limn-review 0.1.181 → 0.1.183

package/dist/db/migrations/0165_withdraw_approval_on_push.sql

@@ -0,0 +1,6 @@
+-- WITHDRAWING LIMN'S OWN APPROVAL ON A PUSH (docs/CLAUDE-REVIEW.md § Withdrawing Limn's approval).
+-- ONE column, `workspaces.withdraw_approval_on_push`: when a PR's head moves off the commit Limn's OWN
+-- automatic approval was given on, Limn dismisses that approval. NULL = ON (the default); only a
+-- stored 0 is off. The claim and the outcome ride the approving run's `claude_reviews.auto_post` JSON
+-- (`approvalWithdrawal`), so no other DDL. Additive and nullable: no backfill.
+ALTER TABLE `workspaces` ADD `withdraw_approval_on_push` integer;

package/dist/db/migrations/meta/_journal.json

@@ -1156,6 +1156,13 @@
       "when": 1792224071016,
       "tag": "0164_teammate_block_lift",
       "breakpoints": true
+    },
+    {
+      "idx": 165,
+      "version": "6",
+      "when": 1792224073016,
+      "tag": "0165_withdraw_approval_on_push",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/schema.sqlite.js

@@ -1927,6 +1927,10 @@ export const workspaces = sqliteTable('workspaces', {
     // PR's head so teammates' Limn skips a commit someone is already reviewing with the same
     // provider. NULL/false = OFF, the default. The ONE writer is `setWorkspaceAutoReview`.
     teamClaimsEnabled: integer('team_claims_enabled', { mode: 'boolean' }),
+    // "Withdraw Limn's approval when new commits are pushed" (migration 0165; docs/CLAUDE-REVIEW.md
+    // § Withdrawing Limn's approval). NULL = ON, the default; only a stored false is off. The ONE
+    // writer is `setWorkspaceAutoReview`.
+    withdrawApprovalOnPush: integer('withdraw_approval_on_push', { mode: 'boolean' }),
     // WHO RUNS AUTO REVIEWS (migration 0135): NULL = the default provider (Settings → AI); 'both' =
     // Claude then Codex as one pair (docs/CLAUDE-REVIEW.md § Claude + Codex). The ONE writer is
     // `setWorkspaceAutoReview` (review/claude-review/auto-settings.ts).

package/dist/db/teammate-reviews.js

@@ -1,6 +1,7 @@
 // TEAMMATES' POSTED REVIEWS — THE READ SIDE (docs/CLAUDE-REVIEW.md § Teammates' reviews). The import
 // is db/teammate-reviews-import.ts. ⚠ This module opens NO database at import (every reader takes an
 // executor): review modules and their fake-context tests import it.
+import { createHash } from 'node:crypto';
 import { and, asc, desc, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm';
 import * as schema from './schema.sqlite.js';
 const { users, reviewComments, commits, pullRequests, repos } = schema;
@@ -67,6 +68,9 @@ export async function listTeammateReviews(exec, accountId, prId) {
         kind: crf.postedCommentKind,
         githubCommentId: crf.githubCommentId,
         nodeId: crf.sourceCommentNodeId,
+        postedAt: crf.postedAt,
+        side: crf.side,
+        reminder: crf.reminder,
     })
         .from(crf)
         .where(inArray(crf.reviewId, rows.map((r) => r.id)))
@@ -114,6 +118,13 @@ export async function listTeammateReviews(exec, accountId, prId) {
                 threadId: kind === 'inline' && f.nodeId != null ? (threadOf.get(f.nodeId) ?? null) : null,
                 ...providersOf(f.nodeId),
                 githubCommentId: f.githubCommentId ?? null,
+                postedAt: f.postedAt != null ? f.postedAt.toISOString() : null,
+                side: f.side === 'LEFT' ? 'LEFT' : 'RIGHT',
+                diffAnchorId: createHash('sha256').update(f.path, 'utf8').digest('hex'),
+                // The reader's reminder (stored beside the finding, never its own post); wire shape only.
+                reminder: f.reminder == null
+                    ? null
+                    : { githubCommentId: f.reminder.githubCommentId, postedCommentKind: f.reminder.postedCommentKind, postedAt: f.reminder.postedAt },
             };
         });
         const at = r.postedAt ?? r.createdAt;

