limn-review 0.1.141 → 0.1.142

package/dist/db/erase-account.js

@@ -168,6 +168,8 @@ export async function eraseAccountData(accountId) {
         // hold third-party analysis of the account's code. No FK on the snapshots, so this is the whole
         // guarantee; workspace_sonar cascades from workspaces too, and is explicit anyway.
         await tx.delete(schema.sonarSnapshots).where(eq(schema.sonarSnapshots.accountId, accountId)).execute();
+        // The team-claim ledger (migration 0138): GitHub logins and heads. No FK, so this is the whole guarantee.
+        await tx.delete(schema.teamClaimLines).where(eq(schema.teamClaimLines.accountId, accountId)).execute();
         await tx.delete(schema.workspaceSonar).where(eq(schema.workspaceSonar.accountId, accountId)).execute();
         // Sequence diagrams (migration 0115 / pg 0102): no FKs, so this is the whole guarantee (story rows
         // carry no pr_id and are reached ONLY here).
@@ -330,6 +332,8 @@ export function accountScopedTables() {
         { name: 'workspaceTrackers', col: schema.workspaceTrackers.accountId, table: schema.workspaceTrackers },
         // SonarCloud (migration 0114 / pg 0101), erased explicitly above; `workspaceSonar` holds a credential.
         { name: 'sonarSnapshots', col: schema.sonarSnapshots.accountId, table: schema.sonarSnapshots },
+        // The team-claim ledger (migration 0138), erased explicitly above.
+        { name: 'teamClaimLines', col: schema.teamClaimLines.accountId, table: schema.teamClaimLines },
         { name: 'workspaceSonar', col: schema.workspaceSonar.accountId, table: schema.workspaceSonar },
         // Sequence diagrams (migration 0115 / pg 0102), erased explicitly above.
         { name: 'sequenceDiagrams', col: schema.sequenceDiagrams.accountId, table: schema.sequenceDiagrams },

package/dist/db/migrations/0138_team_claim_lines.sql

@@ -0,0 +1,55 @@
+-- THE TEAM-CLAIM LEDGER (docs/CLAUDE-REVIEW.md § Team claims → Releasing stale lines). One row per
+-- GitHub status line (`limn/review-claude` | `limn/review-codex`) Limn holds or released on a PR
+-- head, written BEFORE the pending line is posted, so a restart, a dropped run or a failed final write
+-- never leaves this machine's line pending: the reconciler releases every open row whose run is not
+-- running. `whose = 'teammate'` records a teammate's expired line released once.
+CREATE TABLE `team_claim_lines` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`repo_id` integer,
+	`owner` text,
+	`name` text,
+	`head_sha` text NOT NULL,
+	`provider` text NOT NULL,
+	`review_id` integer,
+	`whose` text DEFAULT 'mine' NOT NULL,
+	`state` text NOT NULL,
+	`login` text,
+	`final_description` text,
+	`final_target_url` text,
+	`release_attempts` integer DEFAULT 0 NOT NULL,
+	`last_error` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `team_claim_lines_state` ON `team_claim_lines` (`state`);
+--> statement-breakpoint
+CREATE INDEX `team_claim_lines_account_pr_head` ON `team_claim_lines` (`account_id`,`pr_id`,`head_sha`);
+--> statement-breakpoint
+-- Lines older Limn versions left PENDING (a failed run's "didn't finish · free to claim", or a run that
+-- died mid-way): the newest auto run's record per (PR, head, context), when it is still pending, from
+-- the last 14 days. The reconciler replaces each with the success release line at boot — only where the
+-- head's newest line is still this account's pending one (it reads GitHub first).
+INSERT INTO `team_claim_lines` (`account_id`, `pr_id`, `repo_id`, `owner`, `name`, `head_sha`, `provider`, `review_id`, `whose`, `state`)
+SELECT cr.`account_id`, cr.`pr_id`, pr.`repo_id`, r.`owner`, r.`name`, cr.`head_sha`,
+	CASE json_extract(cr.`team_claim`, '$.context') WHEN 'limn/review-codex' THEN 'codex' ELSE 'claude' END,
+	cr.`id`, 'mine', 'pending'
+FROM `claude_reviews` cr
+JOIN `pull_requests` pr ON pr.`id` = cr.`pr_id`
+JOIN `repos` r ON r.`id` = pr.`repo_id`
+WHERE cr.`team_claim` IS NOT NULL
+	AND json_valid(cr.`team_claim`)
+	AND json_extract(cr.`team_claim`, '$.state') = 'marked'
+	AND json_extract(cr.`team_claim`, '$.lastLine') IN ('reviewing', 'unfinished')
+	AND cr.`created_at` >= unixepoch() - 14 * 86400
+	AND cr.`id` = (
+		SELECT MAX(c2.`id`) FROM `claude_reviews` c2
+		WHERE c2.`account_id` = cr.`account_id`
+			AND c2.`pr_id` = cr.`pr_id`
+			AND c2.`head_sha` = cr.`head_sha`
+			AND c2.`team_claim` IS NOT NULL
+			AND json_valid(c2.`team_claim`)
+			AND json_extract(c2.`team_claim`, '$.context') = json_extract(cr.`team_claim`, '$.context')
+	);

