pi-pr-review 1.17.7 → 1.17.9

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.17.9](https://github.com/10ego/pi-pr-review/compare/v1.17.8...v1.17.9) (2026-09-02)
+
+
+### Bug Fixes
+
+* **review:** publish omitted lane candidates ([#140](https://github.com/10ego/pi-pr-review/issues/140)) ([846c85a](https://github.com/10ego/pi-pr-review/commit/846c85a38a0b2f54becef74c5e35b11487701963))
+
+## [1.17.8](https://github.com/10ego/pi-pr-review/compare/v1.17.7...v1.17.8) (2026-09-01)
+
+
+### Bug Fixes
+
+* **review:** publish retained incomplete findings ([#138](https://github.com/10ego/pi-pr-review/issues/138)) ([586205b](https://github.com/10ego/pi-pr-review/commit/586205bbe46b50e04f00d53d43b3c353c3bea95e))
+
 ## [1.17.7](https://github.com/10ego/pi-pr-review/compare/v1.17.6...v1.17.7) (2026-09-01)
 
 

package/README.md

@@ -195,7 +195,7 @@ Every invocation has a host-owned monotonic 15-minute hard cap, including the tw
 
 A timed-out or retryable quota/rate-limit/capacity lane may start at most one configured fallback attempt. It starts only when at least `minimumFallbackMs` plus cleanup reserve remains; the host never changes the configured model, thinking level, or tool policy to save time. If a tier is unset, its existing nearest-configured-tier/Pi-default behavior is unchanged.
 
-On an attempt deadline the host records timeout separately from user cancellation, sends TERM to the original child, waits only `terminationGraceMs`, then sends KILL if no exit was observed and stops draining after the cleanup reserve. Partial assistant text and telemetry survive this lifecycle. The synthesis cap arms only once review work goes quiet: any turn that starts or any review tool that runs again while the cap is armed defers it, and it re-arms from the next turn end, so early review-tool turns (for example verification discovery) cannot starve later heavy lanes. Batch/total expiry stops queued work and waiting lanes; completed and partial artifacts proceed to Markdown synthesis or deterministic lane assembly, identify every incomplete reviewer, and remain eligible for concise `COMMENT` publication. Complete contract-valid candidate blocks retained before a timeout are deterministically recovered as canonical findings, including when terminal synthesis is absent; a truncated final block and arbitrary lane prose remain private. A timed-out lane is never reported as `NO FINDINGS` or full coverage, and a lane ended by the host total or synthesis deadline is disclosed with that kind (`deadline_expired`) instead of being mistaken for its own attempt deadline expiring. Host lane artifacts are authoritative for completeness in both directions: a false assistant completion claim cannot upgrade incomplete lanes, and a paraphrased or omitted `Lane completeness` line cannot downgrade a host-complete batch away from the concise renderer.
+On an attempt deadline the host records timeout separately from user cancellation, sends TERM to the original child, waits only `terminationGraceMs`, then sends KILL if no exit was observed and stops draining after the cleanup reserve. Partial assistant text and telemetry survive this lifecycle. The synthesis cap arms only once review work goes quiet: any turn that starts or any review tool that runs again while the cap is armed defers it, and it re-arms from the next turn end, so early review-tool turns (for example verification discovery) cannot starve later heavy lanes. Batch/total expiry stops queued work and waiting lanes; completed and partial artifacts proceed to Markdown synthesis or deterministic lane assembly, identify every incomplete reviewer, and remain eligible for concise `COMMENT` publication. Complete contract-valid candidate blocks retained before a timeout are deterministically recovered as canonical findings from the terminal lane output and retained primary/fallback attempt history, including conventional YAML-list field indentation and cases where a later attempt or terminal synthesis is empty or malformed. A recovered lane candidate omitted by terminal synthesis keeps its priority and inline eligibility and carries an explicit recommendation that readers validate it independently. Host-recorded attempt ordinals—not array position—define chronology; duplicate ordinals disable history recovery, a later exact clean contract supersedes older provisional findings, and truncated blocks or arbitrary lane prose remain private. A timed-out lane is never reported as `NO FINDINGS` or full coverage, and a lane ended by the host total or synthesis deadline is disclosed with that kind (`deadline_expired`) instead of being mistaken for its own attempt deadline expiring. Host lane artifacts are authoritative for completeness in both directions: a false assistant completion claim cannot upgrade incomplete lanes, and a paraphrased or omitted `Lane completeness` line cannot downgrade a host-complete batch away from the concise renderer.
 
 Initial operating targets are ordinary-review p50 ≤ 6 minutes and p95 ≤ 12 minutes, and large-review p50 ≤ 10 minutes and p95 ≤ 14 minutes, with the 15-minute hard cap authoritative. Invocation telemetry starts before GitHub preflight and records configured deadline source/caps, termination grace, cleanup reserve, and active wall time; batch details record invocation time consumed before each attempt, batch/total time remaining at dispatch, first event/output timing, lifecycle counts, configured and effective batch-truncated attempt deadlines, fallback starts/budget rejections, external total/synthesis deadline expiries per lane, and termination grace/escalation data. These are initial production targets, not a promise that every provider completes before its host deadline.
 