package/dist/review/claude-review/approval-withdraw.js

@@ -0,0 +1,233 @@
+// WITHDRAWING LIMN'S OWN AUTOMATIC APPROVAL (docs/CLAUDE-REVIEW.md § Withdrawing Limn's approval).
+//
+// An auto-posted APPROVE is Limn's judgement of ONE head. When the head moves, or a later run at a new
+// head finds problems, that approval must not stay in force on GitHub. Two paths dismiss it:
+//
+//   1. THE RUN PATH (auto-post.ts, ALWAYS ON): a later auto run — or a "Review and post" run — at a NEW
+//      head that does not approve dismisses Limn's standing approval FIRST, then posts its review.
+//   2. THE PUSH PATH (`maybeWithdrawApprovalOnPush`, called fire-and-forget by sync/upsert.ts when it
+//      sees a PR's head move): only in a workspace with auto review AND auto-posting on and the
+//      per-workspace switch `withdraw_approval_on_push` on (ON by default, migration 0165), never on
+//      the reader's own PR.
+//
+// ⚠ RECOGNITION IS BY STORED ID ONLY: the approval is Limn's when an earlier run's `auto_post` record
+// holds its GitHub review id with `verdict.submitted === 'APPROVE'` (the twin of
+// `loadLimnAutoBlockIds`). Never by marker or body: a manual Post, or an approval by hand, carries the
+// same marker (or none) and is the reader's own judgement — never touched.
+// ⚠ LIVE: it is dismissed only while it is still the reader's standing review on GitHub.
+// ⚠ THE CLAIM: `approvalWithdrawal` on the APPROVING run's `auto_post` JSON, compare-and-set from
+// absent BEFORE the GitHub write (a `json_set` guarded by `json_extract … IS NULL`). Whichever path
+// claims first dismisses; the other does nothing. A failure is recorded in GitHub's words and NEVER
+// retried (the record is never cleared).
+import { and, asc, eq, lt, sql } from 'drizzle-orm';
+import { ownRunsOnly } from '../../db/teammate-reviews.js';
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const s = (ctx) => ctx.schema;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+const nowIso = () => new Date().toISOString();
+const errText = (err) => (err instanceof Error ? err.message : String(err)).slice(0, 300);
+const shortSha = (sha) => sha.slice(0, 7);
+/**
+ * Limn's own automatic APPROVE reviews on this PR (account-scoped), by GitHub review id: every own
+ * run (before `beforeReviewId`, when given) whose auto-post LANDED a review SENT as APPROVE. A pair's
+ * one review is recorded on both halves; the claim row is the half without `viaPairReviewId`.
+ */
+export async function loadLimnAutoApprovals(ctx, accountId, prId, beforeReviewId) {
+    const cr = s(ctx).claudeReviews;
+    const rows = (await ctx.db
+        .select({ id: cr.id, headSha: cr.headSha, autoPost: cr.autoPost })
+        .from(cr)
+        .where(and(eq(cr.prId, prId), eq(cr.accountId, accountId), ownRunsOnly(cr.kind), ...(beforeReviewId != null ? [lt(cr.id, beforeReviewId)] : [])))
+        .orderBy(asc(cr.id))
+        .execute());
+    const out = new Map();
+    for (const r of rows) {
+        const a = r.autoPost;
+        if (a?.githubReviewId == null || a.verdict?.submitted !== 'APPROVE')
+            continue;
+        const id = String(a.githubReviewId);
+        const via = a.viaPairReviewId != null;
+        const had = out.get(id);
+        if (had != null && !(had.via && !via))
+            continue;
+        out.set(id, { runId: r.id, githubReviewId: id, headSha: r.headSha, withdrawal: a.approvalWithdrawal ?? null, via });
+    }
+    return new Map([...out].map(([k, { via: _via, ...v }]) => [k, v]));
+}
+/** The dismissal message for a later run that found problems: counts by severity, then the head. */
+export function withdrawMessageForRun(counts, headSha) {
+    const parts = [];
+    if (counts.blockers > 0)
+        parts.push(counts.blockers === 1 ? '1 blocker' : `${counts.blockers} blockers`);
+    if (counts.warnings > 0)
+        parts.push(counts.warnings === 1 ? '1 warning' : `${counts.warnings} warnings`);
+    return parts.length > 0
+        ? `Limn withdrew its approval: ${parts.join(' and ')} found at ${shortSha(headSha)}.`