package/dist/db/migrations/meta/_journal.json

@@ -967,6 +967,13 @@
       "when": 1792137624016,
       "tag": "0137_review_pair_consolidation",
       "breakpoints": true
+    },
+    {
+      "idx": 138,
+      "version": "6",
+      "when": 1792137625016,
+      "tag": "0138_team_claim_lines",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/queries.js

@@ -18,6 +18,7 @@ const REASON_PRIORITY = [
 ];
 import { db, schema } from './client.js';
 import { dropRepoRelations } from './related-repos.js';
+import { deleteSettledClaimLinesForPrs } from './team-claim-lines-delete.js';
 import { runTransaction } from './client.js';
 import { enrichMyTurn } from '../feed/my-turn.js';
 import { resolvePrTickets } from '../pr/detail-enricher.js';
@@ -7873,6 +7874,9 @@ export async function deleteRepo(id, accountId) {
             await tx.delete(schema.trackerTickets).where(inArray(schema.trackerTickets.prId, prIds)).execute();
             // SonarCloud snapshots (migration 0114 / pg 0101). No FKs, so nothing would cascade.
             await tx.delete(schema.sonarSnapshots).where(inArray(schema.sonarSnapshots.prId, prIds)).execute();
+            // The team-claim ledger (migration 0138). No FKs, so nothing would cascade. This machine's OPEN
+            // rows stay: their lines still need releasing on GitHub (db/team-claim-lines-delete.ts).
+            await deleteSettledClaimLinesForPrs(tx, prIds);
             // Sequence diagrams of these PRs, and the story diagrams naming any of them (migration 0115 /
             // pg 0102). No FKs, so nothing would cascade. Before the PRs go: it reads their accounts.
             await pruneSequenceDiagramsForPrs(tx, prIds);

package/dist/db/retention.js

@@ -4,6 +4,7 @@ import { config } from '../config.js';
 import { pruneTicketReviewsForPrs } from './ticket-review-prune.js';
 import { pruneCiReviewsForPrs } from './ci-review-prune.js';
 import { pruneSequenceDiagramsForPrs } from './sequence-diagram-prune.js';
+import { deleteSettledClaimLinesForPrs } from './team-claim-lines-delete.js';
 // Time-based retention sweep. Per-account server data (events, PRs + their whole subtree)
 // accumulates forever otherwise; this prunes anything past the retention window so the DB
 // stays bounded (the pre-launch, tight-budget scalability lever). Runs periodically from
@@ -100,6 +101,9 @@ async function deletePrSubtree(tx, prIds) {
     await tx.delete(schema.trackerTickets).where(inArray(schema.trackerTickets.prId, prIds)).execute();
     // SonarCloud snapshots (migration 0114 / pg 0101). No FKs — explicit, pr-keyed.
     await tx.delete(schema.sonarSnapshots).where(inArray(schema.sonarSnapshots.prId, prIds)).execute();
+    // The team-claim ledger (migration 0138). No FKs — explicit, pr-keyed. This machine's OPEN rows
+    // stay: their lines still need releasing on GitHub (db/team-claim-lines-delete.ts).
+    await deleteSettledClaimLinesForPrs(tx, prIds);
     // Sequence diagrams of these PRs, and the story diagrams naming any of them (migration 0115 / pg
     // 0102). No FKs. Before the PRs go: it reads their accounts.
     await pruneSequenceDiagramsForPrs(tx, prIds);

