limn-review 0.1.125 → 0.1.126

package/dist/api/plugins/rate-limit.js

@@ -468,6 +468,16 @@ function tierFor(method, path) {
         return [TIERS.githubWrite];
     if (path.startsWith('/api/ticket-reviews'))
         return [TIERS.read];
+    // CI REVIEW (review/ci-review/routes.ts), matched EXPLICITLY by exact path for the same reason:
+    //   POST /api/ci-reviews          starts an agent run (reads the head's checks + logs) → ai + ai_hourly
+    //   POST /api/ci-reviews/states   batched DB read of the SYNCED head + failing names   → read
+    //   GET  …/:id, …/:id/stream, /api/prs/:id/ci-review                                  → read
+    if (path === '/api/ci-reviews' && mutating)
+        return [TIERS.ai, TIERS.aiHourly];
+    if (path === '/api/ci-reviews/states')
+        return [TIERS.read];
+    if (path.startsWith('/api/ci-reviews'))
+        return [TIERS.read];
     if (/^\/api\/claude-reviews\/[^/]+\/chat$/.test(path)) {
         return mutating ? [TIERS.ai, TIERS.aiHourly] : [TIERS.read];
     }

package/dist/coding/ai-fix/auto-fix.js

@@ -6,6 +6,9 @@
 //   0. the PR's author IS the account's own GitHub user (pull_requests.author_id → users.github_login
 //      vs accounts.github_login, case-insensitive). Anyone else's PR: nothing happens and nothing is
 //      recorded — fixing someone else's branch is never automatic;
+//   ½. `off`             — auto AI Fix is switched off for the workspace holding the PR's repo
+//                          (`workspaces.auto_fix_enabled`, migration 0083 / pg 0070, Settings →
+//                          Auto review). ON by default; a repo with no membership row reads ON;
 //   1. `nothing_to_fix`  — the review's seed is empty (the same refusal as the button's NothingToFix);
 //   2. `head_moved`      — the PR's synced head is no longer the reviewed one (the next review decides);
 //   3. `fix_in_progress` — a fix for this PR (auto or manual) is queued or running;
@@ -33,6 +36,7 @@ import { AUTO_FIX_DAILY_CAP, CLAUDE_REVIEW_MODELS, DEFAULT_AI_FIX_MODEL, } from
 import { isFixRunning, loadReviewSeed, startReviewFix } from './manager.js';
 import { parseChangeReport, parseReviewItems } from './persist.js';
 import { getFixPrContext } from './pr-context.js';
+import { readWorkspaceAutoFixForPr } from '../../review/claude-review/auto-settings.js';
 // At most AUTO_FIX_DAILY_CAP (shared) AUTO fixes per PR in any rolling AUTO_FIX_WINDOW_MS.
 export { AUTO_FIX_DAILY_CAP };
 export const AUTO_FIX_WINDOW_MS = 24 * 60 * 60 * 1000;
@@ -119,6 +123,8 @@ export async function maybeStartAutoFix(ctx, input, deps = defaultDeps, nowMs =
     try {
         if (!(await prAuthorIsAccount(ctx, accountId, prId)))
             return { status: 'not_own' };
+        if (!(await readWorkspaceAutoFixForPr(ctx, accountId, prId)))
+            return skip('off');
         const loaded = await deps.loadReviewSeed(ctx, { accountId, prId, reviewId });
         if (!loaded)
             return skip('not_started');

package/dist/coding/ai-fix/manager.js

@@ -4,6 +4,7 @@ import { getClaudeReviewById } from '../../review/claude-review/persist.js';
 import { pickReviewNonce } from '../../review/claude-review/prompts.js';
 import { buildReviewSeed } from './review-seed.js';
 import { getOwnedTicketItemsForPr } from '../../review/ticket-review/persist.js';
+import { getFixableCiItemsForPr } from '../../review/ci-review/persist.js';
 import { buildFixSystemPrompt, buildFixUserPrompt } from './prompts.js';
 import { insertQueuedFix, markFixCancelled, markFixFailed, markFixRunning, reconcileOrphanedFixes, saveFixSuccess, } from './persist.js';
 // In-memory job manager for AI Fix's agentic fixer (CORE, free, local-only — it left the plugin
@@ -102,7 +103,13 @@ export async function loadReviewSeed(ctx, input) {
                 return [];
             })
             : [];
-        return { review, seed: buildReviewSeed(review, { nonce: pickReviewNonce, ticketItems }) };
+        // The CI review's fixable items at the PR's CURRENT head (manual and auto fixes alike). A failed
+        // read costs the CI items only.
+        const ciItems = await getFixableCiItemsForPr(ctx, input.accountId, input.prId).catch((err) => {
+            ctx.log.warn({ err }, 'ai-fix: loading CI review items failed');
+            return [];
+        });
+        return { review, seed: buildReviewSeed(review, { nonce: pickReviewNonce, ticketItems, ciItems }) };
     }
     catch (err) {
         ctx.log.warn({ err }, 'ai-fix: loading the review seed failed');