@@ -231,7 +231,7 @@ Review semantics are Markdown-first. A deterministic tolerant parser normalizes
 
 You can publish the cache later with `/pr-review-publish 123`, or directly ask the agent to “post the inline review,” “manually post the review comments,” “post it as an inline review,” or “publish the review for PR #123.” The extension handles that request directly before an agent turn. `/pr-review-publish` and a matching direct request publish only the cache; they never start or rerun review agents. Unnumbered direct requests select the latest cached review for the current repository. Only fresh interactive/RPC input can use the direct path.
 
-Every authorized publish path builds one GitHub review payload and sends at most one review `POST`; it never submits `REQUEST_CHANGES` or retries a rejected write with a fallback POST. Fully parsed Markdown with one complete retained artifact for every host-registered dispatch may emit a gated `APPROVE` through the same host binding, priority, lifecycle, self-author, and stale checks as strict JSON. Host lane evidence is authoritative for completeness: a paraphrased or omitted `All requested lanes completed.` disclosure cannot downgrade a host-complete batch, and a false disclosure cannot upgrade incomplete or missing lane coverage; the assistant's canonical line is consulted only when no batch evidence exists. Verdict fields outside the document preamble, hidden in CommonMark code/HTML blocks, or inside lazy container continuations, severity-tagged headings outside `Findings`, incomplete or missing host lane coverage, malformed or unsafe output, and lane-fallback artifacts remain `COMMENT` reviews; their safely parsed findings keep inline placement, while unparsable output publishes body-only. Cache restore reclassifies persisted lane output and requires the exact host-recorded artifact key set, with every complete artifact matching the frozen invocation generation, tier, and minor-hygiene contract, and re-synthesizes the retained raw text under that frozen binding before retaining approval eligibility. For a current, open PR, the first 50 eligible P0–P3 findings with valid, unique diff anchors are inline. The concise top-level body starts with the verdict, points readers to inline findings, and places nits, off-diff findings, unavailable diff metadata, duplicate anchors, and overflow under `Other Notes`; overview, verification, strengths, completion warnings, and transport diagnostics stay out of the public summary. The complete original Markdown and retained lane evidence remain internal and are never substituted for a concise GitHub review, including degraded, incomplete, cached, direct, and stale `COMMENT` publication. If the concise body plus its canonical marker exceeds GitHub's limit, publication fails closed rather than dumping the full report. Stale or authorized non-open reviews are body-only. A stale approval additionally requires `allowStaleApprovals: true`.
+Every authorized publish path builds one GitHub review payload and sends at most one review `POST`; it never submits `REQUEST_CHANGES` or retries a rejected write with a fallback POST. Fully parsed Markdown with one complete retained artifact for every host-registered dispatch may emit a gated `APPROVE` through the same host binding, priority, lifecycle, self-author, and stale checks as strict JSON. Host lane evidence is authoritative for completeness: a paraphrased or omitted `All requested lanes completed.` disclosure cannot downgrade a host-complete batch, and a false disclosure cannot upgrade incomplete or missing lane coverage; the assistant's canonical line is consulted only when no batch evidence exists. Verdict fields outside the document preamble, hidden in CommonMark code/HTML blocks, or inside lazy container continuations, severity-tagged headings outside `Findings`, incomplete or missing host lane coverage, malformed or unsafe output, and lane-fallback artifacts remain `COMMENT` reviews; their safely parsed findings keep inline placement, while unparsable output publishes body-only. Cache restore reclassifies persisted lane output and requires the exact host-recorded artifact key set, with every complete artifact matching the frozen invocation generation, tier, and minor-hygiene contract, and re-synthesizes the retained raw text under that frozen binding before retaining approval eligibility. For a current, open PR, the first 50 eligible P0–P3 findings with valid, unique diff anchors are inline. The concise top-level body starts with the verdict, points readers to inline findings, and places nits, off-diff findings, unavailable diff metadata, duplicate anchors, and overflow under `Other Notes`; overview, verification, strengths, completion warnings, and transport diagnostics stay out of the public summary. Incomplete/degraded reviews publish whenever synthesis, retained attempts, or validated extraction produced at least one canonical finding. Complete host-validated lane candidates omitted by synthesis retain normal priority markers and inline placement with an explicit independent-validation advisory rather than disappearing. If none did, the completed record remains available privately and GitHub publication is skipped rather than creating a verdict-only review. The complete original Markdown and retained lane evidence remain internal and are never substituted for a concise GitHub review, including degraded, incomplete, cached, direct, and stale `COMMENT` publication. If the concise body plus its canonical marker exceeds GitHub's limit, publication fails closed rather than dumping the full report. Stale or authorized non-open reviews are body-only. A stale approval additionally requires `allowStaleApprovals: true`.
 