package/dist/db/schema.sqlite.js

@@ -3390,4 +3390,51 @@ export const storyDocsAlignments = sqliteTable('story_docs_alignments', {
         foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete('cascade'),
 }));
+// team_claim_lines — THE TEAM-CLAIM LEDGER (migration 0138; docs/CLAUDE-REVIEW.md § Team claims →
+// Releasing stale lines). ONE row per GitHub status line Limn holds or has released on a PR head, so a
+// line this machine posted is never left pending by a restart, a dropped run or a failed final write:
+//   whose 'mine'     a claim this machine made. Written as 'claiming' BEFORE the pending line is posted,
+//                    'pending' once it is up, 'finished' when the success line ("reviewed") is up,
+//                    'released' when the release line ("didn't finish · free to claim"), a Clear, a
+//                    newer claim at the same head, or GitHub's refusal ended it.
+//   whose 'teammate' a teammate's expired line this machine released ("Released: bob's claim
+//                    expired"), recorded so it is posted ONCE. Always 'released'.
+// The reconciler (review/claude-review/team-claim-release.ts) releases every 'claiming' / 'pending'
+// row whose run is not queued or running in this process. No FK on pr_id (the sonar_snapshots
+// precedent): BOTH delete paths (deleteRepo, retention's deletePrSubtree) delete its rows EXCEPT this
+// machine's OPEN ones (a pending line on GitHub still needs its release; the row carries owner/name);
+// the erasure deletes everything.
+export const teamClaimLines = sqliteTable('team_claim_lines', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    accountId: integer('account_id').notNull(),
+    prId: integer('pr_id').notNull(),
+    repoId: integer('repo_id'),
+    // The repo's owner/name when the row was written: an open line is still released after its PR or
+    // repo left Limn (the delete paths keep OPEN 'mine' rows for exactly that).
+    owner: text('owner'),
+    name: text('name'),
+    headSha: text('head_sha').notNull(),
+    // 'claude' | 'codex' — the status context (`limn/review-<provider>`).
+    provider: text('provider').notNull(),
+    // The run the claim was for (NULL until its row is written, and on a teammate's line).
+    reviewId: integer('review_id'),
+    whose: text('whose', { enum: ['mine', 'teammate'] }).notNull().default('mine'),
+    state: text('state', { enum: ['claiming', 'pending', 'finished', 'released'] }).notNull(),
+    // The GitHub login the line names (NULL on a row backfilled from before the ledger: the
+    // account's login is used).
+    login: text('login'),
+    // A success line that could not be written when the run finished: the reconciler posts IT
+    // instead of the release line.
+    finalDescription: text('final_description'),
+    finalTargetUrl: text('final_target_url'),
+    releaseAttempts: integer('release_attempts').notNull().default(0),
+    lastError: text('last_error'),
+    createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql `(unixepoch())`),
+    updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql `(unixepoch())`),
+}, (t) => ({
+    // The reconciler's read (open rows).
+    stateIdx: index('team_claim_lines_state').on(t.state),
+    // One head's rows (supersede, Clear, the tab's "Clear" offer).
+    prHeadIdx: index('team_claim_lines_account_pr_head').on(t.accountId, t.prId, t.headSha),
+}));
 //# sourceMappingURL=schema.sqlite.js.map

package/dist/db/team-claim-lines-delete.js

@@ -0,0 +1,18 @@
+// The team-claim ledger's DELETE-PATH rule (migration 0138; docs/CLAUDE-REVIEW.md § Team claims →
+// Releasing stale lines). When PRs leave Limn (deleteRepo, retention's deletePrSubtree), their ledger
+// rows go — EXCEPT this machine's OPEN ones ('mine', 'claiming' / 'pending'): each stands for a line
+// that may still be pending on GitHub, and the reconciler releases it from the row's own owner/name
+// (it closes a row that has neither). The account erasure deletes every row regardless.
+import { and, eq, inArray, not } from 'drizzle-orm';
+import { schema } from './client.js';
+/* eslint-disable @typescript-eslint/no-explicit-any */
+export async function deleteSettledClaimLinesForPrs(tx, prIds) {
+    if (prIds.length === 0)
+        return;
+    const tl = schema.teamClaimLines;
+    await tx
+        .delete(tl)
+        .where(and(inArray(tl.prId, prIds), not(and(eq(tl.whose, 'mine'), inArray(tl.state, ['claiming', 'pending'])))))
+        .execute();
+}
+//# sourceMappingURL=team-claim-lines-delete.js.map