package/dist/coding/ai-fix/review-seed.js

@@ -15,7 +15,9 @@ import { isThreadToFix } from '../../shared/index.js';
 //               addressed — unless this run re-raised it as a finding (then F covers it).
 //   T<n>        another reviewer's thread the review judged still needs a fix (shared
 //               `isThreadToFix`: valid / partly valid AND not / partly addressed).
-//   C<n>        a CI failure the review judged fixable in this PR (`ciFailures`, when present).
+//   C<n>        a CI failure the CI REVIEW (review/ci-review/) explained and judged fixable in this PR —
+//               from its latest succeeded run AT THE PR'S CURRENT HEAD (`ciItems`, the caller's
+//               `getFixableCiItemsForPr`), never from the code review's own (legacy) `ciFailures`.
 //   S<t>-AC<n>  an acceptance criterion of ticket t judged not met or partly met, and
 //   S<t>-M<n>   something ticket t asked for that is missing — BOTH from the TICKET review
 //               (review/ticket-review/), never from the PR review, and ONLY the items whose owner is
@@ -72,21 +74,21 @@ function mkItem(ref, kind, title, over = {}) {
         ...over,
     };
 }
-// ---- CI failures (the review's `ciFailures`, from the Claude Review CI diagnosis) ----
-// Only a DIAGNOSED failure the review judged fixable in this PR (`fixableInPr === true`). Anything
-// else — infrastructure, flaky, unclear, not checked — is not the fixer's. Older rows carry none.
-export function readFixableCiFailures(review) {
-    const raw = review.ciFailures;
-    if (!Array.isArray(raw))
-        return [];
-    return raw.filter((f) => f != null && f.status === 'diagnosed' && f.fixableInPr === true);
+// ---- CI failures (the CI review's items) ----
+// Only a DIAGNOSED failure judged fixable in this PR (`fixableInPr === true`). Anything else —
+// infrastructure, flaky, unclear, not checked — is not the fixer's. The code review's own legacy
+// `ciFailures` are NEVER read: the CI review replaced them, and they describe an older head.
+export function fixableCiItems(items) {
+    return items.filter((f) => f != null && f.status === 'diagnosed' && f.fixableInPr === true);
 }
 /**
  * Collect every fixable item of a review, refs assigned. Pure — the review is the stored run.
  */
 export function collectReviewItems(review, 
 // The ticket review's items THIS PR owns. A MANUAL fix only; absent/[] ⇒ none (an auto fix).
-ticketItems = []) {
+ticketItems = [], 
+// The CI review's items at the PR's current head (both manual and auto fixes); absent/[] ⇒ none.
+ciItems = []) {
     const out = [];
     // F — the review's findings. A RE-RAISE (`priorFindingId` set) left out only because the same
     // comment is already on this commit (follow-up.ts `isAlreadyOnThisCommit`) is NOT a reader's
@@ -161,13 +163,15 @@ ticketItems = []) {
         });
     });
     // C — CI failures fixable in this PR.
-    readFixableCiFailures(review).forEach((f, i) => {
+    fixableCiItems(ciItems).forEach((f, i) => {
         const ref = `C${i + 1}`;
-        const first = f.relatedFiles?.[0] ?? null;
+        const first = f.path ? { path: f.path, line: f.line } : (f.relatedFiles?.[0] ?? null);
         const body = [
             `Check: ${f.checkName}${f.step ? ` (step: ${f.step})` : ''}`,
             f.cause ? `Cause: ${f.cause}` : '',
             f.explanation ? `Detail: ${f.explanation}` : '',
+            f.path ? `Where: ${where(f.path, f.line)}` : '',
+            f.suggestion ? `Suggested change: ${f.suggestion}` : '',
             f.relatedFiles?.length
                 ? `Related files: ${f.relatedFiles.map((r) => where(r.path, r.line)).join(', ')}`
                 : '',
@@ -226,7 +230,7 @@ function fencedTexts(items, summary) {
  */
 export function buildReviewSeed(review, opts) {
     const budget = opts.budgetChars ?? REVIEW_SEED_CHAR_BUDGET;
-    const all = collectReviewItems(review, opts.ticketItems ?? []);
+    const all = collectReviewItems(review, opts.ticketItems ?? [], opts.ciItems ?? []);
     if (all.length === 0)
         return { items: [], sentRefs: [], text: '' };
     const summary = clip(review.userBody?.trim() || review.summary?.trim() || '', SUMMARY_MAX);