 All publication paths apply host-enforced safety gates: captured posting authority, repository and requested-PR binding, reviewed/current-head and stale policy, bounded bodies and payloads, draft and lifecycle checks, non-open authorization, authenticated-identity same-head duplicate detection, and a final head check. Fully or partially parsed review paths additionally enforce safe inline locations, including degraded incomplete-lane reviews whose findings still parse. Raw and lane-assembled fallbacks without parsed findings are body-only; every degraded path is `COMMENT`-only, and assistant text cannot select event, commit, repository, hostname, API path, or inline anchors. Unknown or invalid host states fail closed before a write.
 

package/extensions/pr-review-subagent.ts

@@ -490,7 +490,7 @@ function getPiInvocation(args: string[]): { command: string; args: string[] } {
 	return { command: "pi", args };
 }
 
-const NONEMPTY_CONTRACT_DESCRIPTION = "After a successful terminal stop, nonempty output is exact Markdown with no wrapper: the first nonblank line must be exactly `Review status: COMPLETE` with no leading or trailing whitespace. If you could not inspect required evidence for any reason, return the top-level exact line `Review status: INCOMPLETE` followed by a concise reason; INCOMPLETE and every other status are partial. COMPLETE must be followed in exact order by meaningful one-line `Overview: ...`, `Strengths: ...`, and `Risk areas: ...` sections, then either the exact standalone `NO FINDINGS.` line or one or more complete candidate blocks. Nonblank contract lines have no trailing spaces or tabs. Framing may use plain labels, bold labels, or an ATX label followed immediately by exactly one top-level value line; do not use list-indented or quoted contract lines. Candidate fields are in exact order and each appears once: title prefixed [P0], [P1], [P2], [P3], or [nit] (the tag must match severity); severity P0/P1/P2/P3/nit; meaningful why; location as repo-relative/path:positive-line or repo-relative/path:positive-start-positive-end (ordered), or repo-wide; side RIGHT/LEFT; in_diff yes/no; pr_related yes/no; confidence 0.0-1.0. Candidate labels may be plain/bold or use exactly one top-level `- ` list marker; no other indentation or list marker is accepted. A why value may continue only on lines beginning with exactly two spaces plus a non-list character until the next reserved field. Scalar and continuation values must not contain status/field/severity/sentinel productions, code fences, HTML/container wrappers, blockquotes, lists, or code indentation. Do not emit code fences, blockquotes, JSON, HTML/container wrappers, duplicate/out-of-order fields, arbitrary prose, or placeholder values (none, n/a, unavailable, unknown, skipped, error, review complete). Status/refusal/access/tool/model/error reasons belong in an INCOMPLETE status; inability discussed inside a valid candidate why is allowed. COMPLETE is the primary completion attestation; only obvious exact failure placeholders are rejected as defense-in-depth."
+const NONEMPTY_CONTRACT_DESCRIPTION = "After a successful terminal stop, nonempty output is exact Markdown with no wrapper: the first nonblank line must be exactly `Review status: COMPLETE` with no leading or trailing whitespace. If you could not inspect required evidence for any reason, return the top-level exact line `Review status: INCOMPLETE` followed by a concise reason; INCOMPLETE and every other status are partial. COMPLETE must be followed in exact order by meaningful one-line `Overview: ...`, `Strengths: ...`, and `Risk areas: ...` sections, then either the exact standalone `NO FINDINGS.` line or one or more complete candidate blocks. Nonblank contract lines have no trailing spaces or tabs. Framing may use plain labels, bold labels, or an ATX label followed immediately by exactly one top-level value line; do not use list-indented or quoted contract lines. Candidate fields are in exact order and each appears once: title prefixed [P0], [P1], [P2], [P3], or [nit] (the tag must match severity); severity P0/P1/P2/P3/nit; meaningful why; location as repo-relative/path:positive-line or repo-relative/path:positive-start-positive-end (ordered), or repo-wide; side RIGHT/LEFT; in_diff yes/no; pr_related yes/no; confidence 0.0-1.0. Candidate labels may be plain/bold, repeat one top-level `- ` marker per field, or use conventional YAML-list form with `- title:` followed by fields indented exactly two spaces; no other indentation or list marker is accepted. A why value may continue only on lines beginning with exactly two spaces in top-level form or exactly four spaces in YAML-list form plus a non-list character until the next reserved field. Scalar and continuation values must not contain status/field/severity/sentinel productions, code fences, HTML/container wrappers, blockquotes, lists, or code indentation. Do not emit code fences, blockquotes, JSON, HTML/container wrappers, duplicate/out-of-order fields, arbitrary prose, or placeholder values (none, n/a, unavailable, unknown, skipped, error, review complete). Status/refusal/access/tool/model/error reasons belong in an INCOMPLETE status; inability discussed inside a valid candidate why is allowed. COMPLETE is the primary completion attestation; only obvious exact failure placeholders are rejected as defense-in-depth."
 
 type InternalExpectedOutput = "review_lane" | "nonempty" | "json_object";
 
