limn-review 0.1.148 → 0.1.150

package/dist/ai/budget.js

@@ -45,7 +45,7 @@
 //
 // One budget per ACCOUNT (= per machine), never per workspace.
 import { and, eq, gte, inArray } from 'drizzle-orm';
-import { AI_BUDGET_DAY_MS, AI_BUDGET_WEEK_MS, aiProviderWorthShowing, aiUsageView, budgetWindowStart, decideAiBudget, liveFiveHourReset, liveWeekReset, resolveAiBudgetSettings, rollingSpend, } from '../shared/index.js';
+import { AI_BUDGET_DAY_MS, AI_BUDGET_WEEK_MS, aiProviderWorthShowing, aiUsageView, budgetWindowStart, decideAiBudget, liveFiveHourReset, liveWeekReset, resolveAiBudgetSettings, budgetSettingsInForce, rollingSpend, } from '../shared/index.js';
 import { db, schema } from '../db/client.js';
 import { LOCAL_ACCOUNT_ID } from '../auth/account.js';
 import { getActiveProvider, getProvider } from './provider.js';
@@ -288,7 +288,10 @@ export async function aiBudgetSnapshot(accountId, opts = {}) {
     // the ledger — the named one (a manual run's per-run choice), else the default (active) one.
     const provider = opts.provider ? getProvider(opts.provider) : getActiveProvider();
     const route = provider.credentialRoute();
-    const { settings, isDefault } = await readAiBudgetSettings(accountId);
+    const stored = await readAiBudgetSettings(accountId);
+    const isDefault = stored.isDefault;
+    // On by default (a share of the week); a never-set row on an API key applies no US$ cap.
+    const settings = budgetSettingsInForce(stored.settings, isDefault, route);
     const probe = opts.probe ?? 'when_on';
     if (route === 'login' && (probe === 'always' || (probe === 'when_on' && settings.enabled)))
         kickUsageProbe(nowMs, provider);

package/dist/db/migrations/0145_verdict_strictness.sql

@@ -0,0 +1,14 @@
+-- THE AUTO VERDICT'S TWO RULES + THE NOT-APPROVED REASON (docs/CLAUDE-REVIEW.md § Auto-posting →
+-- AUTO VERDICT). Both workspace columns are OVERRIDES ONLY: NULL = today's rule.
+-- `pair_verdict_strictness`: how a Claude + Codex pair's verdict is folded — NULL / 'strict' = approve
+-- only when both approved; 'relaxed' = approve when one approved and neither asked for changes.
+ALTER TABLE `workspaces` ADD `pair_verdict_strictness` text;
+--> statement-breakpoint
+-- `approve_leftovers`: which open findings may remain when Limn approves — NULL / 'nits_questions' =
+-- nits and questions; 'nits' = nits only; 'none' = nothing open at all.
+ALTER TABLE `workspaces` ADD `approve_leftovers` text;
+--> statement-breakpoint
+-- A REPLIES PASS's not-approved reason ({heldReason, text}), written when the pass ends while the
+-- workspace's auto verdict is on. NULL on every other row (a full review's reason is on its
+-- `auto_post` record, or computed on read).
+ALTER TABLE `claude_reviews` ADD `verdict_reason` text;

package/dist/db/migrations/meta/_journal.json

@@ -1016,6 +1016,13 @@
       "when": 1792137640016,
       "tag": "0144_workspace_tracker_notion",
       "breakpoints": true
+    },
+    {
+      "idx": 145,
+      "version": "6",
+      "when": 1792137641016,
+      "tag": "0145_verdict_strictness",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/schema.sqlite.js

@@ -1123,6 +1123,11 @@ export const claudeReviews = sqliteTable('claude_reviews', {
     // people's replies on Limn's own posted findings; NULL on every full review (migration 0136).
     // ⚠ Every "the latest review" / "a run at this head" reader filters `kind IS NULL`.
     kind: text('kind', { enum: ['replies'] }),
+    // A REPLIES PASS's not-approved reason (migration 0145; review/claude-review/replies-outcome.ts):
+    // `{heldReason, text}`, written when the pass ends while the workspace's auto verdict is on and
+    // the outcome is not an approval. NULL on every full review (its reason rides `auto_post`, or is
+    // computed on read).