package/dist/config.js

@@ -539,6 +539,14 @@ export const config = {
     // AUTOMATIC ticket reviews (trigger 'auto' / 'cascade') per workspace per UTC day. Not shared with
     // the PR review's own auto cap. Manual runs never count. Default = shared TICKET_REVIEW_DAILY_CAP.
     ticketReviewDailyCap: intFromEnv('TICKET_REVIEW_DAILY_CAP', 20),
+    // ---- CI review (one run per (PR, head, failing-check set) — review/ci-review/) ----
+    // Its OWN spend cap and turn cap: a CI run reads log excerpts and the files they point at, nothing
+    // more. Env only — no route sets it.
+    ciReviewBudgetUsd: floatFromEnv('CI_REVIEW_BUDGET_USD', 2),
+    ciReviewMaxTurns: intFromEnv('CI_REVIEW_MAX_TURNS', 25),
+    // AUTOMATIC CI reviews per workspace per UTC day. Not shared with the PR or ticket review caps.
+    // Manual runs never count. Default = shared CI_REVIEW_DAILY_CAP.
+    ciReviewDailyCap: intFromEnv('CI_REVIEW_DAILY_CAP', 20),
     // ---- Diff-size cap ----
     // A very large inlined diff is the dominant cost on a big PR (it's the cached
     // prefix re-read every turn). The diff shown IN THE PROMPT is truncated at a

package/dist/db/ci-review-prune.js

@@ -0,0 +1,22 @@
+import { inArray } from 'drizzle-orm';
+import { schema } from './client.js';
+// THE CI-REVIEW HALF OF BOTH PR DELETE PATHS (deleteRepo in queries.ts, retention's
+// deletePrSubtree). A CI review belongs to exactly one PR, so deleting the PR deletes its runs and
+// their items. Children before parents, explicitly — the composite FKs cascade, but these paths run
+// parent-last by hand on both dialects. Runs inside the caller's transaction.
+export async function pruneCiReviewsForPrs(tx, prIds) {
+    if (prIds.length === 0)
+        return;
+    const runs = schema.ciReviews;
+    const rows = await tx
+        .select({ id: runs.id })
+        .from(runs)
+        .where(inArray(runs.prId, [...prIds]))
+        .execute();
+    const runIds = rows.map((r) => r.id);
+    if (runIds.length > 0) {
+        await tx.delete(schema.ciReviewItems).where(inArray(schema.ciReviewItems.ciReviewId, runIds)).execute();
+    }
+    await tx.delete(runs).where(inArray(runs.prId, [...prIds])).execute();
+}
+//# sourceMappingURL=ci-review-prune.js.map

package/dist/db/erase-account.js

@@ -128,6 +128,13 @@ export async function eraseAccountData(accountId) {
             .delete(schema.ticketReviews)
             .where(eq(schema.ticketReviews.accountId, accountId))
             .execute();
+        // CI reviews (migration 0082 / pg 0069), items first. The repo loop has normally taken them with
+        // their PRs; explicit, like every agentic table.
+        await tx
+            .delete(schema.ciReviewItems)
+            .where(eq(schema.ciReviewItems.accountId, accountId))
+            .execute();
+        await tx.delete(schema.ciReviews).where(eq(schema.ciReviews.accountId, accountId)).execute();
         // AI Fix runs (patches of the user's code + the prompts they were built from). Core since
         // migration 0074 / pg 0061 — the plugin's erasure hook used to own them.
         await tx.delete(schema.aiFixes).where(eq(schema.aiFixes.accountId, accountId)).execute();
@@ -211,6 +218,10 @@ export function accountScopedTables() {
             col: schema.ticketReviewItems.accountId,
             table: schema.ticketReviewItems,
         },
+        // CI reviews (migration 0082 / pg 0069) — the runs and their per-check items. Both carry their
+        // own accountId; both are erased explicitly above.
+        { name: 'ciReviews', col: schema.ciReviews.accountId, table: schema.ciReviews },
+        { name: 'ciReviewItems', col: schema.ciReviewItems.accountId, table: schema.ciReviewItems },
         { name: 'aiUsage', col: aiUsage.accountId, table: aiUsage },
         // Adopted from the plugin (migration 0074 / pg 0061) with AI Fix's fixer. No FKs, so nothing
         // cascades: the explicit delete above is the whole guarantee. (`reviewLearnings`, review