+        : `Limn withdrew its approval: not approved at ${shortSha(headSha)}.`;
+}
+/** The dismissal message for a push. */
+export function withdrawMessageForPush(headSha) {
+    return `Limn withdrew its approval: new commits since it approved (${shortSha(headSha)}).`;
+}
+/**
+ * THE CLAIM: write `approvalWithdrawal` (status 'withdrawing') on the approving run's record, only
+ * while it has none. false = someone (the other path, or an earlier attempt) already claimed it.
+ */
+export async function claimApprovalWithdrawal(ctx, accountId, runId, rec) {
+    const cr = s(ctx).claudeReviews;
+    const value = { ...rec, status: 'withdrawing', at: nowIso(), error: null };
+    const rows = (await ctx.db
+        .update(cr)
+        .set({ autoPost: sql `json_set(${cr.autoPost}, '$.approvalWithdrawal', json(${JSON.stringify(value)}))` })
+        .where(and(eq(cr.id, runId), eq(cr.accountId, accountId), sql `${cr.autoPost} is not null`, sql `json_extract(${cr.autoPost}, '$.approvalWithdrawal') is null`))
+        .returning({ id: cr.id })
+        .execute());
+    return rows.length > 0;
+}
+/** Settle a claimed withdrawal: 'withdrawn', or 'failed' with GitHub's words. */
+export async function settleApprovalWithdrawal(ctx, accountId, runId, rec) {
+    const cr = s(ctx).claudeReviews;
+    await ctx.db
+        .update(cr)
+        .set({ autoPost: sql `json_set(${cr.autoPost}, '$.approvalWithdrawal', json(${JSON.stringify(rec)}))` })
+        .where(and(eq(cr.id, runId), eq(cr.accountId, accountId), sql `${cr.autoPost} is not null`))
+        .execute();
+}
+/** Stamp the local review row dismissed (GitHub accepted the dismissal; a sync reconciles anyway). */
+export async function stampApprovalDismissed(ctx, prId, githubReviewId) {
+    const rv = s(ctx).reviews;
+    await ctx.db
+        .update(rv)
+        .set({ state: 'dismissed' })
+        .where(and(eq(rv.prId, prId), eq(rv.databaseId, githubReviewId)))
+        .execute();
+}
+/**
+ * Claim, dismiss, settle — ONE attempt, never retried. Returns null when the claim was lost (another
+ * path has it), else what GitHub said. Never throws.
+ */
+export async function withdrawApproval(ctx, a, dismiss) {
+    const base = {
+        why: a.why,
+        headSha: a.headSha,
+        message: a.message,
+        ...(a.byReviewId != null ? { byReviewId: a.byReviewId } : {}),
+    };
+    let claimed = false;
+    try {
+        claimed = await claimApprovalWithdrawal(ctx, a.accountId, a.approval.runId, base);
+    }
+    catch (err) {
+        ctx.log.warn(`withdraw approval ${a.approval.githubReviewId}: could not claim: ${errText(err)}`);
+    }
+    if (!claimed)
+        return null;
+    let res;
+    try {
+        res = await dismiss(a.approval.githubReviewId, a.message);
+    }
+    catch (err) {
+        res = { ok: false, message: errText(err) };
+    }
+    const rec = {
+        ...base,
+        status: res.ok ? 'withdrawn' : 'failed',
+        at: nowIso(),
+        error: res.ok ? null : res.message.slice(0, 300),
+    };
+    await settleApprovalWithdrawal(ctx, a.accountId, a.approval.runId, rec).catch((err) => ctx.log.warn(`withdraw approval ${a.approval.githubReviewId}: could not record the result: ${errText(err)}`));
+    if (res.ok) {
+        await stampApprovalDismissed(ctx, a.prId, a.approval.githubReviewId).catch((err) => ctx.log.warn(`withdraw approval ${a.approval.githubReviewId}: could not stamp the dismissal: ${errText(err)}`));
+    }
+    return rec;
+}
+export const defaultPushWithdrawDeps = {
+    async accountLogin(accountId) {
+        const { defaultAutoPostDeps } = await import('./auto-post.js');
+        return defaultAutoPostDeps.accountLogin(accountId);
+    },
+    async accountUserId(accountId) {
+        const { getAccountUserId } = await import('../../auth/account.js');
+        return getAccountUserId(accountId);
+    },
+    async liveReviews(owner, name, prNumber) {
+        const { defaultAutoPostDeps } = await import('./auto-post.js');
+        return defaultAutoPostDeps.liveReviews(owner, name, prNumber);
+    },