package/dist/review/agentic.js

@@ -101,6 +101,11 @@ export async function startAgenticBackground(app) {
     catch (err) {
         app.log.warn({ err }, 'claude review: startup reconcile failed');
     }
+    // TEAM CLAIMS: a run this process lost (a restart mid-review) left its limn/review-* line pending on
+    // GitHub; release every such line now, in the BACKGROUND (GitHub calls; never fails or delays the boot).
+    void import('./claude-review/team-claim-release.js')
+        .then((m) => m.releaseStaleTeamClaims(ctx))
+        .catch((err) => app.log.warn({ err }, 'team claim release at boot failed'));
     try {
         await reconcileThreadChecksOnStartup(ctx);
     }

package/dist/review/claude-review/auto.js

@@ -572,6 +572,11 @@ export function registerAutoReview(ctx) {
         return;
     ctx.registerScheduledJob(AUTO_REVIEW_CRON, async () => {
         await runAutoReviewSweep(ctx);
+        // TEAM CLAIMS: release every limn/review-* line of ours no run holds any more, and teammates'
+        // expired ones (team-claim-release.ts). Never throws; never blocks the sweep.
+        await import('./team-claim-release.js')
+            .then((m) => m.releaseStaleTeamClaims(ctx))
+            .catch((err) => ctx.log.warn(`team claim release: ${err instanceof Error ? err.message : String(err)}`));
     }, 'claude-auto-review');
 }
 //# sourceMappingURL=auto.js.map