package/dist/db/migrations/0082_ci_reviews.sql

@@ -0,0 +1,73 @@
+-- CI REVIEW (local-only feature, like the rest of Claude Review): a separate Claude run that explains
+-- why checks FAILED on a PR's head, split out of the PR review's own run. Two tables:
+--   ci_reviews       one row per run (history kept). Keyed by (pr, head, sorted failing check names):
+--                    `failing_key` is what the run read live, `trigger_key` the synced set that
+--                    started it.
+--   ci_review_items  one row per failing check: Claude's cause, or the server's not-checked reason.
+-- Run ids arrive in request paths, so the item table's tenancy is STRUCTURAL: a composite FK against
+-- ci_reviews(id, account_id), whose parent key `ci_reviews_id_account` is created here; the run's PR
+-- against pull_requests(id, account_id). Both delete paths (deleteRepo, retention's deletePrSubtree)
+-- and eraseAccountData delete these rows explicitly. `claude_reviews.ci_failures` becomes LEGACY
+-- (read-only); nothing here touches it. The Postgres twin is migrations-pg/0069_ci_reviews.sql.
+CREATE TABLE IF NOT EXISTS `ci_reviews` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`head_sha` text NOT NULL,
+	`failing_key` text,
+	`trigger_key` text,
+	`failing_checks` text,
+	`trigger` text DEFAULT 'manual' NOT NULL,
+	`status` text NOT NULL,
+	`model` text NOT NULL,
+	`cost_usd` real,
+	`input_tokens` integer,
+	`output_tokens` integer,
+	`num_turns` integer,
+	`error` text,
+	`refused` text,
+	`ci_state` text,
+	`summary` text,
+	`started_at` integer,
+	`completed_at` integer,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `cir_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `cir_account_pr_created_idx` ON `ci_reviews` (`account_id`,`pr_id`,`created_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `cir_account_ws_created_idx` ON `ci_reviews` (`account_id`,`workspace_id`,`created_at`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ci_reviews_id_account` ON `ci_reviews` (`id`,`account_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `ci_review_items` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`ci_review_id` integer NOT NULL,
+	`account_id` integer NOT NULL,
+	`ref` text,
+	`check_name` text NOT NULL,
+	`job_id` integer,
+	`step` text,
+	`url` text,
+	`sent` integer DEFAULT false NOT NULL,
+	`carried` integer DEFAULT false NOT NULL,
+	`status` text NOT NULL,
+	`not_checked_reason` text,
+	`cause` text,
+	`explanation` text,
+	`category` text,
+	`fixable_in_pr` integer,
+	`path` text,
+	`line` integer,
+	`suggestion` text,
+	`related_files` text,
+	`assessed_at_head` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `ciri_review_account_fk` FOREIGN KEY (`ci_review_id`,`account_id`) REFERENCES `ci_reviews`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ciri_review_idx` ON `ci_review_items` (`ci_review_id`);

package/dist/db/migrations/0083_workspace_auto_fix.sql

@@ -0,0 +1,9 @@
+-- AUTO AI FIX, PER WORKSPACE — `workspaces.auto_fix_enabled`. After a succeeded AUTO Claude review
+-- of the reader's OWN pull request, Limn may prepare one review-seeded AI Fix (never pushed;
+-- coding/ai-fix/auto-fix.ts `maybeStartAutoFix`). This is that step's switch, edited in Settings
+-- beside auto review and written by `setWorkspaceAutoReview` (review/claude-review/auto-settings.ts).
+-- ⚠ DEFAULT TRUE (1) and NOT NULL: auto fix ran unconditionally before this column existed, so
+-- every existing workspace keeps today's behaviour until someone switches it off. It only matters
+-- while auto review is on, because it only runs after an auto review. The Postgres twin is
+-- migrations-pg/0070_workspace_auto_fix.sql.
+ALTER TABLE `workspaces` ADD `auto_fix_enabled` integer DEFAULT 1 NOT NULL;

package/dist/db/migrations/meta/_journal.json

@@ -575,6 +575,20 @@
       "when": 1790658000000,
       "tag": "0081_review_request_requester",
       "breakpoints": true
+    },
+    {
+      "idx": 82,
+      "version": "6",
+      "when": 1790661600000,
+      "tag": "0082_ci_reviews",
+      "breakpoints": true
+    },
+    {
+      "idx": 83,
+      "version": "6",
+      "when": 1790665200000,
+      "tag": "0083_workspace_auto_fix",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0069_ci_reviews.sql