+    async dismissReview(accountId, owner, name, prNumber, reviewId, message) {
+        const { defaultAutoPostDeps } = await import('./auto-post.js');
+        return defaultAutoPostDeps.dismissReview(accountId, owner, name, prNumber, reviewId, message);
+    },
+    async settle({ accountId, prId }) {
+        const { settlePrAfterWrite } = await import('../../sync/resync-after-write.js');
+        const quiet = { info: () => { }, warn: () => { }, error: () => { } };
+        return settlePrAfterWrite({ accountId, prId, log: quiet });
+    },
+};
+/**
+ * A PR's head was seen at `headSha`: dismiss Limn's own automatic approval of an OLDER head, if it
+ * still stands live. DB pre-checks first (the workspace's switches, the reader's own PR, an
+ * unwithdrawn approval of another head), so an ordinary walk costs no GitHub call. Never throws.
+ */
+export async function maybeWithdrawApprovalOnPush(ctx, a, deps = defaultPushWithdrawDeps) {
+    try {
+        return await withdrawOnPush(ctx, a, deps);
+    }
+    catch (err) {
+        ctx.log.warn(`withdraw approval on push, PR ${a.prId}: ${errText(err)}`);
+        return { kind: 'none' };
+    }
+}
+async function withdrawOnPush(ctx, { accountId, prId, headSha }, deps) {
+    const t = s(ctx);
+    const { workspaces: w, workspaceRepos: wr, pullRequests: prs, repos } = t;
+    const rows = (await ctx.db
+        .select({
+        reviewOn: w.autoReviewEnabled,
+        postOn: w.autoPostEnabled,
+        withdrawOn: w.withdrawApprovalOnPush,
+        state: prs.state,
+        authorId: prs.authorId,
+        number: prs.number,
+        owner: repos.owner,
+        name: repos.name,
+    })
+        .from(prs)
+        .innerJoin(repos, and(eq(repos.id, prs.repoId), eq(repos.accountId, accountId)))
+        .innerJoin(wr, and(eq(wr.repoId, prs.repoId), eq(wr.accountId, accountId)))
+        .innerJoin(w, and(eq(w.id, wr.workspaceId), eq(w.accountId, accountId)))
+        .where(and(eq(prs.id, prId), eq(prs.accountId, accountId)))
+        .limit(1)
+        .execute());
+    const pr = rows[0];
+    // Auto review AND auto-posting on (the approval could only exist there), and the switch not off.
+    if (!pr || pr.reviewOn !== true || pr.postOn !== true || pr.withdrawOn === false)
+        return { kind: 'off' };
+    if (pr.state !== 'open')
+        return { kind: 'none' };
+    // The latest unwithdrawn approval of ANOTHER head (only the latest can still stand).
+    const approvals = [...(await loadLimnAutoApprovals(ctx, accountId, prId)).values()]
+        .filter((x) => x.headSha !== headSha && x.withdrawal == null)
+        .sort((x, y) => y.runId - x.runId);
+    const approval = approvals[0];
+    if (approval == null)
+        return { kind: 'none' };
+    // Never on the reader's own PR (GitHub refuses self-approval; nothing of Limn's can stand there).
+    const me = await deps.accountUserId(accountId);
+    if (me != null && pr.authorId === me)
+        return { kind: 'none' };
+    // LIVE: still the reader's standing review on GitHub?
+    const [login, reviews] = await Promise.all([deps.accountLogin(accountId), deps.liveReviews(pr.owner, pr.name, pr.number)]);
+    const { ownStandingReview } = await import('./auto-post.js');
+    const standing = ownStandingReview(reviews, login, new Set(), new Set([approval.githubReviewId]));
+    if (standing.state !== 'LIMN_AUTO_APPROVED' || standing.reviewId !== approval.githubReviewId)
+        return { kind: 'not_standing' };
+    const rec = await withdrawApproval(ctx, { accountId, prId, approval, why: 'push', headSha, message: withdrawMessageForPush(headSha) }, (reviewId, message) => deps.dismissReview(accountId, pr.owner, pr.name, pr.number, reviewId, message));
+    if (rec == null)
+        return { kind: 'claimed_elsewhere' };
+    // SETTLE, THEN CASCADE (the post-write rule): a dismissal changes the PR's review decision.
+    if (rec.status === 'withdrawn')
+        await Promise.resolve(deps.settle({ accountId, prId })).catch(() => undefined);
+    return { kind: 'done', record: rec };
+}
+//# sourceMappingURL=approval-withdraw.js.map