@@ -554,7 +554,7 @@ function buildSubagentSystemPrompt(tier: Tier, majorOnly = false, minorHygiene =
 				"- confidence: a float 0.0-1.0",
 			]),
 			expectedOutput === "nonempty"
-				? "After the exact COMPLETE status and three framing sections, the clean sentinel is one top-level standalone uppercase line `NO FINDINGS.`; never use `No findings.` or append a sentence. Candidate fields are top-level or use exactly one `- ` marker, with no arbitrary indentation; candidate `why` may use exactly-two-space non-list continuation lines, but never absorb a reserved field, status, sentinel, or wrapper."
+				? "After the exact COMPLETE status and three framing sections, the clean sentinel is one top-level standalone uppercase line `NO FINDINGS.`; never use `No findings.` or append a sentence. Candidate fields may be top-level, repeat one `- ` marker per field, or use conventional YAML-list form with `- title:` followed by exactly-two-space-indented fields; candidate `why` continuations use two spaces in top-level form or four in YAML-list form and may never absorb a reserved field, status, sentinel, or wrapper."
 				: majorOnly
 					? "If there are no substantiated P0-P2 findings, reply exactly with: NO FINDINGS."
 					: "If there are genuinely no findings at any severity, reply exactly with: NO FINDINGS.",

package/extensions/review-table.ts

@@ -461,6 +461,14 @@ async function publishCompletedReview(
 	}
 	const degradedPublication = record.completeness === "incomplete" ||
 		(record.synthesisQuality !== undefined && record.synthesisQuality !== "fully_parsed");
+	const findings = Array.isArray(record.review.findings) ? record.review.findings : [];
+	if (degradedPublication && findings.length === 0) {
+		// A result-less degraded record remains cached for private diagnostics and a
+		// later rerun, but must not create a verdict-only GitHub review. Incomplete
+		// reviews with any validated synthesis/lane/extraction finding still publish.
+		ctx.ui.notify("PR review was not posted: the incomplete review retained no validated findings", "warning");
+		return undefined;
+	}
 	const result = await publishPullReview({
 		cwd: ctx.cwd,
 		prNumber: record.invocation.prNumber,
@@ -475,9 +483,6 @@ async function publishCompletedReview(
 		// inline findings. Retained raw synthesis and lane evidence remain private
 		// completion diagnostics, including for degraded/incomplete COMMENT runs.
 		// If the concise payload cannot fit, publication fails closed.
-		forceBodyOnly: record.synthesisQuality !== undefined &&
-			record.synthesisQuality !== "fully_parsed" &&
-			!(Array.isArray(record.review.findings) && record.review.findings.length > 0),
 		// A publication body identifies Markdown-derived or degraded synthesis.
 		// Enforce COMMENT again at the final publication boundary so restored
 		// canonical artifacts created by an older parser cannot inherit APPROVE.
@@ -1076,7 +1081,7 @@ export default function registerReviewTable(
 			}
 		}
 		const publishResult = await publishCompletedReview(pending.record, { kind: "frozen-invocation" }, ctx);
-		if (pending.extraction) {
+		if (pending.extraction && publishResult) {
 			try {
 				// `published` decorates exactly the attempt whose merged event it
 				// follows: the spread carries that attempt's identity, so tooling can

package/lib/pr-review-artifacts.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import type { ReviewDeadlineKind } from "./pr-review-deadlines.ts";
 
 export type ReviewLaneLifecycle = "complete" | "partial" | "timed_out" | "failed";
@@ -137,6 +138,9 @@ const CANDIDATE_SEVERITIES = new Set(["P0", "P1", "P2", "P3", "nit"]);
 const FRAMING_LABELS = ["Overview", "Strengths", "Risk areas"] as const;
 const PLACEHOLDER_ONLY = /^(?:none|n\/?a|na|unavailable|unknown|skipped|error|review complete|no findings|nothing to review)(?:\s+(?:identified|found|available|present))?[.!]?$/i;
 const NO_FINDINGS_SENTINEL = "NO FINDINGS.";
+const MAX_CANDIDATE_TITLE_BYTES = 1_024;
+const MAX_CANDIDATE_WHY_BYTES = 16 * 1_024;
+const MAX_CANDIDATE_PATH_BYTES = 4_096;
 const CODE_FENCE = /^ {0,3}(?:`{3,}|~{3,})/m;
 const COMMONMARK_HTML_BLOCK_TAGS = [
 	"address", "article", "aside", "base", "basefont", "blockquote", "body", "caption", "center", "col",
@@ -236,6 +240,21 @@ function candidateLabel(line: string): MarkdownLabel | undefined {
 	return { field: (match[1] ?? match[2] ?? match[3])!, value: match[4] ?? "", kind: "inline" };
 }
 