package/dist/review/claude-review/chat.js

@@ -1,5 +1,5 @@
 import { and, asc, desc, eq, inArray, isNull } from 'drizzle-orm';
-import { CLAUDE_REVIEW_CHAT_EXPLAIN_DEFAULT_QUESTION, CLAUDE_REVIEW_CHAT_MAX_QUESTION_CHARS, CLAUDE_REVIEW_MODELS, aiRunProvider, DEFAULT_CLAUDE_REVIEW_MODEL, } from '../../shared/index.js';
+import { CLAUDE_REVIEW_CHAT_EXPLAIN_DEFAULT_QUESTION, CLAUDE_REVIEW_CHAT_MAX_QUESTION_CHARS, CLAUDE_REVIEW_MODELS, aiRunProvider, findingSourceLabel, pairChatProvider, DEFAULT_CLAUDE_REVIEW_MODEL, } from '../../shared/index.js';
 import { requestModelOf } from '../../ai/provider.js';
 import { AGENTIC_AI_ENABLED, chatMayApplyAuthEnv } from './manager.js';
 import { getReviewPrContext, getReviewView } from './persist.js';
@@ -7,6 +7,7 @@ import { pickReviewNonce } from './prompts.js';
 import { EXPLAIN_INSTRUCTION, EXPLAIN_SYSTEM_ADDENDUM, explainSectionLines, explanationsMarkdown, findingPinLabel, findingPinText, parsePinRefs, questionWithPins, storyPinLabel, storyPinText, validateExplanations, } from './chat-explain.js';
 import { providerName } from '../../ai/prompt-tools.js';
 import { followUpProvider, preflightFor } from '../../ai/run-choice.js';
+import { activeProviderId } from '../../ai/provider-setting.js';
 // CLAUDE REVIEW CHAT (CORE, free, local-only like the rest of Claude Review). Questions about ONE
 // succeeded review: a general thread (findingId null) and one thread per finding. The answer comes
 // from `ctx.review.chat` — a core agent run that MIRRORS the review's mode (worktree → Read/Glob/
@@ -77,16 +78,49 @@ const messageCols = (msg) => ({
     provider: msg.provider,
 });
 /** One thread's stored messages, oldest first. Callers have already proved the review is theirs. */
-export async function listChatMessages(ctx, accountId, reviewId, findingId) {
+export async function listChatMessages(ctx, accountId, 
+// One run's id, or a pair's thread ids (`chatThreadIds`).
+reviewId, findingId) {
     const { msg } = tables(ctx);
+    const ids = typeof reviewId === 'number' ? [reviewId] : [...reviewId];
     const rows = (await ctx.db
         .select(messageCols(msg))
         .from(msg)
-        .where(and(eq(msg.accountId, accountId), eq(msg.reviewId, reviewId), findingId == null ? isNull(msg.findingId) : eq(msg.findingId, findingId)))
+        .where(and(eq(msg.accountId, accountId), ids.length === 1 ? eq(msg.reviewId, ids[0]) : inArray(msg.reviewId, ids), findingId == null ? isNull(msg.findingId) : eq(msg.findingId, findingId)))
         .orderBy(asc(msg.id))
         .execute());
     return rows.map(toWire);
 }
+// ---- a pair's ONE chat ---------------------------------------------------------
+/**
+ * Where a review's chat is STORED: a Claude + Codex pair's chat (general and per finding) is keyed to
+ * the pair's FIRST row id (`pair.pairId`, which always exists), whichever half is latest; an ordinary
+ * run's is its own id.
+ */
+export function chatStoreId(review) {
+    return review.pair?.pairId ?? review.id;
+}
+/**
+ * Every id a review's chat may be READ from: a pair's first row id, then each half's (a pair's chat was
+ * stored under its latest half's id before 2026-10-28, so both are read; nothing is moved).
+ */
+export function chatThreadIds(review) {
+    const ids = new Set([chatStoreId(review), review.id]);
+    for (const h of review.pair?.halves ?? [])
+        ids.add(h.reviewId);
+    return [...ids];
+}
+/**
+ * WHO ANSWERS: an ordinary run's own provider; a pair's, the DEFAULT provider when its half succeeded,
+ * else the half that did (`pairChatProvider`). Either way only when it can answer now; else the
+ * default (`followUpProvider`).
+ */
+export function chatPreferredProvider(review, defaultProvider = activeProviderId) {
+    if (review.pair == null)
+        return aiRunProvider(review.provider, review.model);
+    const ok = (review.pair.halves ?? []).filter((h) => h.status === 'succeeded').map((h) => h.provider);
+    return pairChatProvider(defaultProvider(), ok);
+}
 /** Pair stored messages into question/answer turns (an unanswered question is skipped). */
 export function pairTurns(messages) {
     const out = [];
@@ -160,6 +194,10 @@ const findingRef = (findings, id) => `F${findings.findIndex((f) => f.id === id)
 function findingText(f, ref) {
     const where = f.line != null ? `${f.path}:${f.line}` : f.path;
     const parts = [`${ref} [${f.severity}] ${where}`, `Title: ${f.title}`, clip(f.body, FINDING_BODY_CHARS)];
+    // A Claude + Codex pair's finding names who raised it (absent on an ordinary run: its prompt is
+    // unchanged).
+    if (f.source != null)
+        parts.splice(2, 0, `Raised by: ${findingSourceLabel(f.source)}`);
     if (f.editedBody && f.editedBody.trim() && f.editedBody !== f.body) {
         parts.push(`The developer reworded it as:\n${clip(f.editedBody, FINDING_BODY_CHARS)}`);
     }
@@ -211,6 +249,10 @@ export function buildChatPrompt(input) {
     fence(lines, 'PULL REQUEST', nonce, `Title: ${pr.title}\n\n${pr.body && pr.body.trim() ? clip(pr.body, PR_BODY_CHARS) : '(no description)'}`);
     lines.push('');
     lines.push('## Your review');
