeUrl !== void 0 ? n.codeUrl.length + 4 : 0);
+      const size = n.carried.reduce((sum, line) => sum + line.length + 3, 0) + SUPPRESSED_NIT_BLOCK_OVERHEAD + n.title.length + n.path.length * 2 + // The id renders with its two wrapper backticks; the code_url adds the [](...) link form.
+      n.id.length * 2 + 2 + (n.codeUrl !== void 0 ? n.codeUrl.length + 4 : 0) + String(n.startLine).length * 2 + String(n.endLine).length + (n.side !== void 0 ? n.side.length + 2 : 0);
       return acc.used + size > CARRIED_TOTAL_CHARS ? { list: acc.list, used: acc.used, dropped: acc.dropped + 1 } : { list: [...acc.list, n], used: acc.used + size, dropped: acc.dropped };
     },
     { list: [], used: 0, dropped: 0 }
   );
+  const permalinkBase = input.repo !== void 0 && input.repo !== "" && input.reviewedSha !== void 0 && input.reviewedSha !== "" ? `https://github.com/${input.repo}/blob/${input.reviewedSha}/` : void 0;
+  const unanchored = new Set(input.unanchoredStrays ?? []);
   return eta.renderString(input.template, {
     findings: input.findings,
     envelope: input.envelope,
@@ -1333,7 +1605,9 @@ var render = (input) => {
     postedAt: input.postedAt ?? "",
     severityCounts,
     convergenceSummary: !isFullReviewRound ? "" : convergence ? convergenceBadge(convergence) : convergenceSummary(input.findings, input.convergenceThreshold),
-    strays: (input.strays ?? []).map((f) => sanitizeFinding(f, input.answeredNotes)),
+    strays: (input.strays ?? []).map(
+      (f) => sanitizeFinding(f, input.answeredNotes, permalinkBase, unanchored)
+    ),
     suppressedNits: suppressedBudget.list,
     carriedDroppedNits: suppressedBudget.dropped,
     nitVisibilityFloor: input.nitVisibilityFloor ?? DEFAULT_NIT_VISIBILITY_FLOOR,
@@ -1456,11 +1730,7 @@ var buildInlineComments = (findings, diff, context) => {
   const { inDiff, strays } = partitionFindings(findings, index);
   const eta = new Eta({ autoTrim: false });
   const modelsText = formatModels(models);
-  const noteFor = (f, notes) => {
-    if (notes === void 0) return "";
-    const key2 = answeredNoteKey(f);
-    return Object.prototype.hasOwnProperty.call(notes, key2) ? notes[key2] ?? "" : "";
-  };
+  const noteFor = (notes, key2) => notes !== void 0 && Object.prototype.hasOwnProperty.call(notes, key2) ? notes[key2] ?? "" : "";
   const comments = inDiff.map((f) => {
     const pointer = fullFindings ? findingPointer(f, fullFindings.schema_version, jsonUrl) : "";
     const clipProse = fullFindings !== void 0 && findingPayload(f, fullFindings.schema_version).length > INLINE_PROSE_CLIP_THRESHOLD_CHARS;
@@ -1472,8 +1742,8 @@ var buildInlineComments = (findings, diff, context) => {
       reasoning: clipText(f.reasoning, BODY_CLIP_CHARS),
       ...f.patch != null ? { patch: clipText(f.patch, BODY_CLIP_CHARS) } : {}
     } : f;
-    const sameRootNote = noteFor(f, context.sameRootNotes);
-    const answeredNote2 = noteFor(f, context.answeredNotes);
+    const sameRootNote = noteFor(context.sameRootNotes, resolveFindingId(f));
+    const answeredNote2 = noteFor(context.answeredNotes, answeredNoteKey(f));
     const comment = {
       path: f.path,
       line: f.end_line,
@@ -1917,33 +2187,47 @@ var buildUnknownNoticeEnvelope = (kind) => noticeEnvelope(
 The workflow asked for an unrecognized notice kind (\`${kind}\`) \u2014 the pinned code-review CLI is older than the workflow calling it (check that its version matches). Failing closed. See the workflow logs.`
 );
 var identity = (decoded) => decoded;
+var legacyFindingsCodec = FindingsCodecV09;
+var legacyFindingsNormalize = (doc) => normalizeV09(doc);
 var findingsTable = [
   {
     minor: "0.4",
     defaultVersion: "0.4.0",
-    schemaFile: "findings.schema.json",
-    codec: FindingsCodec,
-    normalize: identity,
+    // The frozen tolerant-in legacy schema, NOT the live 0.10 file: every ajv-gated channel
+    // (validate --schema-version, the extraction ladder) dispatches the RAW doc's declared minor
+    // through schemaPathFor, so the ajv gate must accept exactly what the tolerant legacy codec
+    // accepts — the live file (id required) would reject the legacy docs the upcast promises to read.