+    verdictReason: text('verdict_reason', { mode: 'json' }).$type(),
 }, (t) => ({
     prIdx: index('cr_pr_idx').on(t.prId),
     prShaIdx: index('cr_pr_sha_idx').on(t.prId, t.headSha),
@@ -1808,6 +1813,13 @@ export const workspaces = sqliteTable('workspaces', {
     // Claude then Codex as one pair (docs/CLAUDE-REVIEW.md § Claude + Codex). The ONE writer is
     // `setWorkspaceAutoReview` (review/claude-review/auto-settings.ts).
     autoReviewProviders: text('auto_review_providers'),
+    // THE AUTO VERDICT'S TWO RULES (migration 0145; docs/CLAUDE-REVIEW.md § Auto-posting → AUTO
+    // VERDICT), OVERRIDES ONLY. `pairVerdictStrictness`: NULL = 'strict' (a Claude + Codex pair approves
+    // only when both approved), 'relaxed' (one approved and neither asked for changes).
+    // `approveLeftovers`: NULL = 'nits_questions' (nits and questions may remain open on an approve),
+    // 'nits', 'none'. The ONE writer is `setWorkspaceAutoReview` (review/claude-review/auto-settings.ts).
+    pairVerdictStrictness: text('pair_verdict_strictness'),
+    approveLeftovers: text('approve_leftovers'),
     // DEPENDENCY AUTO-MERGE (migration 0093 / pg 0080): may the server arm "merge when ready" on
     // every open dependency-automation PR in this workspace's repos (merge/dependency-policy.ts)?
     // NULL/false = OFF, the default for every workspace; nullable with no default, so no insert

package/dist/review/claude-review/auto-post.js

@@ -37,8 +37,15 @@
 //      (`unsettledEarlierBlockers`) and none of the blocking run's own blockers that never reached
 //      GitHub (`loadUnpostedBlockersOfBlock` — never followed up, so never judged). Otherwise no
 //      dismissal, and an APPROVE over the block is held as 'already_requested';
-//   4. nothing to post and nothing but COMMENT to send ⇒ `skipped` — `already_posted` (with the
-//      ids) when the dedupe alone emptied it, else `nothing_new` — no GitHub write;
+//   3c. THE REASON (only with `autoVerdict` on): a run that does not end in an APPROVE gets ONE
+//      plain-English "Not approved: …" line (`findingsNotApproved` + the gate's `heldReason`,
+//      ./auto-verdict.ts), stored on the verdict record (`reasonText`). Posted findings carry it as the
+//      review body's last line before the footer; with NOTHING else to post it goes out as ONE short
+//      COMMENT review of its own — at most once per (PR, head): an earlier record at this head with
+//      `reasonPosted` (a full review's or a replies pass's) means nothing more is posted;
+//   4. nothing to post, nothing but COMMENT to send and no reason to post ⇒ `skipped` —
+//      `already_posted` (with the ids) when the dedupe alone emptied it, else `nothing_new` — no
+//      GitHub write;
 //   5. the LIVE PR is still open, not a draft, at the reviewed head (a moved head ⇒ `failed`);
 //   6. THE CLAIM — a compare-and-set of `claude_reviews.auto_post` from NULL to `status: 'posting'`
 //      BEFORE any write, so a second call (or a restart) can never post the same run twice;
@@ -65,9 +72,9 @@ import { similarTitles } from './settled-by-reply.js';
 import { prAuthorIsAccount } from '../../coding/ai-fix/auto-fix.js';
 import { getClaudeReviewById, getReviewPostContext, isAlreadyPostedReraise, isReaderIgnoredFinding, markReviewPosted, readPairConsolidation, } from './persist.js';
 import { resolveFindingBody } from './follow-up.js';
-import { autoVerdictFor } from './auto-verdict.js';
+import { autoVerdictFor, findingsNotApproved, pairVerdict, reasonMayPost, safeReasonText, withReason, } from './auto-verdict.js';
 import { aiRunProviderName, autoPostFooter, findingSourceLabel, limnSeverityLabel, PAIR_AUTO_POST_FOOTER, } from '../../shared/index.js';
-import { pairRaisedByLead, pairReviewBody, pairVerdict } from './pair.js';
+import { pairRaisedByLead, pairReviewBody } from './pair.js';
 // A pair's body names both when it falls back to a count ("3 comments from Claude and Codex.").