@@ -0,0 +1,65 @@
+-- Postgres twin of migrations/0082_ci_reviews.sql, where the contract lives. CI review is
+-- local-only, so the tables exist in Postgres for schema parity. `job_id` is BIGINT: GitHub Actions
+-- job ids have passed 2^31.
+CREATE TABLE IF NOT EXISTS "ci_reviews" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"workspace_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"repo_id" integer NOT NULL,
+	"head_sha" text NOT NULL,
+	"failing_key" text,
+	"trigger_key" text,
+	"failing_checks" jsonb,
+	"trigger" text DEFAULT 'manual' NOT NULL,
+	"status" text NOT NULL,
+	"model" text NOT NULL,
+	"cost_usd" double precision,
+	"input_tokens" integer,
+	"output_tokens" integer,
+	"num_turns" integer,
+	"error" text,
+	"refused" text,
+	"ci_state" jsonb,
+	"summary" text,
+	"started_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ci_reviews_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "cir_pr_account_fk" FOREIGN KEY ("pr_id","account_id") REFERENCES "pull_requests"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "cir_account_pr_created_idx" ON "ci_reviews" USING btree ("account_id","pr_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "cir_account_ws_created_idx" ON "ci_reviews" USING btree ("account_id","workspace_id","created_at");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ci_reviews_id_account" ON "ci_reviews" USING btree ("id","account_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "ci_review_items" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"ci_review_id" integer NOT NULL,
+	"account_id" integer NOT NULL,
+	"ref" text,
+	"check_name" text NOT NULL,
+	"job_id" bigint,
+	"step" text,
+	"url" text,
+	"sent" boolean DEFAULT false NOT NULL,
+	"carried" boolean DEFAULT false NOT NULL,
+	"status" text NOT NULL,
+	"not_checked_reason" text,
+	"cause" text,
+	"explanation" text,
+	"category" text,
+	"fixable_in_pr" boolean,
+	"path" text,
+	"line" integer,
+	"suggestion" text,
+	"related_files" jsonb,
+	"assessed_at_head" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ci_review_items_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "ciri_review_account_fk" FOREIGN KEY ("ci_review_id","account_id") REFERENCES "ci_reviews"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ciri_review_idx" ON "ci_review_items" USING btree ("ci_review_id");

package/dist/db/migrations-pg/0070_workspace_auto_fix.sql

@@ -0,0 +1,3 @@
+-- Postgres twin of migrations/0083_workspace_auto_fix.sql — the per-workspace auto AI Fix switch.
+-- DEFAULT true so every existing workspace keeps today's behaviour. See the sqlite original.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_fix_enabled" boolean DEFAULT true NOT NULL;

package/dist/db/migrations-pg/meta/_journal.json

@@ -484,6 +484,20 @@
       "when": 1790658000000,
       "tag": "0068_review_request_requester",
       "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "7",
+      "when": 1790661600000,
+      "tag": "0069_ci_reviews",
+      "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "7",
+      "when": 1790665200000,
+      "tag": "0070_workspace_auto_fix",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/my-turn-dismissals.js