package/dist/review/claude-review/auto-post.js

@@ -37,6 +37,12 @@
 //      (`unsettledEarlierBlockers`) and none of the blocking run's own blockers that never reached
 //      GitHub (`loadUnpostedBlockersOfBlock` — never followed up, so never judged). Otherwise no
 //      dismissal, and an APPROVE over the block is held as 'already_requested';
+//   3b'. THE WITHDRAWAL (./approval-withdraw.ts, always on): a run at a NEW head that does not approve
+//      while Limn's OWN earlier AUTOMATIC APPROVE still stands (an earlier run's `githubReviewId` —
+//      never the marker) DISMISSES it before the post ("Limn withdrew its approval: 3 warnings found
+//      at 91482c8."), claimed on the approving run's record (`approvalWithdrawal`) so the push path
+//      and this never both dismiss; recorded as `withdrewApproval`, never retried. Its REQUEST_CHANGES
+//      then goes out (the gate's 'LIMN_AUTO_APPROVED' is not the reader's verdict);
 //   3c. THE REASON (only with `autoVerdict` on): a run that does not end in an APPROVE gets ONE
 //      plain-English "Not approved: …" line (`findingsNotApproved` + the gate's `heldReason`,
 //      ./auto-verdict.ts), stored on the verdict record (`reasonText`). Posted findings carry it as the
@@ -75,7 +81,8 @@ import { similarTitles } from './settled-by-reply.js';
 import { prAuthorIsAccount } from '../../coding/ai-fix/auto-fix.js';
 import { getClaudeReviewById, getReviewPostContext, isAlreadyPostedReraise, isReaderIgnoredFinding, markReviewPosted, readPairConsolidation, } from './persist.js';
 import { resolveFindingBody } from './follow-up.js';
-import { autoVerdictFor, findingsNotApproved, pairVerdict, reasonMayPost, safeReasonText, withReason, } from './auto-verdict.js';
+import { loadLimnAutoApprovals, withdrawApproval, withdrawMessageForRun, } from './approval-withdraw.js';
+import { autoVerdictFor, blockerWarningCounts, findingsNotApproved, pairVerdict, reasonMayPost, safeReasonText, withReason, } from './auto-verdict.js';
 import { aiRunProviderName, autoPostFooter, findingSourceLabel, limnSeverityLabel, PAIR_AUTO_POST_FOOTER, } from '../../shared/index.js';
 import { pairRaisedByLead, pairReviewBody } from './pair.js';
 import { limnMetaForReview, loadJudgedForPost } from './post-meta.js';
@@ -212,6 +219,10 @@ export function verdictGate(wanted, g) {
             ? { wanted, submitted: wanted, heldReason: null }
             : { wanted, submitted: 'COMMENT', heldReason: 'already_requested' };
     }
+    // Limn's OWN automatic approval is not the reader's: a new APPROVE supersedes it, and a request for
+    // changes goes out (auto-post withdraws the approval first when the head moved).
+    if (g.ownLatest === 'LIMN_AUTO_APPROVED')
+        return { wanted, submitted: wanted, heldReason: null };
     if (g.ownLatest !== 'none')
         return { wanted, submitted: 'COMMENT', heldReason: 'prior_review' };
     return { wanted, submitted: wanted, heldReason: null };
@@ -220,9 +231,10 @@ export function verdictGate(wanted, g) {
  * The reader's standing verdict in a live GitHub list (oldest first): the latest of their DECISIVE
  * reviews — COMMENTED and PENDING are skipped, because neither supersedes a standing APPROVED or
  * CHANGES_REQUESTED on GitHub; a latest DISMISSED stands for nothing. `limnAutoBlockIds` = the ids of
- * Limn's own earlier AUTOMATIC REQUEST_CHANGES reviews on this PR (`loadLimnAutoBlockIds`).
+ * Limn's own earlier AUTOMATIC REQUEST_CHANGES reviews on this PR (`loadLimnAutoBlockIds`);
+ * `limnAutoApproveIds` = those of its own automatic APPROVEs (`loadLimnAutoApprovals`).
  */
-export function ownStandingReview(reviews, login, limnAutoBlockIds = new Set()) {
+export function ownStandingReview(reviews, login, limnAutoBlockIds = new Set(), limnAutoApproveIds = new Set()) {
     if (!login)
         return { state: 'unreadable', reviewId: null };
     const me = login.toLowerCase();
@@ -237,7 +249,7 @@ export function ownStandingReview(reviews, login, limnAutoBlockIds = new Set())
             case 'DISMISSED':
                 return { state: 'none', reviewId: null };
             case 'APPROVED':
-                return { state: 'APPROVED', reviewId };
+                return { state: reviewId != null && limnAutoApproveIds.has(reviewId) ? 'LIMN_AUTO_APPROVED' : 'APPROVED', reviewId };
             case 'CHANGES_REQUESTED':
                 return {
                     state: reviewId != null && limnAutoBlockIds.has(reviewId) ? 'LIMN_AUTO_CHANGES_REQUESTED' : 'CHANGES_REQUESTED',
@@ -726,6 +738,14 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     // (Read for a REQUEST_CHANGES too: the gate must tell Limn's own standing block from a person's.)
     const limnBlockIds = !facts.authorIsMe ? await loadLimnAutoBlockIds(ctx, accountId, prId, reviewId) : new Set();
     const mayLift = noBlocker && unjudgedBlockers.length === 0 && limnBlockIds.size > 0;
+    // WITHDRAWING LIMN'S OWN APPROVAL (./approval-withdraw.ts): a run at a NEW head that does not
+    // approve (whatever the auto-verdict switch says now) dismisses Limn's earlier AUTOMATIC approval
+    // that still stands, BEFORE it posts. A DB pre-check first, so an ordinary run reads nothing more.
+    const runApproves = autoVerdictFor(runVerdict, allFindings, rules.approveLeftovers) === 'APPROVE';
+    const limnApprovals = !facts.authorIsMe
+        ? await loadLimnAutoApprovals(ctx, accountId, prId, reviewId)
+        : new Map();
+    const mayWithdraw = !runApproves && [...limnApprovals.values()].some((x) => x.headSha !== review.headSha && x.withdrawal == null);
     // LIFTING A TEAMMATE'S LIMN BLOCK (./teammate-lift.ts): the DB pre-check first (both opt-ins, every
     // point behind the block settled), so an ordinary run costs no extra GitHub read.
     let readerLogin = null;
@@ -754,6 +774,7 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         (wanted == null || wanted === 'COMMENT') &&
         !mayLift &&
         !mayLiftTeammate &&
+        !mayWithdraw &&
         !commentReasonToPost) {
         return skip(...nothingReason());
     }
@@ -786,14 +807,14 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     let standing = { state: 'unreadable', reviewId: null };