+    schemaFile: "v0.9/findings.schema.json",
+    codec: legacyFindingsCodec,
+    normalize: legacyFindingsNormalize,
     latest: false
   },
   {
     minor: "0.5",
     defaultVersion: "0.5.0",
-    schemaFile: "findings.schema.json",
-    codec: FindingsCodec,
-    normalize: identity,
+    schemaFile: "v0.9/findings.schema.json",
+    codec: legacyFindingsCodec,
+    normalize: legacyFindingsNormalize,
     latest: false
   },
   {
     minor: "0.6",
     defaultVersion: "0.6.0",
-    schemaFile: "findings.schema.json",
-    codec: FindingsCodec,
-    normalize: identity,
+    schemaFile: "v0.9/findings.schema.json",
+    codec: legacyFindingsCodec,
+    normalize: legacyFindingsNormalize,
     latest: false
   },
   {
     minor: "0.9",
+    defaultVersion: "0.9.0",
+    schemaFile: "v0.9/findings.schema.json",
+    codec: legacyFindingsCodec,
+    normalize: legacyFindingsNormalize,
+    latest: false
+  },
+  {
+    minor: "0.10",
     defaultVersion: DEFAULT_SCHEMA_VERSION,
     schemaFile: "findings.schema.json",
     codec: FindingsCodec,
@@ -2037,6 +2321,13 @@ var resolvers = {
   prices: (raw) => resolveSingleVersion("prices", raw)
 };
 var resolve = (kind, raw) => resolvers[kind](raw);
+var resolveTolerantFindings = (doc) => {
+  const r = resolveFindings(doc);
+  if (r.kind === "ok") return r.value;
+  if (r.kind === "unsupported-version") return null;
+  const legacy = FindingsCodecV09.decode(doc);
+  return legacy._tag === "Right" ? normalizeV09(legacy.right) : null;
+};
 var MAX_BUFFER = 100 * 1024 * 1024;
 var MAX_TIMEOUT_MS = 2147483647;
 var parseTimeoutMs = (raw, fallback) => {
@@ -2083,14 +2374,32 @@ var execFileWithTimeout = (spec) => new Promise((resolve4, reject) => {
 
 // src/gh.ts
 var describeEndpoint = (args) => args.find((a) => a === "graphql" || a.includes("/") && !a.startsWith("-")) ?? args[0] ?? "(no endpoint)";
-var runGhApi = (args, stdin, env) => execFileWithTimeout({
-  command: "gh",
-  args: ["api", ...args],
-  label: `gh api ${describeEndpoint(args)}`,
-  timeoutMs: subprocessTimeoutMs(),
-  env,
-  stdin
-});
+var flagFirst;
+var withEscapeRetry = async (run2, idempotent) => {
+  if (flagFirst) return run2(true);
+  try {
+    return await run2(false);
+  } catch (err) {
+    if (errMsg(err).includes("--allow-escape-sequences")) {
+      if (!idempotent) throw err;
+      flagFirst = true;
+      return run2(true);
+    }
+    throw err;
+  }
+};
+var isIdempotentCall = (args) => !args.includes("--input") && !args.includes("--method") && !args.includes("graphql");
+var runGhApi = (args, stdin, env) => withEscapeRetry(
+  (withFlag) => execFileWithTimeout({
+    command: "gh",
+    args: ["api", ...withFlag ? ["--allow-escape-sequences"] : [], ...args],
+    label: `gh api ${describeEndpoint(args)}`,
+    timeoutMs: subprocessTimeoutMs(),
+    env,
+    stdin
+  }),
+  isIdempotentCall(args)
+);
 var run = promisify(execFile);
 var STEP_TIMEOUT_MS = 6e4;
 var MARKER_URL = /<!-- code-review:findings-json (https?:\/\/[^\s>]+) -->/;
@@ -2143,11 +2452,14 @@ var readArtifactFindings = (ghApiPath) => {