@@ -30,6 +30,12 @@
 // clock scores higher and wins `compareScored`'s age tie-break). Ties beyond that break on the
 // item's own id, so two reads of unchanged data keep the same card.
 //
+// ⚠ A CLAUDE REVIEW IS EXEMPT: it never competes for the PR's one card and is never removed by
+// it. A finished run, and above all an auto RE-review on a PR that already holds another job (a
+// reply in your thread), is new work of its own; folding it under that job hid every re-review on
+// a busy PR. Each run is its own item (its own id and `finishedAt` clock), so a newer run shows
+// even after an older one's card was dismissed.
+//
 // ⚠ IT IS A BOARD RULE, NOT A NOTIFICATION RULE. `getWorkspaceInsights` asks for it; the
 // account-wide `GET /api/my-turn` does not, because the browser-notification watcher diffs item
 // ids — a deduplicated list would flip the winner whenever the top job cleared and announce the
@@ -285,14 +291,6 @@ export function onePerPr(mt, order) {
             ref: `${i.threadId}`,
         }),
     };
-    const claude = {
-        of: (i) => ({
-            prId: i.prId,
-            reason: 'claude_review',
-            clockMs: clockMsOf(i.finishedAt),
-            ref: `${i.reviewId}`,
-        }),
-    };
     for (const i of mt.awaitingReview)
         offer(S.awaitingReview.of(i));
     for (const i of mt.mentions)
@@ -319,8 +317,6 @@ export function onePerPr(mt, order) {
         offer(threadReplies.of(i));
     for (const i of mt.ownThreads)
         offer(ownThreads.of(i));
-    for (const i of mt.claudeReviewsToAction)
-        offer(claude.of(i));
     return {
         awaitingReview: mt.awaitingReview.filter((i) => winnerIs(S.awaitingReview.of(i))),
         mentions: mt.mentions.filter((i) => winnerIs(S.mentions.of(i))),
@@ -335,7 +331,8 @@ export function onePerPr(mt, order) {
         threadsAwaiting: mt.threadsAwaiting.filter((i) => winnerIs(threadsAwaiting.of(i))),
         threadReplies: mt.threadReplies.filter((i) => winnerIs(threadReplies.of(i))),
         ownThreads: mt.ownThreads.filter((i) => winnerIs(ownThreads.of(i))),
-        claudeReviewsToAction: mt.claudeReviewsToAction.filter((i) => winnerIs(claude.of(i))),
+        // Exempt (header, rule 2): every Claude review keeps its own card.
+        claudeReviewsToAction: mt.claudeReviewsToAction,
         // Repo-grained: a branch is not a pull request, and never shares a key with one.
         redTrunks: mt.redTrunks,
     };