     // A teammate block still standing LIVE, with Limn's marker and the consent in its live body.
     let teammateLifts = [];
-    if (!facts.authorIsMe && ((wantsVerdict && !impactHeld) || mayLift || mayLiftTeammate)) {
+    if (!facts.authorIsMe && ((wantsVerdict && !impactHeld) || mayLift || mayLiftTeammate || mayWithdraw)) {
         try {
             const [login, reviews] = await Promise.all([
                 deps.accountLogin(accountId),
                 deps.liveReviews(pctx.owner, pctx.name, pctx.prNumber),
             ]);
             readerLogin = login;
-            standing = ownStandingReview(reviews, login, limnBlockIds);
+            standing = ownStandingReview(reviews, login, limnBlockIds, new Set(limnApprovals.keys()));
             teammateLifts = teammateCandidates.filter((c) => liveLiftCheck(reviews, c, login) == null);
         }
         catch (err) {
@@ -834,9 +855,16 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
     // Limn's own automatic request for changes still stands, this run has no blocker and none behind
     // the block is left unjudged: lift it — superseded by the APPROVE this run sends, else dismissed.
     const liftId = noBlocker && !blockersRemain && standing.state === 'LIMN_AUTO_CHANGES_REQUESTED' ? standing.reviewId : null;
+    // Limn's own automatic approval of an OLDER head still stands and this run does not approve:
+    // withdraw it — unless the push path (or an earlier attempt) already claimed it.
+    const standingApproval = standing.state === 'LIMN_AUTO_APPROVED' && standing.reviewId != null ? limnApprovals.get(standing.reviewId) : undefined;
+    const withdrawFrom = !runApproves && standingApproval != null && standingApproval.headSha !== review.headSha && standingApproval.withdrawal == null
+        ? standingApproval
+        : null;
     if (picked.toPost.length === 0 &&
         (verdict?.submitted ?? 'COMMENT') === 'COMMENT' &&
         liftId == null &&
+        withdrawFrom == null &&
         !reasonOnly &&
         teammateLifts.length === 0) {
         return skip(...nothingReason());
@@ -881,6 +909,25 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         first = null;
     }
     const pairFirst = first;
+    // WITHDRAW LIMN'S OWN APPROVAL FIRST (claimed on the approving run, then dismissed, never retried),
+    // so the review below never sits under a stale approval.
+    let withdrew = false;
+    if (withdrawFrom != null) {
+        const message = withdrawMessageForRun(blockerWarningCounts(allFindings), review.headSha);
+        const w = await withdrawApproval(ctx, { accountId, prId, approval: withdrawFrom, why: 'run', headSha: review.headSha, message, byReviewId: reviewId }, (id, msg) => deps.dismissReview
+            ? deps.dismissReview(accountId, pctx.owner, pctx.name, pctx.prNumber, id, msg)
+            : Promise.resolve({ ok: false, message: 'Dismissing is not available.' }));
+        // null = the push path (or an earlier attempt) has it: nothing more to do here.
+        if (w != null) {
+            withdrew = w.status === 'withdrawn';
+            record.withdrewApproval = {
+                reviewId: withdrawFrom.githubReviewId,
+                how: withdrew ? 'withdrawn' : 'withdraw_failed',
+                message,
+                error: w.error,
+            };
+        }
+    }
     // The earlier Limn findings on GitHub this review judged, for the marker's `j=` (DB only, never throws).
     const judged = await loadJudgedForPost(ctx, accountId, prId, pairFirst != null ? [pairFirst, review] : [review]);
     // THE PAIR'S ONE REVIEW (pair-consolidate.ts): its summary, and who raised each kept finding. A pair
@@ -1059,28 +1106,38 @@ async function autoPostReview(ctx, { accountId, prId, reviewId, pairFirstReviewI
         if (lifted.length > 0)
             record.liftedTeammateBlocks = lifted;
     }
-    // A run whose only write was the lift: posted when it took, failed (GitHub's words) when not.
+    // A run whose only write was the lift or the withdrawal: posted when it took, failed (GitHub's
+    // words) when not. A withdrawal the push path had already claimed left nothing to do: skipped.
     const liftOnly = !sendsReview;
+    const otherWriteOk = dismissed || withdrew;
+    const nothingDone = liftOnly && liftId == null && record.withdrewApproval == null && teammateLifts.length === 0;
     const final = {
         ...record,
-        status: liftOnly
-            ? dismissed
-                ? 'posted'
-                : 'failed'
-            : !landed
-                ? 'failed'
-                : errors.length > 0
-                    ? 'partial'
-                    : 'posted',
+        status: nothingDone
+            ? 'skipped'
+            : liftOnly
+                ? otherWriteOk
+                    ? 'posted'
+                    : 'failed'
+                : !landed
+                    ? 'failed'
+                    : errors.length > 0
+                        ? 'partial'
+                        : 'posted',
+        ...(nothingDone ? { reason: nothingReason()[0] } : {}),
         at: nowIso(),
-        error: liftOnly ? (dismissed ? null : (record.liftedBlock?.error ?? null)) : (errors[0] ?? null),
+        error: liftOnly
+            ? otherWriteOk || nothingDone
+                ? null
+                : (record.liftedBlock?.error ?? record.withdrewApproval?.error ?? null)
+            : (errors[0] ?? null),
         postedFindingIds: [...posted],
     };
     await writeRecord(ctx, reviewId, final).catch((err) => ctx.log.warn(`auto post review ${reviewId}: could not record the result: ${errText(err)}`));
     if (pairFirst != null) {
         await writeRecord(ctx, pairFirst.id, { ...final, viaPairReviewId: reviewId }).catch((err) => ctx.log.warn(`auto post review ${pairFirst.id}: could not record the result: ${errText(err)}`));
     }
-    if (landed || dismissed) {
+    if (landed || dismissed || withdrew) {
         await deps.settle({ accountId, prId, log: ctx.log }).catch(() => ({ visible: false }));
     }
     return { kind: 'done', record: final };