 const PAIR_BODY_BY = 'Claude and Codex';
 /* eslint-disable @typescript-eslint/no-explicit-any */
@@ -245,9 +252,28 @@ export function autoReviewBodyLead(summary, commentCount, by = 'Claude') {
         return `Reviewed by ${by}.`;
     return commentCount === 1 ? `One comment from ${by}.` : `${commentCount} comments from ${by}.`;
 }
-/** The posted body of an auto review: the lead, then the footer (the seam appends the marker). */
-export function autoReviewBody(summary, commentCount, by = 'Claude') {
-    return `${autoReviewBodyLead(summary, commentCount, by)}\n\n${autoPostFooter(by)}`;
+/** The posted body of an auto review: the lead, then the not-approved reason when there is one, then
+ *  the footer (the seam appends the marker). */
+export function autoReviewBody(summary, commentCount, by = 'Claude', reason = null) {
+    return `${autoReviewBodyLead(summary, commentCount, by)}\n\n${withReasonLine(reason, autoPostFooter(by))}`;
+}
+/** The footer, led by the not-approved reason as its own line when there is one. */
+export function withReasonLine(reason, footer) {
+    return reason ? `${safeReasonText(reason)}\n\n${footer}` : footer;
+}
+/**
+ * Has a not-approved reason already gone to GitHub at this head (any run of the PR other than
+ * `exceptIds`, full review or replies pass — a record whose `reasonPosted` is set, whatever became of
+ * it: never retried)? A reason-only review goes out at most once per (PR, head).
+ */
+export async function reasonPostedAtHead(ctx, accountId, prId, headSha, exceptIds) {
+    const cr = s(ctx).claudeReviews;
+    const rows = (await ctx.db
+        .select({ id: cr.id, autoPost: cr.autoPost })
+        .from(cr)
+        .where(and(eq(cr.prId, prId), eq(cr.accountId, accountId), eq(cr.headSha, headSha)))
+        .execute());
+    return rows.some((r) => !exceptIds.includes(r.id) && r.autoPost?.reasonPosted != null && r.autoPost.reasonPosted !== '');
 }
 export const defaultAutoPostDeps = {
     async livePr(owner, name, prNumber) {
@@ -416,6 +442,7 @@ export async function readAutoPostPrFacts(ctx, deps, accountId, workspaceId, prI
         deps.accountUserId(accountId),
     ]);
     let requestedOfMe = false;
+    let openRequestOfMe = false;
     if (me != null) {
         const [open, history] = await Promise.all([
             ctx.db
@@ -431,7 +458,8 @@ export async function readAutoPostPrFacts(ctx, deps, accountId, workspaceId, prI
                 .limit(1)
                 .execute(),
         ]);
-        requestedOfMe = open.length > 0 || history.length > 0;
+        openRequestOfMe = open.length > 0;
+        requestedOfMe = openRequestOfMe || history.length > 0;
     }
     let participatedByMe = false;
     if (me != null && !authorIsMe && !requestedOfMe) {
@@ -445,7 +473,7 @@ export async function readAutoPostPrFacts(ctx, deps, accountId, workspaceId, prI
         const hits = await Promise.all([by(t.reviews), by(t.reviewComments), by(t.prComments)]);
         participatedByMe = hits.some((h) => h.length > 0);
     }
-    return { state: pr.state, isDraft: pr.isDraft === true, authorIsBot, authorIsMe, requestedOfMe, participatedByMe };
+    return { state: pr.state, isDraft: pr.isDraft === true, authorIsBot, authorIsMe, requestedOfMe, openRequestOfMe, participatedByMe };
 }
 /** Every earlier run's findings of this PR (account-scoped), as the dedupe reads them. */
 export async function loadEarlierFindings(ctx, accountId, prId, beforeReviewId) {
@@ -591,8 +619,13 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         for (const f of r.findings)
             byOf.set(f.id, aiRunProviderName(r));
     const allFindings = runs.flatMap((r) => r.findings);
+    // THE WORKSPACE'S VERDICT RULES (migration 0145): strict / relaxed for a pair, and what may stay open.
+    const rules = { pairStrictness: ws.pairStrictness, approveLeftovers: ws.settings.approveLeftovers };
     // The run's verdict as `autoVerdictFor` reads it: a pair's is both runs' together.
-    const runVerdict = first ? pairVerdict(first.verdict, review.verdict) : review.verdict;
+    const runVerdict = first ? pairVerdict(first.verdict, review.verdict, rules.pairStrictness) : review.verdict;
+    // WHY NOT APPROVED, from the findings and the model(s) — only while the auto verdict is on.
+    const verdictRuns = runs.map((r) => ({ by: aiRunProviderName(r), verdict: r.verdict, summary: r.summary }));
+    const findingsReason = ws.settings.autoVerdict ? findingsNotApproved(verdictRuns, allFindings, rules) : null;
     // Claim the FIRST half as posted in this pair's review (compare-and-set from NULL): false ⇒ some
     // other writer has it, and its findings leave this post.
     const claimFirst = async (rec) => first != null && (await claimRun(ctx, first.id, { ...rec, viaPairReviewId: reviewId }));
@@ -615,6 +648,14 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         await claimFirst(rec);
         return { kind: 'skipped', reason };
     };
+    const wanted = ws.settings.autoVerdict
+        ? autoVerdictFor(runVerdict, allFindings, rules.approveLeftovers)
+        : null;
+    // A run that never wanted more than a COMMENT is recorded with its reason from the start (shown in
+    // Limn whatever happens next).