package/dist/db/queries.js

@@ -50,6 +50,7 @@ import { forwardKindOf, isConflicting, isRedCiStatus, RED_CI_STATUSES, } from '.
 import { authorAutomationFor, dependencyPrState, dependencyStateDetail, MERGE_QUEUE_CARD_DETAIL, securityFixDetail, unionAdvisoryIds, } from './dependency-cards.js';
 import { deriveSecurityAlerts } from './security-alerts.js';
 import { pruneTicketReviewsForPrs } from './ticket-review-prune.js';
+import { pruneCiReviewsForPrs } from './ci-review-prune.js';
 import { failingChecksFields, prFailingChecks, trunkFailingChecks, trunkFailingFor, } from './failing-checks.js';
 import { addressedCommitAuthors, mentionExcerpts, reviewRequesters, threadFirstComments, yourPrNewActors, } from './my-turn-card-facts.js';
 // Bind a JS Date into a raw-`sql` epoch comparison portably: Postgres columns are
@@ -8329,6 +8330,8 @@ export async function deleteRepo(id, accountId) {
             // Ticket reviews (migration 0080 / pg 0067): this repo's member rows, then any run left with
             // no members — a run whose other PRs live in another repo keeps its history.
             await pruneTicketReviewsForPrs(tx, prIds);
+            // CI reviews (migration 0082 / pg 0069): one PR each, so its runs and items go with it.
+            await pruneCiReviewsForPrs(tx, prIds);
             // The agentic table core ADOPTED from the plugin (migration 0074 / pg 0061): AI Fix runs
             // (~MiB patches). No FKs, so nothing would cascade; before this the plugin had no deleteRepo
             // hook at all and they were orphaned on a repo removal.
@@ -8561,19 +8564,21 @@ repoIds) {
 // based: every tick it asks this read which PRs qualify, so the DATABASE is the queue and a restart
 // loses nothing. A PR qualifies when it is, in ONE workspace:
 //   - OPEN and NOT A DRAFT (a draft qualifies once it is marked ready, if it was opened late enough);
-//   - OPENED at or after `openedSinceMs` - the moment the workspace switched the feature on. That
-//     floor is what makes a first sync, a 90-day backfill or adding a repo safe: none of them can
-//     make an OLD PR look new;
+//   - for a FIRST review: OPENED at or after `openedSinceMs` - the moment the workspace switched the
+//     feature on. That floor is what makes a first sync, a 90-day backfill or adding a repo safe:
+//     none of them can make an OLD PR look new. A RE-review also qualifies an older PR once it has a
+//     succeeded run created at or after the floor (someone chose to review it since the switch);
 //   - by a PERSON. The workspace-aware resolver `hiddenBotUserIds` - the SAME set that decides
 //     `InsightPrRef.authorIsBot` and the "hide bots" lens, a manual workspace judgement winning both
 //     ways - never the global set alone. An unmapped author (`author_id` NULL) is not a proven
 //     person and is skipped;
 //   - with NO `claude_reviews` row at all, whatever its head, status or trigger: ONE review per PR,
 //     ever, from auto. A manual run (or a failed auto one) settles it too.
-// `ci` carries, for every PR offered (first review or re-review), whether the synced CI of its head
-// is still RUNNING (`ci_status` pending / expected) and when that head was first observed
-// (`ci_status_events`, the earliest row for that head; null = no row). The sweeper holds a run
-// while CI runs, for at most AUTO_REVIEW_CI_WAIT_MS from that moment (review/claude-review/auto.ts).
+// Each re-review carries `lastRunAtMs` (the latest start or finish of any run of the PR) for the
+// sweeper's "start a new head on receipt unless a run was within 5 minutes" test, and
+// `inFlightMoved` lists PRs whose run is queued or running while their head moved past it (never
+// cancelled; the sweeper only starts that head's settle clock). There is NO CI reading: auto review
+// does not wait for CI (review/claude-review/auto.ts).
 // `autoToday` counts this workspace's AUTO runs created at or after `dayStartMs`, for the daily cap.
 // Returns null when the workspace is not this account's - never another workspace's answer (the
 // request-side resolver's "fall back to Default" would review the wrong repos here).
@@ -8588,7 +8593,7 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
         return null;
     const repoIds = await getWorkspaceRepoIds(workspaceId, accountId);
     if (repoIds.length === 0)
-        return { prIds: [], autoToday: 0, reReview: [], ci: [] };
+        return { prIds: [], autoToday: 0, reReview: [], inFlightMoved: [] };
     const autoRows = await db
         .select({ id: claudeReviews.id })
         .from(claudeReviews)
@@ -8597,21 +8602,20 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
         .execute();
     const autoToday = autoRows.length;
     if (opts.limit <= 0)
-        return { prIds: [], autoToday, reReview: [], ci: [] };
+        return { prIds: [], autoToday, reReview: [], inFlightMoved: [] };
     const open = await db
         .select({
         id: pullRequests.id,
         authorId: pullRequests.authorId,
         openedAt: pullRequests.openedAt,
         headSha: pullRequests.headSha,
-        ciStatus: pullRequests.ciStatus,
     })
         .from(pullRequests)
-        .where(and(eq(pullRequests.accountId, accountId), inArray(pullRequests.repoId, repoIds), eq(pullRequests.state, 'open'), eq(pullRequests.isDraft, false), gte(pullRequests.openedAt, new Date(opts.openedSinceMs))))
+        .where(and(eq(pullRequests.accountId, accountId), inArray(pullRequests.repoId, repoIds), eq(pullRequests.state, 'open'), eq(pullRequests.isDraft, false)))