+    // A Claude + Codex pair is asked about as its ONE consolidated review.
+    if (review.pair != null) {
+        lines.push('This is one review by Claude and Codex together: the summary and verdict are the merged ones, and each finding says who raised it.');
+    }
     fence(lines, 'REVIEW', nonce, `Verdict: ${review.verdict ?? 'COMMENT'}\n\n${clip(review.summary ?? '(no summary)', SUMMARY_CHARS)}`);
     lines.push('');
     lines.push(`## Findings (${review.findings.length})`);
@@ -421,15 +463,18 @@ export async function answerReviewChat(ctx, accountId, reviewId, body) {
         // the head has not moved. Once it has, the findings' own excerpts (and, in worktree mode, the
         // files at the reviewed commit) are what the answer reads.
         const prepared = headMoved ? null : await preparedFor(ctx, reviewId, pr);
-        const stored = await listChatMessages(ctx, accountId, reviewId, findingId);
+        // A pair's ONE chat: stored under its first row id, read from every id it may sit under.
+        const storeId = chatStoreId(review);
+        const stored = await listChatMessages(ctx, accountId, chatThreadIds(review), findingId);
         const fit = fitTranscript(pairTurns(stored));
         const base = { review, pr, mode, headMoved, prepared, findingId, turns: fit.turns, question, pins };
         const nonce = pickReviewNonce(chatUntrustedTexts(base));
         const prompt = buildChatPrompt({ ...base, nonce });
         const model = chatModelFor(review.model);
         // THE CHAT RUNS ON ITS REVIEW'S PROVIDER when that one is signed in and can answer; else on the
-        // default provider (Settings → AI). A Codex review is asked about on Codex, a Claude one on Claude.
-        const provider = followUpProvider(aiRunProvider(review.provider, review.model), 'review_chat', preflightFor(ctx));
+        // default provider (Settings → AI). A Codex review is asked about on Codex, a Claude one on Claude;
+        // a Claude + Codex pair on the default provider when its half succeeded, else on the half that did.
+        const provider = followUpProvider(chatPreferredProvider(review), 'review_chat', preflightFor(ctx));
         const abortController = new AbortController();
         const timer = setTimeout(() => abortController.abort(), CHAT_TIMEOUT_MS);
         let result;
@@ -495,7 +540,7 @@ export async function answerReviewChat(ctx, accountId, reviewId, body) {
             .values([
             {
                 accountId,
-                reviewId,
+                reviewId: storeId,
                 findingId,
                 role: 'user',
                 content: question,
@@ -504,7 +549,7 @@ export async function answerReviewChat(ctx, accountId, reviewId, body) {
             },
             {
                 accountId,
-                reviewId,
+                reviewId: storeId,
                 findingId,
                 role: 'assistant',
                 content: clip(answerText, STORED_ANSWER_CHARS),
@@ -548,6 +593,7 @@ export async function listChatHistoryForPr(ctx, accountId, prId) {
         reviewMode: cr.reviewMode,
         finishedAt: cr.finishedAt,
         createdAt: cr.createdAt,
+        pairId: cr.pairId,
     })
         .from(cr)
         .where(and(eq(cr.accountId, accountId), eq(cr.prId, prId)))
@@ -555,6 +601,19 @@ export async function listChatHistoryForPr(ctx, accountId, prId) {
         .execute());
     if (runs.length === 0)
         return { prId, runs: [] };
+    // A Claude + Codex pair is ONE review with ONE chat: every half's messages are listed under the
+    // pair's view id (its LATEST half, the id the tab shows), so the current pair's chat never reappears
+    // as an "earlier review".
+    const viewIdOf = new Map();
+    const latestOfPair = new Map();
+    for (const r of runs) {
+        const key = r.pairId ?? null;
+        if (key == null)
+            continue;
+        latestOfPair.set(key, Math.max(latestOfPair.get(key) ?? 0, r.id));
+    }
+    for (const r of runs)
+        viewIdOf.set(r.id, r.pairId != null ? (latestOfPair.get(r.pairId) ?? r.id) : r.id);
     const rows = (await ctx.db
         .select({ ...messageCols(msg), reviewId: msg.reviewId })
         .from(msg)
@@ -563,9 +622,10 @@ export async function listChatHistoryForPr(ctx, accountId, prId) {
         .execute());
     const byRun = new Map();
     for (const r of rows) {
-        const list = byRun.get(r.reviewId) ?? [];
+        const key = viewIdOf.get(r.reviewId) ?? r.reviewId;
+        const list = byRun.get(key) ?? [];
         list.push(toWire(r));
-        byRun.set(r.reviewId, list);
+        byRun.set(key, list);
     }
     return {
         prId,
@@ -623,7 +683,7 @@ export function registerClaudeReviewChatRoutes(app, ctx) {
         return {
             reviewId,
             findingId,
-            messages: await listChatMessages(ctx, accountId, reviewId, findingId),
+            messages: await listChatMessages(ctx, accountId, chatThreadIds(review), findingId),
             headMoved: pr?.headSha != null && pr.headSha !== review.headSha,
             answering: inFlight.get(accountId) === reviewId,
         };