+    if (wanted != null && wanted === 'COMMENT') {
+        verdict = withReason(verdictGate('COMMENT', { authorIsMe: false, ownLatest: 'none' }), findingsReason);
+    }
     const facts = await readAutoPostPrFacts(ctx, deps, accountId, ws.workspaceId, prId);
     if (!facts)
         return { kind: 'not_found' };
@@ -626,13 +667,14 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     const earlier = await loadEarlierFindings(ctx, accountId, prId, runs[0].id);
     const picked = selectFindingsToPost(allFindings, ws.settings.kinds, earlier);
     const nothingReason = () => picked.alreadyPosted.length > 0 ? ['already_posted', picked.alreadyPosted.map((f) => f.id)] : ['nothing_new', undefined];
-    const wanted = ws.settings.autoVerdict ? autoVerdictFor(runVerdict, allFindings) : null;
-    if (wanted != null && wanted === 'COMMENT')
-        verdict = verdictGate('COMMENT', { authorIsMe: facts.authorIsMe, ownLatest: 'none' });
+    // A reason-only review goes out at most once per (PR, head): read only when nothing else would post.
+    const reasonAlreadyAtHead = ws.settings.autoVerdict && picked.toPost.length === 0
+        ? await reasonPostedAtHead(ctx, accountId, prId, review.headSha, runs.map((r) => r.id))
+        : false;
     // LIFTING LIMN'S OWN BLOCK: a run with NO blocker (whatever the auto-verdict switch says now) may
     // withdraw an earlier AUTOMATIC request for changes of Limn's that still stands. A DB pre-check
     // first, so an ordinary run costs no extra GitHub read.
-    const noBlocker = autoVerdictFor(runVerdict, allFindings) !== 'REQUEST_CHANGES';
+    const noBlocker = autoVerdictFor(runVerdict, allFindings, rules.approveLeftovers) !== 'REQUEST_CHANGES';
     // ⚠ "No blocker" from this run's OWN findings is not enough to lift: an earlier blocker the run
     // did not judge (a 'not_checked' follow-up) is still open as far as anyone knows. (A pair: either
     // half's.)
@@ -640,8 +682,12 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     // (Read for a REQUEST_CHANGES too: the gate must tell Limn's own standing block from a person's.)
     const limnBlockIds = !facts.authorIsMe ? await loadLimnAutoBlockIds(ctx, accountId, prId, reviewId) : new Set();
     const mayLift = noBlocker && unjudgedBlockers.length === 0 && limnBlockIds.size > 0;
-    if (picked.toPost.length === 0 && (wanted == null || wanted === 'COMMENT') && !mayLift)
+    // A COMMENT-only run with a reason still to tell GitHub goes on (to the reason-only review).
+    // (Never while a review request of the reader is open: any review answers it.)
+    const commentReasonToPost = wanted === 'COMMENT' && reasonMayPost(verdict) && !reasonAlreadyAtHead && facts.openRequestOfMe !== true;
+    if (picked.toPost.length === 0 && (wanted == null || wanted === 'COMMENT') && !mayLift && !commentReasonToPost) {
         return skip(...nothingReason());
+    }
     const pctx = await getReviewPostContext(ctx, reviewId, accountId);
     if (!pctx)
         return { kind: 'not_found' };
@@ -700,16 +746,27 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         if (verdict.submitted === 'APPROVE' && standing.state === 'LIMN_AUTO_CHANGES_REQUESTED' && blockersRemain) {
             verdict = { ...verdict, submitted: 'COMMENT', heldReason: 'already_requested' };
         }
+        verdict = withReason(verdict, findingsReason);
     }
+    // The reason this run tells GitHub (none on an approval, none with the verdict switched off, none
+    // for a Limn-only gate reason — own PR, unreadable reviews, a refusal: `reasonMayPost`).
+    const reasonNow = () => verdict != null && verdict.submitted !== 'APPROVE' && reasonMayPost(verdict) ? (verdict.reasonText ?? null) : null;
+    // NOTHING ELSE TO POST: the reason alone, as one short COMMENT review — once per (PR, head), and
+    // never while a review request of the reader is open (the review would answer it).