+type CandidateBlockStyle = "top-level" | "list-undecided" | "repeated-list" | "yaml-list";
+
+/** Parse top-level, repeated-list-marker, or conventional YAML-list fields. */
+function candidateBlockLabel(line: string, style: CandidateBlockStyle): MarkdownLabel | undefined {
+	if (style === "top-level") return line.startsWith("- ") ? undefined : candidateLabel(line);
+	if (style === "repeated-list") return line.startsWith("- ") ? candidateLabel(line) : undefined;
+	if (style === "list-undecided") return undefined;
+	// In conventional YAML form the title owns the list marker and subsequent
+	// fields use exactly two spaces with no nested marker. Broader indentation
+	// remains unavailable to arbitrary Markdown containers.
+	if (!/^ {2}\S/.test(line) || /^ {3}/.test(line)) return undefined;
+	const unindented = line.slice(2);
+	return unindented.startsWith("- ") ? undefined : candidateLabel(unindented);
+}
+
 function canonicalField(field: string): string {
 	return field.toLowerCase();
 }
@@ -285,7 +304,8 @@ function safeLocation(value: string): boolean {
 	const start = Number(match[2]);
 	const end = match[3] === undefined ? start : Number(match[3]);
 	if (!Number.isSafeInteger(start) || start < 1 || !Number.isSafeInteger(end) || end < start) return false;
-	if (!locationPath || locationPath.startsWith("/") || locationPath.startsWith("~") || /^[A-Za-z]:/.test(locationPath)) return false;
+	if (!locationPath || Buffer.byteLength(locationPath, "utf8") > MAX_CANDIDATE_PATH_BYTES ||
+		locationPath.startsWith("/") || locationPath.startsWith("~") || /^[A-Za-z]:/.test(locationPath)) return false;
 	if (/[\\\u0000-\u001f\u007f]/.test(locationPath)) return false;
 	const segments = locationPath.split("/");
 	return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment === segment.trim() && segment !== "." && segment !== ".." && !segment.includes(":"));
@@ -341,8 +361,9 @@ function validCandidateFields(fields: ReadonlyMap<string, string>): boolean {
 	const inDiff = fields.get("in_diff")!.trim();
 	const prRelated = fields.get("pr_related")!.trim();
 	return !!titleMatch && meaningfulValue(titleMatch[2]!) &&
+		Buffer.byteLength(title, "utf8") <= MAX_CANDIDATE_TITLE_BYTES &&
 		CANDIDATE_SEVERITIES.has(severity) && titleMatch[1] === severity &&
-		meaningfulValue(why) && safeLocation(location) &&
+		meaningfulValue(why) && Buffer.byteLength(why, "utf8") <= MAX_CANDIDATE_WHY_BYTES && safeLocation(location) &&
 		/^(?:RIGHT|LEFT)$/.test(side) &&
 		/^(?:yes|no)$/.test(inDiff) &&
 		/^(?:yes|no)$/.test(prRelated) &&
@@ -402,11 +423,18 @@ function parseCandidatePrefix(
 		if (cursor >= lines.length) return { candidates, consumedAll: true };
 		const start = cursor;
 		const fields = new Map<string, string>();
+		let style: CandidateBlockStyle = "top-level";
 		for (const expected of CANDIDATE_FIELDS) {
 			while (cursor < lines.length && !lines[cursor]!.trim()) cursor++;
 			const fieldLine = lines[cursor] ?? "";
 			if (fieldLine.trim() && /[ \t]+$/.test(fieldLine)) return { candidates, consumedAll: false };
-			const field = candidateLabel(fieldLine);
+			if (expected === "title" && fieldLine.startsWith("- ")) style = "list-undecided";
+			if (expected === "severity" && style === "list-undecided") {
+				style = fieldLine.startsWith("- ") ? "repeated-list" : "yaml-list";
+			}
+			const field = expected === "title"
+				? candidateLabel(fieldLine)
+				: candidateBlockLabel(fieldLine, style);
 			if (!field || canonicalField(field.field) !== expected || fields.has(expected)) {
 				return { candidates, consumedAll: false };
 			}
@@ -419,12 +447,20 @@ function parseCandidatePrefix(
 				const continuation = lines[cursor]!;
 				if (!continuation.trim()) break;
 				if (/[ \t]+$/.test(continuation)) return { candidates, consumedAll: false };
+				const nextField = candidateBlockLabel(continuation, style);
+				if (nextField && canonicalField(nextField.field) === "location") break;
 				if (isReservedContractLine(continuation)) break;
-				if (!/^ {2}\S/.test(continuation) || /^ {2}(?:[-*+>]|#{1,6})[ \t]+/.test(continuation)) {
+				const continuationIndent = style === "yaml-list" ? 4 : 2;
+				const prefix = " ".repeat(continuationIndent);
+				if (!continuation.startsWith(prefix) || continuation.startsWith(`${prefix} `) ||
+					new RegExp(`^ {${continuationIndent}}(?:[-*+>]|#{1,6})[ \\t]+`).test(continuation)) {
+					return { candidates, consumedAll: false };
+				}
+				const continuationValue = continuation.slice(continuationIndent);
+				if (continuationValue.startsWith("\t") || hasReservedCandidateProduction("why", continuationValue)) {
 					return { candidates, consumedAll: false };
 				}
-				if (hasReservedCandidateProduction("why", continuation.slice(2))) return { candidates, consumedAll: false };
-				whyLines.push(continuation.slice(2));
+				whyLines.push(continuationValue);
 				cursor++;
 			}
 			fields.set("why", whyLines.join("\n"));
@@ -480,6 +516,15 @@ function parseIntegratedCompletion(text: string): boolean {
  * output. A timed-out final block may be truncated; earlier complete blocks
  * remain usable, while arbitrary prose and unsafe containers recover nothing.
  */
+export function isValidatedReviewLaneNoFindings(
+	rawText: string,
+	expectedOutput: "review_lane" | "nonempty" = "review_lane",
+): boolean {
+	const text = normalizeReviewText(rawText);
+	if (expectedOutput === "review_lane") return /^NO FINDINGS\.?$/.test(text);
+	return parseIntegratedCompletion(text) && text.split("\n").some((line) => line === NO_FINDINGS_SENTINEL);
+}
+
 export function extractValidatedReviewLaneCandidates(
 	rawText: string,
 	expectedOutput: "review_lane" | "nonempty" = "review_lane",
@@ -559,8 +604,25 @@ function expectedLaneSections(input: ReviewLaneCompletionInput): boolean {
 	// missing final period carries no semantic uncertainty and must not amplify
 	// into expensive replacement passes. Integrated/deep `nonempty` output keeps
 	// its exact byte contract in parseIntegratedCompletion().
-	if (/^NO FINDINGS\.?$/.test(text)) return true;
-	return CANDIDATE_FIELDS.every((field) => hasMeaningfulField(text, field));
+	if (/^NO FINDINGS\.?$/.test(normalized)) return true;
+	return parseOrdinaryCandidateCompletion(normalized);
+}
+
+function parseOrdinaryCandidateCompletion(rawText: string): boolean {
+	const text = normalizeReviewText(rawText);
+	if (
+		!text.trim() || hasTrailingHorizontalWhitespace(text) || CODE_FENCE.test(text) ||
+		hasHtmlContainer(text) || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(text) ||
+		/<!--\s*pi-pr-review:/i.test(text)
+	) return false;
+	const lines = text.split("\n");
+	if (lines.some((line) => hasReservedStatusProduction(line) || line.trim() === NO_FINDINGS_SENTINEL || line.trim() === "NO FINDINGS")) {
+		return false;
+	}
+	let cursor = 0;
+	while (cursor < lines.length && !lines[cursor]!.trim()) cursor++;
+	const parsed = parseCandidatePrefix(lines, cursor);
+	return parsed.consumedAll && parsed.candidates.length > 0;
 }
 