   };
 };
 var ghArtifactReader = readArtifactFindings(async (url, outPath) => {
-  const { stdout } = await run("gh", ["api", url], {
-    encoding: "buffer",
-    maxBuffer: 256 * 1024 * 1024,
-    timeout: STEP_TIMEOUT_MS
-  });
+  const { stdout } = await withEscapeRetry(
+    (withFlag) => run("gh", ["api", ...withFlag ? ["--allow-escape-sequences"] : [], url], {
+      encoding: "buffer",
+      maxBuffer: 256 * 1024 * 1024,
+      timeout: STEP_TIMEOUT_MS
+    }),
+    true
+  );
   await writeFile(outPath, stdout);
 });
 var withoutKey = (doc, key2) => Object.fromEntries(Object.entries(doc).filter(([k]) => k !== key2));
@@ -2813,15 +3125,16 @@ ${dropNote}` : ""}`,
   const reRaisedNotes = answeredFilter.reRaisedNotes;
   const verbatimReRaised = answeredFilter.verbatimReRaised;
   const droppedCount = answeredFilter.droppedCount;
-  const droppedCodes = new Set(verbatimReRaised.flatMap((e) => e.code !== "" ? [e.code] : []));
-  const keptCodes = new Set(
-    answeredFilter.findings.flatMap((f) => f.code !== void 0 && f.code !== "" ? [f.code] : [])
-  );
-  const trulyDropped = new Set([...droppedCodes].filter((c) => !keptCodes.has(c)));
+  const droppedIds = /* @__PURE__ */ new Set([
+    ...verbatimReRaised.flatMap((e) => e.code !== "" ? [e.code] : []),
+    ...answeredFilter.droppedFindingIds.filter((id) => id !== "")
+  ]);
+  const keptCodes = new Set(answeredFilter.findings.map((f) => f.id));
+  const trulyDropped = new Set([...droppedIds].filter((c) => !keptCodes.has(c)));
   const systemic = trulyDropped.size === 0 ? loadedFindings.systemic_problems ?? [] : (loadedFindings.systemic_problems ?? []).map((s) => {
-    if (s.finding_codes === void 0) return s;
-    const codes = s.finding_codes.filter((c) => !trulyDropped.has(c));
-    return codes.length === s.finding_codes.length ? s : { ...s, finding_codes: codes };
+    if (s.finding_ids === void 0) return s;
+    const codes = s.finding_ids.filter((c) => !trulyDropped.has(c));
+    return codes.length === s.finding_ids.length ? s : { ...s, finding_ids: codes };
   });
   const findings = {
     ...loadedFindings,
@@ -2832,10 +3145,13 @@ ${dropNote}` : ""}`,
   const priorDocForNits = roundHasNit && existingSticky !== null && isFullReviewSticky(existingSticky.body) ? await resolvePriorFindings(existingSticky.body, readArtifact) : null;
   const priorSuppressedKeys = new Set(
     priorBelowFloorNits(priorDocForNits, input.nitVisibilityFloor).map(
-      (n) => answeredNoteKey({ code: n.code, title: n.title })
+      (n) => answeredNoteKey({ id: n.id ?? "", title: n.title })
     )
   );
-  const isSuppressedNit = (f) => f.severity === "nit" && (isBelowVisibilityFloor(f, input.nitVisibilityFloor) || priorSuppressedKeys.has(answeredNoteKey(f)));
+  const isSuppressedNit = (f) => f.severity === "nit" && (isBelowVisibilityFloor(f, input.nitVisibilityFloor) || // ALL THREE key forms the prior side can emit: the resolved id (a coded or same-path
+  // synthesized prior), the answeredNoteKey form (an empty-id prior), and the bare title: key
+  // (a pathless codeless prior).