+    const reasonOnly = picked.toPost.length === 0 &&
+        (verdict?.submitted ?? 'COMMENT') === 'COMMENT' &&
+        reasonNow() != null &&
+        !reasonAlreadyAtHead &&
+        facts.openRequestOfMe !== true;
     // Limn's own automatic request for changes still stands, this run has no blocker and none behind
     // the block is left unjudged: lift it — superseded by the APPROVE this run sends, else dismissed.
     const liftId = noBlocker && !blockersRemain && standing.state === 'LIMN_AUTO_CHANGES_REQUESTED' ? standing.reviewId : null;
-    if (picked.toPost.length === 0 && (verdict?.submitted ?? 'COMMENT') === 'COMMENT' && liftId == null) {
+    if (picked.toPost.length === 0 && (verdict?.submitted ?? 'COMMENT') === 'COMMENT' && liftId == null && !reasonOnly) {
         return skip(...nothingReason());
     }
     const event = verdict?.submitted ?? 'COMMENT';
     // Nothing but the lift to do: no review is sent at all.
-    const sendsReview = picked.toPost.length > 0 || event !== 'COMMENT';
+    const sendsReview = picked.toPost.length > 0 || event !== 'COMMENT' || reasonOnly;
     const record = {
         status: 'posting',
         at: nowIso(),
@@ -727,6 +784,13 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         await claimFirst(rec);
         return { kind: 'done', record: rec };
     }
+    // The reason rides the review (its last line, or the whole body): recorded as POSSIBLY POSTED from
+    // the claim on, so a restart never sends it again at this head.
+    if (sendsReview && reasonNow() != null) {
+        record.reasonPosted = reasonNow();
+        if (reasonOnly)
+            record.reasonOnly = true;
+    }
     // ⚠ THE CLAIM, BEFORE ANY WRITE — on THIS run, then (a pair) on its first half. A first half
     // someone else claimed meanwhile keeps its findings out of this post.
     if (!(await claimRun(ctx, reviewId, record)))
@@ -749,21 +813,28 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     };
     const posted = new Set();
     const errors = [];
+    // The body. With findings: the lead, the reason line, the footer. Reason only: the reason, the footer.
+    const bodyOf = (reason) => {
+        const footer = pairFirst != null ? PAIR_AUTO_POST_FOOTER : autoPostFooter(aiRunProviderName(review));
+        if (reasonOnly && reason != null)
+            return withReasonLine(reason, footer);
+        if (pairFirst == null)
+            return autoReviewBody(review.summary, picked.toPost.length, aiRunProviderName(review), reason);
+        return consolidation?.how === 'pass'
+            ? `${autoReviewBodyLead(consolidation.summary, picked.toPost.length, PAIR_BODY_BY)}\n\n${withReasonLine(reason, footer)}`
+            : // Joined in code (or an older pair): each half's lead, named.
+                pairReviewBody([pairFirst, review].map((r) => {
+                    const mine = new Set(r.findings.map((x) => x.id));
+                    const n = picked.toPost.filter((f) => mine.has(f.id)).length;
+                    return { by: aiRunProviderName(r), text: autoReviewBodyLead(r.summary, n, aiRunProviderName(r)) };
+                }), withReasonLine(reason, footer));
+    };
     const submit = (ev) => ctx.review.postReview({
         owner: pctx.owner,
         name: pctx.name,
         prNumber: pctx.prNumber,
         reviewHeadSha: pctx.reviewHeadSha,
-        body: pairFirst != null
-            ? consolidation?.how === 'pass'
-                ? `${autoReviewBodyLead(consolidation.summary, picked.toPost.length, PAIR_BODY_BY)}\n\n${PAIR_AUTO_POST_FOOTER}`
-                : // Joined in code (or an older pair): each half's lead, named.
-                    pairReviewBody([pairFirst, review].map((r) => {
-                        const mine = new Set(r.findings.map((x) => x.id));
-                        const n = picked.toPost.filter((f) => mine.has(f.id)).length;
-                        return { by: aiRunProviderName(r), text: autoReviewBodyLead(r.summary, n, aiRunProviderName(r)) };
-                    }), PAIR_AUTO_POST_FOOTER)
-            : autoReviewBody(review.summary, picked.toPost.length, aiRunProviderName(review)),
+        body: bodyOf(ev === 'APPROVE' ? null : reasonNow()),
         // COMMENT unless auto verdict is on AND its gate let the verdict through.
         verdict: ev,
         // Questions ride the same review: the seam anchors each inline, else falls back. In a pair each
@@ -787,8 +858,10 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
                 // Never on a COMMENT, never on an ambiguous failure (5xx, network, rate limit), never twice.