package/dist/review/claude-review/manager.js

@@ -227,6 +227,23 @@ opts = {}) {
 export function reviewHeldForPr(prId) {
     return claimed.has(prId) || startingAuto.has(prId) || autoPending.some((a) => a.prId === prId);
 }
+/**
+ * TEAM CLAIMS — may a GitHub line for `provider` at `headSha` on this PR still be held by a run of
+ * THIS process? (team-claim-release.ts asks before releasing a ledger row.) True while an auto item is
+ * mid-start (its provider is not known yet), while a pair is between its halves at that head, and while
+ * a run at that head holds that provider's line — its own, or (a pair's second half) its first half's.
+ */
+export function reviewClaimBusy(accountId, prId, provider, headSha) {
+    if (startingAuto.get(prId)?.accountId === accountId)
+        return true;
+    const between = startingPair.get(prId);
+    if (between && between.accountId === accountId && between.headSha === headSha)
+        return true;
+    const run = runningItems.get(prId);
+    if (!run || run.accountId !== accountId || run.headSha !== headSha)
+        return false;
+    return run.provider === provider || run.pair?.first?.provider === provider;
+}
 /**
  * Put ONE PR on the auto lane (the sweeper's only door into the queue). Synchronous and
  * storage-free: the row is written when a slot opens (`startAutoItem`). Same model and budget as a
@@ -353,7 +370,7 @@ async function startAutoItem(a) {
         if (pair)
             pair.pairId = reviewId;
         if (teamClaim)
-            await saveTeamClaimRecord(ctx, reviewId, teamClaim.record).catch(() => { });
+            await saveTeamClaimRecord(ctx, reviewId, teamClaim.record, teamClaim).catch(() => { });
         reviewIdByPr.set(prId, reviewId);
         startingAuto.delete(prId);
         launched = true;
@@ -642,7 +659,7 @@ async function startPairSecond(first) {
         const firstFindings = firstReview?.findings ?? [];
         const reviewId = await insertQueuedReview(ctx, prId, first.headSha, first.model, accountId, [], first.trigger, provider, first.fresh === true, { role: 'second', pairId: pair.pairId });
         if (teamClaim)
-            await saveTeamClaimRecord(ctx, reviewId, teamClaim.record).catch(() => { });
+            await saveTeamClaimRecord(ctx, reviewId, teamClaim.record, teamClaim).catch(() => { });
         startingPair.delete(prId);
         launched = true;
         // The second half's row is running now; the end (consolidateAtPairEnd) marks the merge itself.