 /** Process exit is necessary but insufficient: only a terminal stop with valid lane output is complete. */

package/lib/pr-review-markdown.ts

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import {
 	extractValidatedReviewLaneCandidates,
+	isValidatedReviewLaneNoFindings,
 	type ExpectedReviewLane,
 	type ReviewLaneArtifact,
 } from "./pr-review-artifacts.ts";
@@ -492,51 +493,98 @@ function retainedLaneText(lane: ReviewLaneArtifact): string {
 	return "";
 }
 
+function retainedLaneCandidateTexts(
+	lane: ReviewLaneArtifact,
+	contract: "review_lane" | "nonempty",
+): string[] {
+	const texts: string[] = [];
+	const seen = new Set<string>();
+	const retain = (value: string): "continue" | "stop" => {
+		if (!value.trim() || seen.has(value)) return "continue";
+		seen.add(value);
+		const text = value;
+		// A later exact clean contract supersedes provisional findings from older
+		// attempts. Malformed or empty later output does not.
+		if (isValidatedReviewLaneNoFindings(text, contract)) return "stop";
+		texts.push(text);
+		return "continue";
+	};
+	// The lane-level text is the latest authoritative output. Earlier attempts
+	// remain eligible only for independently contract-valid findings; malformed
+	// prose can neither become a finding nor poison a valid earlier attempt.
+	if (retain(lane.rawText) === "stop") return texts;
+	const ordinals = new Set<number>();
+	for (const attempt of lane.attempts) {
+		if (ordinals.has(attempt.ordinal)) return texts;
+		ordinals.add(attempt.ordinal);
+	}
+	const newestFirst = [...lane.attempts].sort((left, right) =>
+		left.ordinal === right.ordinal ? 0 : left.ordinal > right.ordinal ? -1 : 1);
+	for (const attempt of newestFirst) {
+		if (retain(attempt.rawText) === "stop") break;
+	}
+	return texts;
+}
+
 function retainedLaneFindings(
 	lanes: readonly ReviewLaneArtifact[],
 	expected: readonly ExpectedReviewLane[],
 ): ReviewFindingLike[] {
 	const findings: ReviewFindingLike[] = [];
-	const seen = new Set<string>();
+	const seen = new Map<string, number>();
 	for (const lane of lanes) {
 		const contract = expected.find((descriptor) => descriptor.key === lane.key)?.expectedOutput ?? "review_lane";
-		for (const candidate of extractValidatedReviewLaneCandidates(retainedLaneText(lane), contract)) {
-			if (!candidate.prRelated) continue;
-			const parsedLocation = candidate.location === "repo-wide"
-				? { status: "absent" as const, location: null }
-				: parseLocation(`${candidate.location} ${candidate.side}`);
-			if (parsedLocation.status === "unsafe") continue;
-			const codeLocation = parsedLocation.location
-				? { ...parsedLocation.location, commentable: candidate.inDiff }
-				: null;
-			const key = JSON.stringify([
-				candidate.severity,
-				candidate.title,
-				candidate.why,
-				candidate.location,
-				candidate.side,
-			]);
-			if (seen.has(key)) continue;
-			seen.add(key);
-			findings.push({
-				title: candidate.title,
-				severity: candidate.severity,
-				blocking: candidate.severity === "P0" || candidate.severity === "P1",
-				body: candidate.why,
-				confidence_score: candidate.confidence,
-				code_location: codeLocation,
-			});
+		for (const text of retainedLaneCandidateTexts(lane, contract)) {
+			for (const candidate of extractValidatedReviewLaneCandidates(text, contract)) {
+				if (!candidate.prRelated) continue;
+				const parsedLocation = candidate.location === "repo-wide"
+					? { status: "absent" as const, location: null }
+					: parseLocation(`${candidate.location} ${candidate.side}`);
+				if (parsedLocation.status === "unsafe") continue;
+				const codeLocation = parsedLocation.location
+					? { ...parsedLocation.location, commentable: candidate.inDiff }
+					: null;
+				const key = JSON.stringify([
+					candidate.severity,
+					candidate.title,
+					candidate.why,
+					candidate.location,
+					candidate.side,
+				]);
+				const duplicateIndex = seen.get(key);
+				if (duplicateIndex !== undefined) {
+					const existing = findings[duplicateIndex];
+					if (candidate.inDiff && existing?.code_location && !existing.code_location.commentable) {
+						findings[duplicateIndex] = {
+							...existing,
+							code_location: { ...existing.code_location, commentable: true },
+						};
+					}
+					continue;
+				}
+				seen.set(key, findings.length);
+				findings.push({
+					title: candidate.title,
+					severity: candidate.severity,
+					blocking: candidate.severity === "P0" || candidate.severity === "P1",
+					body: candidate.why,
+					confidence_score: candidate.confidence,
+					code_location: codeLocation,
+				});
+			}
 		}
 	}
 	return findings;
 }
 