                 if (event === 'COMMENT' || !isVerdictRefusal(err))
                     throw err;
-                verdict = { ...verdict, submitted: 'COMMENT', heldReason: 'refused', refusedError: errText(err).slice(0, 300) };
+                verdict = withReason({ ...verdict, submitted: 'COMMENT', heldReason: 'refused', refusedError: errText(err).slice(0, 300) }, findingsReason);
                 record.verdict = verdict;
+                if (picked.toPost.length > 0 && reasonNow() != null)
+                    record.reasonPosted = reasonNow();
                 // A bare verdict with no comments behind it: nothing is left to post. GitHub created
                 // nothing, so a lift may still go ahead.
                 if (picked.toPost.length === 0) {

package/dist/review/claude-review/auto-settings.js

@@ -2,6 +2,7 @@ import { and, eq } from 'drizzle-orm';
 import { AUTO_FIX_DEFAULT_AUTO_PUSH, AUTO_FIX_DEFAULT_INCLUDE, AUTO_POST_DEFAULT_APPROVE_IMPACT, AUTO_POST_DEFAULT_AUTO_RESOLVE, AUTO_POST_DEFAULT_AUTO_VERDICT, AUTO_POST_DEFAULT_KINDS, AUTO_POST_DEFAULT_SCOPE, } from '../../shared/index.js';
 import { dropAutoReviews } from './manager.js';
 import { resolveAutoReviewProviders } from './pair.js';
+import { DEFAULT_VERDICT_RULES, resolveApproveLeftovers, resolvePairStrictness, } from './auto-verdict.js';
 import { onOff, writeSettingEvent } from '../../db/setting-event-write.js';
 // AUTO CLAUDE REVIEW — THE PER-WORKSPACE SWITCH (CORE since migration 0074 / pg 0061; it lived on
 // the plugin's `pro_workspace_settings` until Claude Review left the plugin, and plugin migration
@@ -42,6 +43,11 @@ import { onOff, writeSettingEvent } from '../../db/setting-event-write.js';
 // `autoResolve` switches (both OFF by default) ride the same overrides JSON (no column), and so
 // does `approveImpact` (which blast-radius levels an auto verdict may APPROVE; all by default).
 //
+// THE AUTO VERDICT'S TWO RULES ride the same route as two more columns (migration 0145), OVERRIDES
+// ONLY (NULL = today's rule): `pair_verdict_strictness` ('relaxed', else strict — wire
+// `pairStrictness`) and `approve_leftovers` ('nits' / 'none', else 'nits_questions' — wire
+// `autoPost.approveLeftovers`). `readVerdictRulesForPr` is what every verdict reads.
+//
 // TEAM CLAIMS ("Mark auto reviews on GitHub") ride the same route as one more column,
 // `team_claims_enabled` (migration 0134): may an AUTO review post a status line on the PR's head so
 // teammates' Limn skips it (team-claim.ts)? OFF by default — only a stored true is on.
@@ -68,9 +74,12 @@ export function resolveAutoReviewDailyCap(stored) {
 }
 const AUTO_POST_KIND_KEYS = Object.keys(AUTO_POST_DEFAULT_KINDS);
 export const APPROVE_IMPACT_KEYS = Object.keys(AUTO_POST_DEFAULT_APPROVE_IMPACT);
+const APPROVE_LEFTOVERS = ['none', 'nits', 'nits_questions'];
 const isScope = (v) => v === 'mine' || v === 'all';
 /** The stored switch + overrides → the settings in force. Anything malformed reads as the default. */
-export function resolveAutoPostSettings(enabled, stored) {
+export function resolveAutoPostSettings(enabled, stored, 
+// `workspaces.approve_leftovers` (migration 0145): its own column, NULL = the default.
+approveLeftovers) {
     const kinds = { ...AUTO_POST_DEFAULT_KINDS };
     const sk = stored?.kinds;
     if (sk != null && typeof sk === 'object') {
@@ -92,6 +101,7 @@ export function resolveAutoPostSettings(enabled, stored) {
         autoVerdict: typeof stored?.autoVerdict === 'boolean' ? stored.autoVerdict : AUTO_POST_DEFAULT_AUTO_VERDICT,
         autoResolve: typeof stored?.autoResolve === 'boolean' ? stored.autoResolve : AUTO_POST_DEFAULT_AUTO_RESOLVE,
         approveImpact,
+        approveLeftovers: resolveApproveLeftovers(approveLeftovers),
     };
 }
 /** The settings in force → what to store: only what differs from the product default (null = none). */
@@ -161,7 +171,8 @@ export function autoReviewOf(row) {
         // ON unless explicitly switched off (0126).