package/dist/review/claude-review/team-claim-ledger.js

@@ -0,0 +1,135 @@
+import { and, asc, eq, inArray, lt } from 'drizzle-orm';
+export const OPEN_CLAIM_STATES = ['claiming', 'pending'];
+/** After this many failed releases a row is left (logged) — and out of the reconciler's read; the tab's
+ *  Clear still finds it (`openClaimLinesAtHead`). */
+export const RELEASE_MAX_ATTEMPTS = 5;
+const t = (ctx) => ctx.schema.teamClaimLines;
+const now = () => new Date();
+const clipErr = (s) => (s == null ? null : s.slice(0, 300));
+/**
+ * The INTENT, written before the pending line is posted ('claiming'). Our new line replaces any older
+ * line of ours at the same (PR, head, provider), so those rows are closed ('released', "superseded")
+ * in the same transaction. Returns the new row's id.
+ */
+export async function recordClaimIntent(ctx, row) {
+    const tl = t(ctx);
+    const prs = ctx.schema.pullRequests;
+    const repo = (await ctx.db
+        .select({ repoId: prs.repoId })
+        .from(prs)
+        .where(and(eq(prs.id, row.prId), eq(prs.accountId, row.accountId)))
+        .limit(1)
+        .execute());
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const write = async (tx) => {
+        await tx
+            .update(tl)
+            .set({ state: 'released', lastError: 'superseded', updatedAt: now() })
+            .where(and(eq(tl.accountId, row.accountId), eq(tl.prId, row.prId), eq(tl.headSha, row.headSha), eq(tl.provider, row.provider), eq(tl.whose, 'mine'), inArray(tl.state, [...OPEN_CLAIM_STATES])))
+            .execute();
+        const [ins] = (await tx
+            .insert(tl)
+            .values({
+            accountId: row.accountId,
+            prId: row.prId,
+            repoId: repo[0]?.repoId ?? null,
+            owner: row.owner ?? null,
+            name: row.name ?? null,
+            headSha: row.headSha,
+            provider: row.provider,
+            whose: 'mine',
+            state: 'claiming',
+            login: row.login,
+            createdAt: now(),
+            updatedAt: now(),
+        })
+            .returning({ id: tl.id })
+            .execute());
+        return ins.id;
+    };
+    // Two DB statements, no network: close the older rows, then write the intent.
+    return write(ctx.db);
+}
+/** Move a row on (and stamp it). `patch` may set the run, the error, the counters. */
+export async function setClaimLine(ctx, id, patch) {
+    const tl = t(ctx);
+    const set = { updatedAt: now() };
+    for (const [k, v] of Object.entries(patch))
+        if (v !== undefined)
+            set[k] = k === 'lastError' ? clipErr(v) : v;
+    await ctx.db.update(tl).set(set).where(eq(tl.id, id)).execute();
+}
+/**
+ * The open rows (ours: 'claiming' / 'pending') the reconciler may still try, oldest first, capped.
+ * ⚠ A row that used up its RELEASE_MAX_ATTEMPTS is left OUT here, so given-up rows can never fill the
+ * window and starve newer ones.
+ */
+export async function openClaimLines(ctx, limit = 50) {
+    const tl = t(ctx);
+    return (await ctx.db
+        .select()
+        .from(tl)
+        .where(and(eq(tl.whose, 'mine'), inArray(tl.state, [...OPEN_CLAIM_STATES]), lt(tl.releaseAttempts, RELEASE_MAX_ATTEMPTS)))
+        .orderBy(asc(tl.id))
+        .limit(limit)
+        .execute());
+}
+/** This machine's open rows at one PR head (the tab's "Clear" offer). */
+export async function openClaimLinesAtHead(ctx, accountId, prId, headSha) {
+    const tl = t(ctx);
+    return (await ctx.db
+        .select()
+        .from(tl)
+        .where(and(eq(tl.accountId, accountId), eq(tl.prId, prId), eq(tl.headSha, headSha), eq(tl.whose, 'mine'), inArray(tl.state, [...OPEN_CLAIM_STATES])))
+        .orderBy(asc(tl.id))
+        .execute());
+}
+/** A Clear (or anything else that settled the head for one provider): close every open row there. */
+export async function releaseClaimLinesAtHead(ctx, accountId, prId, headSha, provider, why) {
+    const tl = t(ctx);
+    const rows = (await ctx.db
+        .update(tl)
+        .set({ state: 'released', lastError: clipErr(why), updatedAt: now() })
+        .where(and(eq(tl.accountId, accountId), eq(tl.prId, prId), eq(tl.headSha, headSha), eq(tl.provider, provider), inArray(tl.state, [...OPEN_CLAIM_STATES])))
+        .returning({ id: tl.id })
+        .execute());
+    return rows.length;
+}
+/** Has this machine already released `login`'s line at this head (posted once, never again)? */
+export async function teammateLineReleased(ctx, accountId, prId, headSha, provider, login) {
+    const tl = t(ctx);
+    const rows = (await ctx.db
+        .select({ id: tl.id, login: tl.login })
+        .from(tl)
+        .where(and(eq(tl.accountId, accountId), eq(tl.prId, prId), eq(tl.headSha, headSha), eq(tl.provider, provider), eq(tl.whose, 'teammate')))
+        .execute());
+    return rows.some((r) => (r.login ?? '').toLowerCase() === login.toLowerCase());
+}
+/** Record a teammate's line this machine released (or tried to: `lastError`). */
+export async function recordTeammateRelease(ctx, row) {
+    const tl = t(ctx);
+    const prs = ctx.schema.pullRequests;
+    const repo = (await ctx.db
+        .select({ repoId: prs.repoId })
+        .from(prs)
+        .where(and(eq(prs.id, row.prId), eq(prs.accountId, row.accountId)))
+        .limit(1)
+        .execute());
+    await ctx.db
+        .insert(tl)
+        .values({
+        accountId: row.accountId,
+        prId: row.prId,
+        repoId: repo[0]?.repoId ?? null,
+        headSha: row.headSha,
+        provider: row.provider,
+        whose: 'teammate',
+        state: 'released',
+        login: row.login,
+        lastError: clipErr(row.lastError),
+        createdAt: now(),
+        updatedAt: now(),
+    })
+        .execute();
+}
+//# sourceMappingURL=team-claim-ledger.js.map