+  priorSuppressedKeys.has(resolveFindingId(f)) || priorSuppressedKeys.has(answeredNoteKey(f)) || priorSuppressedKeys.has(`title:${f.title}`));
   const suppressedNits = findings.findings.filter(isSuppressedNit);
   const visibleFindings = findings.findings.filter((f) => !isSuppressedNit(f));
   const answeredDropNote = answeredReRaiseNote(verbatimReRaised, droppedCount) + (verbatimReRaised.length > 0 && findings.findings.length === 0 ? "\n> _The stop signal reflects the kept findings \u2014 this round carries none._" : "");
@@ -2862,6 +3178,7 @@ ${dropNote}` : ""}`,
         template,
         route: effectiveRoute,
         reviewedSha: input.headSha,
+        repo: input.headRepo || input.repo,
         effort: input.effort,
         sameRootNotes: {},
         // The answered-state honesty rules apply on EVERY surface that renders the filtered
@@ -2932,7 +3249,7 @@ ${dropNote}` : ""}`,
   const botReviews = await fetchBotReviews(input.repo, prNumber, input.botLogin, ghApi);
   const initialDisposition = !inlineRequested ? { kind: "disabled" } : comments.length === 0 && strays.length > 0 ? { kind: "none-in-diff" } : void 0;
   const currentCounts = computeSeverityCounts(findings.findings);
-  const currentCodes = computeCodeCounts(findings.findings, findings.systemic_problems ?? []);
+  const currentCodes = computeIdCounts(findings.findings, findings.systemic_problems ?? []);
   const roundNumber = priorRoundCount + 1;
   const convergence = isRound ? buildConvergence(
     findings,
@@ -2954,6 +3271,7 @@ ${dropNote}` : ""}`,
     template,
     route: effectiveRoute,
     reviewedSha: input.headSha,
+    repo: input.headRepo || input.repo,
     effort: input.effort,
     testReport,
     clocDiff,
@@ -2980,11 +3298,12 @@ ${dropNote}` : ""}`,
 
 > **Note:** ${String(longFiles.length)} suggestion(s) exceeded GitHub's ~10-line inline suggestion limit and were omitted from the inline comments; the affected findings remain in the review.
 ` : "";
-  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2) => formatMarkdown(
+  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2, unanchoredStrays) => formatMarkdown(
     render({
       ...commonRenderInput,
       ...straysOverride ? { strays: straysOverride } : {},
       ...unanchoredCount2 !== void 0 ? { unanchoredCount: unanchoredCount2 } : {},
+      ...unanchoredStrays !== void 0 && unanchoredStrays.length > 0 ? { unanchoredStrays } : {},
       inlineDisposition,
       reviewUrl: reviewUrl2
     }) + longFilesNote
@@ -3041,7 +3360,7 @@ ${dropNote}` : ""}`,
       await patchComment(
         input.repo,
         stickyRef.id,
-        renderBody(finalDisposition, reviewUrl, finalStrays, unanchoredCount),
+        renderBody(finalDisposition, reviewUrl, finalStrays, unanchoredCount, unposted),
         ghApi
       );
       process.stderr.write(
@@ -3060,7 +3379,13 @@ ${dropNote}` : ""}`,
     () => renderBody(
       { kind: "whole-document", inlineCount: inlinePosted, rejectedCount: unanchoredCount },
       reviewUrl,
-      visibleFindings
+      visibleFindings,
+      void 0,
+      // The rejected-anchor invariant holds on EVERY surface, the run summary included — this
+      // document deliberately carries every finding, so the GitHub-rejected ones must keep their
+      // path-only links here too (issue #231 r2). Unconditional: renderBody's own gate treats an
+      // empty array exactly like absence, so the ternary was a duplicated decision (issue #231 r3).