         autoDiagramsEnabled: row?.autoDiagramsEnabled !== false,
         autoReviewProviders: resolveAutoReviewProviders(row?.providers),
-        autoPost: resolveAutoPostSettings(row?.autoPostEnabled, row?.autoPostSettings),
+        pairStrictness: resolvePairStrictness(row?.pairStrictness),
+        autoPost: resolveAutoPostSettings(row?.autoPostEnabled, row?.autoPostSettings, row?.approveLeftovers),
         autoFix: resolveAutoFixSettings(row?.autoFixSettings),
         // OFF unless explicitly switched on (0134).
         teamClaimsEnabled: row?.teamClaimsEnabled === true,
@@ -175,7 +186,12 @@ export function autoReviewOf(row) {
 export async function readWorkspaceAutoPostForPr(ctx, accountId, prId) {
     const { workspaces: w, workspaceRepos: wr, pullRequests: prs } = ctx.schema;
     const rows = (await ctx.db
-        .select({ workspaceId: w.id, enabled: w.autoPostEnabled, stored: w.autoPostSettings })
+        .select({
+        workspaceId: w.id,
+        enabled: w.autoPostEnabled,
+        stored: w.autoPostSettings,
+        ...verdictRuleCols(w),
+    })
         .from(prs)
         .innerJoin(wr, and(eq(wr.repoId, prs.repoId), eq(wr.accountId, accountId)))
         .innerJoin(w, and(eq(w.id, wr.workspaceId), eq(w.accountId, accountId)))
@@ -183,7 +199,28 @@ export async function readWorkspaceAutoPostForPr(ctx, accountId, prId) {
         .limit(1)
         .execute());
     const r = rows[0];
-    return r ? { workspaceId: r.workspaceId, settings: resolveAutoPostSettings(r.enabled, r.stored) } : null;
+    return r
+        ? {
+            workspaceId: r.workspaceId,
+            settings: resolveAutoPostSettings(r.enabled, r.stored, r.approveLeftovers),
+            pairStrictness: resolvePairStrictness(r.pairStrictness),
+        }
+        : null;
+}
+// The two rule columns (migration 0145), when the schema has them (an older test schema may not).
+const verdictRuleCols = (w) => ({
+    ...(w.pairVerdictStrictness ? { pairStrictness: w.pairVerdictStrictness } : {}),
+    ...(w.approveLeftovers ? { approveLeftovers: w.approveLeftovers } : {}),
+});
+/**
+ * THE AUTO VERDICT'S RULES for the workspace holding this PR's repo (strict / relaxed, what may stay
+ * open), with whether its auto verdict is on. A PR with no membership row reads the defaults, off.
+ */
+export async function readVerdictRulesForPr(ctx, accountId, prId) {
+    const ws = await readWorkspaceAutoPostForPr(ctx, accountId, prId);
+    if (!ws)
+        return { ...DEFAULT_VERDICT_RULES, autoVerdict: false };
+    return { pairStrictness: ws.pairStrictness, approveLeftovers: ws.settings.approveLeftovers, autoVerdict: ws.settings.autoVerdict };
 }
 /**
  * Is auto AI Fix on for the workspace holding this PR's repo? Read by `maybeStartAutoFix`. Only a
@@ -221,6 +258,7 @@ export async function readWorkspaceAutoFixSettingsForPr(ctx, accountId, prId) {
 }
 const autoCols = (w) => ({
     providers: w.autoReviewProviders,
+    ...verdictRuleCols(w),
     enabled: w.autoReviewEnabled,
     enabledAt: w.autoReviewEnabledAt,
     autoFixEnabled: w.autoFixEnabled,
@@ -262,7 +300,7 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     const existing = rows[0];
     if (!existing)
         return null;
-    const { enabled, autoFixEnabled, autoDiagramsEnabled, teamClaimsEnabled, dailyCap, autoPost, autoFix, autoReviewProviders } = change;
+    const { enabled, autoFixEnabled, autoDiagramsEnabled, teamClaimsEnabled, dailyCap, autoPost, autoFix, autoReviewProviders, pairStrictness, } = change;
     const wasOn = existing.enabled === true && toMs(existing.enabledAt) != null;
     let review;
     if (enabled === undefined || (enabled && wasOn))
@@ -290,7 +328,7 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     const claims = teamClaimsEnabled ?? claimsWas;
     const capOverride = dailyCap === undefined ? existing.dailyCap : dailyCap === AUTO_REVIEW_DAILY_CAP ? null : dailyCap;
     // Auto-posting: each field optional; a kind left out keeps its stored value.