package/dist/review/claude-review/auto-settings.js

@@ -55,6 +55,11 @@ import { onOff, writeSettingEvent } from '../../db/setting-event-write.js';
 // teammates' Limn skips it (team-claim.ts)? ⚠ ON BY DEFAULT since 2026-11-02 (migration 0159 switched
 // every workspace on) — only a stored false is off, in every reader and in the writer.
 //
+// WITHDRAWING LIMN'S APPROVAL ON A PUSH rides the same route as one more column,
+// `withdraw_approval_on_push` (migration 0165): when a PR's head moves off the commit Limn's OWN
+// automatic approval was given on, dismiss it (./approval-withdraw.ts). ⚠ ON BY DEFAULT — only a
+// stored false is off, in every reader and in the writer.
+//
 // AUTOMATIC DESIGN DIAGRAMS ride the same route as one more column, `auto_diagrams_enabled`
 // (migration 0126): may a succeeded review (MANUAL OR AUTO) queue its design diagrams
 // (review/diagrams/trigger.ts)? ⚠ ON BY DEFAULT — only a stored false is off, in every reader and
@@ -187,6 +192,8 @@ export function autoReviewOf(row) {
         autoFix: resolveAutoFixSettings(row?.autoFixSettings),
         // ON unless explicitly switched off (0159).
         teamClaimsEnabled: row?.teamClaimsEnabled !== false,
+        // ON unless explicitly switched off (0165).
+        withdrawApprovalOnPush: row?.withdrawApprovalOnPush !== false,
     };
 }
 /**
@@ -287,6 +294,7 @@ const autoCols = (w) => ({
     autoFixEnabled: w.autoFixEnabled,
     autoDiagramsEnabled: w.autoDiagramsEnabled,
     ...(w.teamClaimsEnabled ? { teamClaimsEnabled: w.teamClaimsEnabled } : {}),
+    ...(w.withdrawApprovalOnPush ? { withdrawApprovalOnPush: w.withdrawApprovalOnPush } : {}),
     dailyCap: w.autoReviewDailyCap,
     autoPostEnabled: w.autoPostEnabled,
     autoPostSettings: w.autoPostSettings,
@@ -323,7 +331,7 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     const existing = rows[0];
     if (!existing)
         return null;
-    const { enabled, autoFixEnabled, autoDiagramsEnabled, teamClaimsEnabled, dailyCap, autoPost, autoFix, autoReviewProviders, pairStrictness, } = change;
+    const { enabled, autoFixEnabled, autoDiagramsEnabled, teamClaimsEnabled, withdrawApprovalOnPush, dailyCap, autoPost, autoFix, autoReviewProviders, pairStrictness, } = change;
     const wasOn = existing.enabled === true && toMs(existing.enabledAt) != null;
     let review;
     if (enabled === undefined || (enabled && wasOn))
@@ -349,6 +357,9 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     // Only a stored false is off (ON by default, 0159).
     const claimsWas = existing.teamClaimsEnabled !== false;
     const claims = teamClaimsEnabled ?? claimsWas;
+    // Only a stored false is off (ON by default, 0165).
+    const withdrawWas = existing.withdrawApprovalOnPush !== false;
+    const withdraw = withdrawApprovalOnPush ?? withdrawWas;
     const capOverride = dailyCap === undefined ? existing.dailyCap : dailyCap === AUTO_REVIEW_DAILY_CAP ? null : dailyCap;
     // Auto-posting: each field optional; a kind left out keeps its stored value.
     const postBefore = resolveAutoPostSettings(existing.autoPostEnabled, existing.autoPostSettings, existing.approveLeftovers);
@@ -403,6 +414,7 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
         autoFixEnabled: fix,
         autoDiagramsEnabled: diagrams,
         teamClaimsEnabled: claims,
+        withdrawApprovalOnPush: withdraw,
         dailyCap: capOverride,
         autoPostEnabled: postAfter.enabled,
         autoPostSettings: postOverrides,
@@ -422,6 +434,9 @@ export async function setWorkspaceAutoReview(ctx, accountId, workspaceId, change
     if (teamClaimsEnabled !== undefined && teamClaimsEnabled !== claimsWas) {
         set.teamClaimsEnabled = teamClaimsEnabled;
     }
+    if (withdrawApprovalOnPush !== undefined && withdrawApprovalOnPush !== withdrawWas) {
+        set.withdrawApprovalOnPush = withdrawApprovalOnPush;
+    }
     if (dailyCap !== undefined && capOverride !== existing.dailyCap) {
         set.autoReviewDailyCap = capOverride;
     }
@@ -479,6 +494,9 @@ function settingChanges(set, existing, next) {
     if ('teamClaimsEnabled' in set) {
         out.push(['auto_review', `Mark auto reviews on GitHub ${onOff(next.teamClaimsEnabled === true)}`]);
     }
+    if ('withdrawApprovalOnPush' in set) {
+        out.push(['auto_post', `Withdraw Limn's approval when new commits are pushed ${onOff(next.withdrawApprovalOnPush !== false)}`]);
+    }
     if ('autoFixEnabled' in set)
         out.push(['auto_fix', `Auto fix ${onOff(next.autoFixEnabled === true)}`]);
     if ('autoFixSettings' in set) {
@@ -655,6 +673,7 @@ export function registerAutoReviewSettingsRoutes(app, ctx) {
                     autoFixEnabled: { type: 'boolean' },
                     autoDiagramsEnabled: { type: 'boolean' },
                     teamClaimsEnabled: { type: 'boolean' },
+                    withdrawApprovalOnPush: { type: 'boolean' },
                     autoReviewProviders: { type: 'string', enum: ['default', 'both'] },
                     pairStrictness: { type: 'string', enum: ['strict', 'relaxed'] },
                     // An integer 1..500; anything else (a fraction, a string, out of range) is a 400.
@@ -734,6 +753,10 @@ export function registerAutoReviewSettingsRoutes(app, ctx) {
                 reply.status(400);
                 return reply.send({ error: 'BadRequest', message: 'autoFix switches must be true or false' });
             }
+            if (notBool(raw, 'withdrawApprovalOnPush')) {
+                reply.status(400);
+                return reply.send({ error: 'BadRequest', message: 'withdrawApprovalOnPush must be true or false' });
+            }
             if ('dailyCap' in raw && typeof raw.dailyCap !== 'number') {
                 reply.status(400);
                 return reply.send({