+const INDEPENDENT_VALIDATION_ADVISORY = "_Recommend validating this comment independently._";
+
 function mergeUniqueFindings(
 	primary: readonly ReviewFindingLike[],
 	additional: readonly ReviewFindingLike[],
 ): ReviewFindingLike[] {
 	const merged = [...primary];
-	const keys = new Set(merged.map((finding) => JSON.stringify([
+	const findingKey = (finding: ReviewFindingLike) => JSON.stringify([
 		finding.severity,
 		finding.title,
 		finding.body,
@@ -544,20 +592,30 @@ function mergeUniqueFindings(
 		finding.code_location?.line_range?.start,
 		finding.code_location?.line_range?.end,
 		finding.code_location?.side,
-	])));
+	]);
+	const keys = new Map(merged.map((finding, index) => [findingKey(finding), index]));
 	for (const finding of additional) {
-		const key = JSON.stringify([
-			finding.severity,
-			finding.title,
-			finding.body,
-			finding.code_location?.absolute_file_path,
-			finding.code_location?.line_range?.start,
-			finding.code_location?.line_range?.end,
-			finding.code_location?.side,
-		]);
-		if (keys.has(key)) continue;
-		keys.add(key);
-		merged.push(finding);
+		const key = findingKey(finding);
+		const duplicateIndex = keys.get(key);
+		if (duplicateIndex !== undefined) {
+			const existing = merged[duplicateIndex];
+			if (finding.code_location?.commentable && existing?.code_location && !existing.code_location.commentable) {
+				merged[duplicateIndex] = {
+					...existing,
+					code_location: { ...existing.code_location, commentable: true },
+				};
+			}
+			continue;
+		}
+		keys.set(key, merged.length);
+		// These are complete, host-validated lane candidate blocks, but the
+		// terminal synthesizer did not independently confirm them. Keep their
+		// normal severity and inline eligibility while making that provenance
+		// explicit to the reader.
+		merged.push({
+			...finding,
+			body: `${finding.body?.trim() ?? ""}\n\n${INDEPENDENT_VALIDATION_ADVISORY}`.trim(),
+		});
 	}
 	return merged;
 }
@@ -789,10 +847,12 @@ export function synthesizeReviewArtifact(input: {
 			batchEvidence ? lanes.every((lane) => lane.lifecycle === "complete") && (expectedLaneCount === 0 || exactLaneCoverage) : true,
 		);
 		const safe = publicationSafeStrictReview(input.strictJsonReview);
-		const bodyFallback = !safe || completeness === "incomplete";
+		const recoveredOverridesSkip = input.strictJsonReview.disposition === "skipped" &&
+			validatedLaneFindings.length > 0;
+		const bodyFallback = !safe || completeness === "incomplete" || recoveredOverridesSkip;
 		const strictFindings = mergeUniqueFindings(
-			safe ? (input.strictJsonReview.findings ?? []) : [],
-			bodyFallback ? validatedLaneFindings : [],
+			safe && !recoveredOverridesSkip ? (input.strictJsonReview.findings ?? []) : [],
+			validatedLaneFindings,
 		);
 		const body = bodyFallback
 			? buildDegradedReviewBody({
@@ -801,9 +861,11 @@ export function synthesizeReviewArtifact(input: {
 				findings: strictFindings,
 				expectedLaneCount,
 				exactCoverage: exactLaneCoverage || expectedLaneCount === 0,
-				reason: safe
-						? "incomplete lane evidence degraded this synthesis"
-						: "publication-invalid extracted content degraded this synthesis",
+				reason: recoveredOverridesSkip
+						? "retained lane findings overrode a skipped model synthesis"
+						: safe
+							? "incomplete lane evidence degraded this synthesis"
+							: "publication-invalid extracted content degraded this synthesis",
 			})
 			: "";
 		return Object.freeze({
@@ -814,10 +876,21 @@ export function synthesizeReviewArtifact(input: {
 			// Rebind every target field to the frozen host snapshot so an assistant
 			// cannot substitute the final head and bypass stale-head handling.
 			review: bodyFallback
-				? syntheticReview(input.prNumber, input.prTitle, input.headSha, body, strictFindings)
+				? input.strictJsonReview.disposition === "skipped" && !recoveredOverridesSkip
+					? {
+							...input.strictJsonReview,
+							pr: { number: input.prNumber, title: input.prTitle, head_sha: input.headSha },
+						}
+					: syntheticReview(input.prNumber, input.prTitle, input.headSha, body, strictFindings)
 				: {
 						...input.strictJsonReview,
 						pr: { number: input.prNumber, title: input.prTitle, head_sha: input.headSha },
+						// A model-level skip cannot suppress complete host-retained findings.
+						disposition: validatedLaneFindings.length > 0 ? "reviewed" : input.strictJsonReview.disposition,
+						findings: strictFindings,
+						...(strictFindings.some((finding) => finding.severity === "P0" || finding.severity === "P1")
+							? { verdict: "request_changes", overall_correctness: "patch is incorrect" }
+							: {}),
 					},
 			laneArtifacts: lanes,
 			expectedLaneDescriptors,
@@ -825,21 +898,24 @@ export function synthesizeReviewArtifact(input: {
 			completeness,
 			mergeApprovalEligible: !bodyFallback,
 			diagnostics: Object.freeze(bodyFallback
-				? [safe
-					? "incomplete lane evidence degraded this synthesis"
-					: "publication-invalid extracted content degraded this synthesis"]
+				? [recoveredOverridesSkip
+					? "retained lane findings overrode a skipped model synthesis"
+					: safe
+						? "incomplete lane evidence degraded this synthesis"
+						: "publication-invalid extracted content degraded this synthesis"]
 				: []),
 		});
 	}
 	const raw = input.rawText.trim().replace(/\r\n?/g, "\n");
 	if (!raw) {
 		const completeness = synthesisCompleteness(input.rawText, lanes);
+		const recoveredLaneFindings = mergeUniqueFindings([], validatedLaneFindings);
 		// Retained lane output is bounded by the host-owned body cap so an early
 		// large lane cannot truncate away the coverage disclosure above it.
 		const body = buildDegradedReviewBody({
 			rawText: "",
 			lanes,
-			findings: validatedLaneFindings,
+			findings: recoveredLaneFindings,
 			expectedLaneCount,
 			exactCoverage: exactLaneCoverage,
 			reason: "terminal synthesis was absent",
@@ -848,7 +924,7 @@ export function synthesizeReviewArtifact(input: {
 			quality: "lane_fallback" as const,
 			rawText: input.rawText,
 			body,
-			review: syntheticReview(input.prNumber, input.prTitle, input.headSha, body, validatedLaneFindings),
+			review: syntheticReview(input.prNumber, input.prTitle, input.headSha, body, recoveredLaneFindings),
 			laneArtifacts: lanes,
 			expectedLaneDescriptors,
 			expectedLaneCount,
@@ -898,7 +974,10 @@ export function synthesizeReviewArtifact(input: {
 			? "fully_parsed"
 			: canonicalParsed.findings.length > 0 ? "partially_parsed" : "raw";
 	const parsedSynthesisFindings = canonicalParsed.unsafe ? [] : canonicalParsed.findings;
-	const recoveredLaneFindings = quality === "fully_parsed" ? [] : validatedLaneFindings;
+	// Terminal semantic validation may confirm a candidate, but it may not erase
+	// a complete host-validated lane block. Omitted candidates retain ordinary
+	// finding behavior with an explicit independent-validation advisory.
+	const recoveredLaneFindings = validatedLaneFindings;
 	const safeFindings = mergeUniqueFindings(parsedSynthesisFindings, recoveredLaneFindings);
 	const degradationReasons = (() => {
 		if (canonicalParsed.unsafe) {