-    const postBefore = resolveAutoPostSettings(existing.autoPostEnabled, existing.autoPostSettings);
+    const postBefore = resolveAutoPostSettings(existing.autoPostEnabled, existing.autoPostSettings, existing.approveLeftovers);
     const postAfter = {
         enabled: autoPost?.enabled ?? postBefore.enabled,
         scope: autoPost?.scope ?? postBefore.scope,
@@ -298,7 +336,13 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
         autoVerdict: autoPost?.autoVerdict ?? postBefore.autoVerdict,
         autoResolve: autoPost?.autoResolve ?? postBefore.autoResolve,
         approveImpact: { ...postBefore.approveImpact },
+        approveLeftovers: autoPost?.approveLeftovers ?? postBefore.approveLeftovers,
     };
+    // The leftovers rule is its own column (migration 0145): NULL = the default.
+    const leftoversStored = postAfter.approveLeftovers === 'nits_questions' ? null : postAfter.approveLeftovers;
+    // How a pair's verdict folds (migration 0145): NULL = strict.
+    const strictnessWas = resolvePairStrictness(existing.pairStrictness);
+    const strictness = pairStrictness ?? strictnessWas;
     for (const k of AUTO_POST_KIND_KEYS) {
         const v = autoPost?.kinds?.[k];
         if (typeof v === 'boolean')
@@ -327,6 +371,8 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     const providers = autoReviewProviders ?? providersWas;
     const next = {
         providers: providers === 'both' ? 'both' : null,
+        pairStrictness: strictness === 'relaxed' ? 'relaxed' : null,
+        approveLeftovers: leftoversStored,
         enabled: review.enabled,
         enabledAt: review.enabledAt,
         autoFixEnabled: fix,
@@ -357,6 +403,12 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     if (autoReviewProviders !== undefined && providers !== providersWas) {
         set.autoReviewProviders = providers === 'both' ? 'both' : null;
     }
+    if (pairStrictness !== undefined && strictness !== strictnessWas) {
+        set.pairVerdictStrictness = strictness === 'relaxed' ? 'relaxed' : null;
+    }
+    if (autoPost?.approveLeftovers !== undefined && postAfter.approveLeftovers !== postBefore.approveLeftovers) {
+        set.approveLeftovers = leftoversStored;
+    }
     if (autoPost !== undefined) {
         if (postAfter.enabled !== (existing.autoPostEnabled === true))
             set.autoPostEnabled = postAfter.enabled;
@@ -409,6 +461,25 @@ function settingChanges(set, existing, next) {
         const now = resolveAutoFixSettings(next.autoFixSettings).autoPush;
         out.push(['auto_fix', was !== now ? `Auto fix push ${onOff(now)}` : 'Auto fix contents changed']);
     }
+    if ('pairVerdictStrictness' in set) {
+        out.push([
+            'auto_post',
+            next.pairStrictness === 'relaxed'
+                ? 'Claude + Codex verdict: relaxed (approve if one approves and neither asks for changes)'
+                : 'Claude + Codex verdict: strict (approve only if both approve)',
+        ]);
+    }
+    if ('approveLeftovers' in set) {
+        const now = resolveApproveLeftovers(next.approveLeftovers);
+        out.push([
+            'auto_post',
+            now === 'none'
+                ? 'Auto-approve: only with nothing open'
+                : now === 'nits'
+                    ? 'Auto-approve: nits may stay open'
+                    : 'Auto-approve: nits and questions may stay open',
+        ]);
+    }
     if ('autoPostEnabled' in set)
         out.push(['auto_post', `Auto-posting ${onOff(next.autoPostEnabled === true)}`]);
     else if ('autoPostSettings' in set)
@@ -560,6 +631,7 @@ export function registerAutoReviewSettingsRoutes(app, ctx) {
                     autoDiagramsEnabled: { type: 'boolean' },
                     teamClaimsEnabled: { type: 'boolean' },
                     autoReviewProviders: { type: 'string', enum: ['default', 'both'] },
+                    pairStrictness: { type: 'string', enum: ['strict', 'relaxed'] },
                     // An integer 1..500; anything else (a fraction, a string, out of range) is a 400.
                     dailyCap: {
                         type: 'integer',
@@ -587,6 +659,7 @@ export function registerAutoReviewSettingsRoutes(app, ctx) {
                                 additionalProperties: false,
                                 properties: Object.fromEntries(APPROVE_IMPACT_KEYS.map((k) => [k, { type: 'boolean' }])),
                             },
+                            approveLeftovers: { type: 'string', enum: APPROVE_LEFTOVERS },
                         },
                     },
                     autoFix: {