         .orderBy(asc(pullRequests.openedAt), asc(pullRequests.id))
         .execute();
     if (open.length === 0)
-        return { prIds: [], autoToday, reReview: [], ci: [] };
+        return { prIds: [], autoToday, reReview: [], inFlightMoved: [] };
     const [bots, reviewed, reviewerBots] = await Promise.all([
         hiddenBotUserIds(accountId, workspaceId),
         db
@@ -8621,6 +8625,7 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
             headSha: claudeReviews.headSha,
             status: claudeReviews.status,
             createdAt: claudeReviews.createdAt,
+            finishedAt: claudeReviews.finishedAt,
             commentsThrough: claudeReviews.commentsThrough,
         })
             .from(claudeReviews)
@@ -8631,8 +8636,13 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
     const botSet = new Set(bots);
     const hasRun = new Set(reviewed.map((r) => r.prId));
     const human = open.filter((r) => r.authorId != null && !botSet.has(r.authorId));
+    // ⚠ THE ONBOARDING FLOOR GATES FIRST REVIEWS ONLY. A PR opened before the switch is never
+    // reviewed unasked (switching on must not bill a backlog), but once someone has run a review on
+    // it SINCE the switch, it is followed like any other: a manual run on an older PR used to leave
+    // its later pushes un-re-reviewed for ever, because the floor filtered the whole candidate read.
+    const afterFloor = (r) => r.openedAt != null && r.openedAt.getTime() >= opts.openedSinceMs;
     const prIds = human
-        .filter((r) => !hasRun.has(r.id))
+        .filter((r) => afterFloor(r) && !hasRun.has(r.id))
         .slice(0, opts.limit)
         .map((r) => r.id);
     // RE-REVIEW: a PR already reviewed (a SUCCEEDED run, manual or auto) whose synced head has
@@ -8646,20 +8656,31 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
         runsByPr.set(r.prId, list);
     }
     const reReview = [];
+    const inFlightMoved = [];
     // Same head, but maybe NEW REVIEW COMMENTS: the PR's runs at its head and how far they saw.
     const sameHead = [];
     for (const pr of human) {
         const runs = runsByPr.get(pr.id);
         if (!runs || !pr.headSha)
             continue;
+        const newest = runs.reduce((a, b) => (b.id > a.id ? b : a));
+        if ((newest.status === 'queued' || newest.status === 'running') &&
+            !runs.some((r) => r.headSha === pr.headSha)) {
+            inFlightMoved.push({ prId: pr.id, headSha: pr.headSha });
+            continue;
+        }
         if (!runs.some((r) => r.status === 'succeeded'))
             continue;
+        if (!afterFloor(pr) &&
+            !runs.some((r) => r.status === 'succeeded' && r.createdAt.getTime() >= opts.openedSinceMs))
+            continue;
         const latest = runs.reduce((a, b) => (b.id > a.id ? b : a));
         if (latest.status === 'queued' || latest.status === 'running')
             continue;
         const atHead = runs.filter((r) => r.headSha === pr.headSha);
         if (atHead.length === 0) {
-            reReview.push({ prId: pr.id, headSha: pr.headSha, commentsAtMs: null, reason: 'head' });
+            const lastRunAtMs = Math.max(...runs.map((r) => Math.max(r.createdAt.getTime(), r.finishedAt?.getTime() ?? 0)));
+            reReview.push({ prId: pr.id, headSha: pr.headSha, commentsAtMs: null, reason: 'head', lastRunAtMs });
             if (reReview.length >= opts.limit)
                 break;
             continue;
@@ -8683,41 +8704,18 @@ export async function getAutoReviewCandidates(accountId, workspaceId, opts) {
             const at = newest.get(p.prId);
             if (!at || at.getTime() <= p.coveredMs)
                 continue;
-            reReview.push({ prId: p.prId, headSha: p.headSha, commentsAtMs: at.getTime(), reason: 'comments' });
+            reReview.push({
+                prId: p.prId,
+                headSha: p.headSha,
+                commentsAtMs: at.getTime(),
+                reason: 'comments',
+                lastRunAtMs: null,
+            });
             if (reReview.length >= opts.limit)
                 break;
         }
     }
-    const ci = await autoReviewCiStates(accountId, open, new Set([...prIds, ...reReview.map((r) => r.prId)]));
-    return { prIds, autoToday, reReview, ci };
-}
-async function autoReviewCiStates(accountId, open, offered) {
-    const rows = open.filter((r) => offered.has(r.id));
-    if (rows.length === 0)
-        return [];
-    const events = (await db
-        .select({
-        prId: ciStatusEvents.prId,
-        headSha: ciStatusEvents.headSha,
-        observedAt: ciStatusEvents.observedAt,
-    })
-        .from(ciStatusEvents)
-        .where(and(eq(ciStatusEvents.accountId, accountId), inArray(ciStatusEvents.prId, rows.map((r) => r.id))))
-        .execute());
-    const firstSeen = new Map();
-    for (const e of events) {
-        const k = `${e.prId}|${e.headSha}`;
-        const t = e.observedAt.getTime();
-        const prev = firstSeen.get(k);
-        if (prev == null || t < prev)
-            firstSeen.set(k, t);
-    }
-    return rows.map((r) => ({
-        prId: r.id,
-        headSha: r.headSha,
-        running: r.ciStatus === 'pending' || r.ciStatus === 'expected',
-        headSeenAtMs: r.headSha ? (firstSeen.get(`${r.id}|${r.headSha}`) ?? null) : null,
-    }));
+    return { prIds, autoToday, reReview, inFlightMoved };
 }
 // WHO MAY RE-TRIGGER AN AUTO REVIEW BY COMMENTING (the comment half of the re-review key). A
 // PERSON — not in the workspace's bot union `hiddenBotUserIds`, where a manual "this is a human"