package/lib/pr-review-publish.ts

@@ -596,7 +596,7 @@ export interface CompletedReviewSessionIdentity {
 }
 
 export interface PersistedCompletedReview {
-	schemaVersion: 3;
+	schemaVersion: 4;
 	session: CompletedReviewSessionIdentity;
 	invocation: ReviewInvocation;
 	repository: RepositoryBinding;
@@ -819,7 +819,7 @@ export class CompletedReviewCache {
 		const digest = reviewHash(record.review);
 		const useReference = !!reviewEntryId && !!referencedReview && reviewHash(referencedReview) === digest;
 		return {
-			schemaVersion: 3,
+			schemaVersion: 4,
 			session: { ...session },
 			invocation: { ...record.invocation, autoPost: { ...record.invocation.autoPost } },
 			repository: { ...record.repository },
@@ -849,7 +849,7 @@ export class CompletedReviewCache {
 	): boolean {
 		if (
 			!isObject(value) ||
-			value.schemaVersion !== 3 ||
+			value.schemaVersion !== 4 ||
 			!validSessionIdentity(value.session) ||
 			!sameSessionIdentity(value.session, session) ||
 			!validRepositoryBinding(value.repository)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.17.7",
+  "version": "1.17.9",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and host-gated COMMENT or qualified APPROVE publishing.",
   "keywords": [
     "pi-package",