package/dist/review/claude-review/auto-verdict.js

@@ -39,6 +39,14 @@ export function leftoverAllowed(sev, leftovers) {
 // ⚠ Everything except a READER'S ignore counts — a re-raise the server left out because its comment
 // is already on this commit is still an open issue (`isReaderIgnoredFinding`).
 const countedOf = (findings) => findings.filter((f) => f.story == null && !isReaderIgnoredFinding(f));
+/** How many blockers and warnings a run's verdict counts (the same findings `autoVerdictFor` reads). */
+export function blockerWarningCounts(findings) {
+    const counted = countedOf(findings);
+    return {
+        blockers: counted.filter((f) => f.severity === 'blocker').length,
+        warnings: counted.filter((f) => f.severity === 'warning').length,
+    };
+}
 /**
  * The verdict an auto post wants — the model's, made STRICTER. Counts the run's non-story findings a
  * reader did not ignore (whatever the kind toggles say): any blocker ⇒ REQUEST_CHANGES; APPROVE only

package/dist/review/claude-review/persist.js

@@ -91,6 +91,8 @@ export function autoPostWireOf(v) {
         ...(typeof r.viaPairReviewId === 'number' ? { viaPairReviewId: r.viaPairReviewId } : {}),
         ...(typeof r.reasonPosted === 'string' && r.reasonPosted !== '' ? { reasonPosted: true } : {}),
         ...(r.reasonOnly === true ? { reasonOnly: true } : {}),
+        ...(r.approvalWithdrawal != null && typeof r.approvalWithdrawal === 'object' ? { approvalWithdrawal: r.approvalWithdrawal } : {}),
+        ...(r.withdrewApproval != null && typeof r.withdrewApproval === 'object' ? { withdrewApproval: r.withdrewApproval } : {}),
     };
 }
 // A stored CI record, or null for an older row / anything malformed (never a guessed shape).