+      unposted
     )
   );
 };
@@ -4096,6 +4421,7 @@ var parseScope = (raw) => {
 };
 
 // src/index.ts
+var resolvedPriorValue = resolveTolerantFindings;
 var readJSON = (path) => {
   try {
     return JSON.parse(readFileSync(resolve$1(path), "utf-8"));
@@ -4873,13 +5199,13 @@ var seedDraftCmd = defineCommand({
     const priorFindings = (() => {
       if (strippedPrior === null || typeof strippedPrior !== "object" || Array.isArray(strippedPrior))
         return strippedPrior;
-      const raw = strippedPrior;
-      const doc = answeredRegistry !== null && answeredRegistry.length > 0 && Array.isArray(raw["findings"]) ? {
-        ...raw,
-        findings: raw["findings"].filter(
+      const resolved = resolvedPriorValue(strippedPrior);
+      const doc = resolved === null ? strippedPrior : {
+        ...resolved,
+        findings: answeredRegistry !== null && answeredRegistry.length > 0 ? resolved.findings.filter(
           (f) => !answeredRegistry.some((e) => isAnsweredDrop(f, e))
-        )
-      } : raw;
+        ) : resolved.findings
+      };
       const carried = doc["scope_metastasis"];
       if (ScopeMetastasisCodec.decode(carried)._tag === "Right") return doc;
       if (doc["verdict"] === "error") return doc;
@@ -4923,22 +5249,27 @@ var seedDraftCmd = defineCommand({
             ([key2]) => !RECOVERABLE_OPTIONAL_FIELDS.has(key2)
           )
         ) : priorFindings;
-        const accepts = (doc) => validateAgainstSchema(doc, schemaPath).valid && resolve("findings", doc).kind === "ok";
-        const seedDoc = accepts(priorFindings) ? priorFindings : accepts(barePrior) ? (process.stderr.write(
-          `Note: the in-force schema rejects a carried recoverable field (scope_metastasis/convergence/change_size) \u2014 seeding the prior without it (issue #150 review r2 / #182 review r2)
+        const accepts = (doc) => {
+          const resolved = resolvedPriorValue(doc);
+          return resolved !== null && validateAgainstSchema(resolved, schemaPath).valid ? resolved : null;
+        };
+        const seedDoc = accepts(priorFindings) ?? (() => {
+          const bare = accepts(barePrior);
+          if (bare === null) return null;
+          process.stderr.write(
+            `Note: the in-force schema rejects a carried recoverable field (scope_metastasis/convergence/change_size) \u2014 seeding the prior without it (issue #150 review r2 / #182 review r2)
 `
-        ), barePrior) : null;
+          );
+          return bare;
+        })();
         if (seedDoc === null) return false;
-        const resolution = resolve("findings", seedDoc);
-        if (resolution.kind !== "ok") return false;
-        if (isIncompleteFindings(resolution.value)) return false;
+        if (isIncompleteFindings(seedDoc)) return false;
         if (parseReviewedRoute(priorBody ?? "") !== "full review") return false;
         writeFileSync(outPath, SEED_SENTINEL);
         writeFileSync(priorContextPath(outPath), `${JSON.stringify(seedDoc, null, 2)}
 `);
-        const count = resolution.value.findings.length;
         process.stderr.write(
-          `Seeded ${outPath} with the sentinel and wrote the prior review (${String(count)} finding(s)) to ${priorContextPath(outPath)} as context
+          `Seeded ${outPath} with the sentinel and wrote the prior review (${String(seedDoc.findings.length)} finding(s)) to ${priorContextPath(outPath)} as context
 `
         );
         return true;
@@ -5447,6 +5778,10 @@ var postCmd = defineCommand({
     const priceResolution = resolvePrices(args.prices);
     await post({
       repo: args.repo,
+      // The workflow's post step threads HEAD_REPO env (the fork's owner/name) — a finding
+      // permalink targets the tree the reviewed SHA lives in (issue #231 r1). Absent/empty ⇒ the
+      // base repo. Env rather than a flag: an older pinned CLI simply ignores it.
+      headRepo: process.env["HEAD_REPO"] || void 0,
       headSha: args["head-sha"],
       botLogin: args["bot-login"] || "github-actions[bot]",
       findingsPath: args.findings,