prreviewbuddy 0.25.7 → 0.25.13

package/dist/{relative_time-CDvK_Zaj.js → relative_time-vn8Ex9E8.js}

@@ -2002,15 +2002,11 @@ async function defaultRemoteBranch(repoPath) {
 async function buildChangeSet(options) {
 	const repoPath = (await git(options.repoPath, ["rev-parse", "--show-toplevel"])).trim();
 	const base = options.resolvedBase ?? await resolveBase(repoPath, options.base);
-	const mergeBase = (await git(repoPath, [
-		"merge-base",
-		base.revision,
-		"HEAD"
-	])).trim();
+	const mergeBase = await mergeBaseOf(repoPath, base, "HEAD");
 	const headRef = await currentBranch(repoPath);
 	const isLinkedWorktree = await linkedWorktree(repoPath);
 	const files = await collectFiles(repoPath, [mergeBase, "HEAD"]);
-	if (files.length === 0) throw emptyChange(headRef, base.display, options.requestNumber);
+	if (files.length === 0) throw emptyChange(headRef, base.display, options.requestNumber === void 0 ? {} : { requestNumber: options.requestNumber });
 	disagreement(files.length, base.display, options.expected);
 	const blobShas = await headBlobShas(repoPath);
 	for (const file of files) file.sha = blobShas.get(file.name) ?? "";
@@ -2073,10 +2069,19 @@ function disagreement(found, baseRef, expected) {
 *
 * The message names both refs, because "no changes" on its own reads as a bug when the branch is
 * visibly full of work and the real story is that it was compared against itself.
+*
+* `uncommitted` is only ever counted by a caller standing in the reviewer's own checkout, which is
+* `resolveTarget`. This module usually runs inside the isolated worktree, where `git status` is
+* clean by construction, so it could never see the edits it would be explaining.
 */
-function emptyChange(headRef, baseRef, requestNumber) {
+function emptyChange(headRef, baseRef, { requestNumber, uncommitted = 0 } = {}) {
 	if (requestNumber !== void 0) return new EmptyChangeError(`Pull request ${requestNumber} is already merged into ${baseRef}, so there is nothing left to compare. PR Review Buddy reviews a change before it lands, and a merged request has no diff against the branch it went into. Review the branch it was merged from, if it is still around, or a request that is still open.`);
-	return new EmptyChangeError(`No changes found to review. ${headRef === baseRef ? `${headRef} is the base it would be compared against` : `${headRef} has no commits that ${baseRef} does not`}. Switch to the branch containing your changes, or commit them first.`);
+	const comparison = headRef === baseRef ? `${headRef} is the base it would be compared against` : `${headRef} has no commits that ${baseRef} does not`;
+	if (uncommitted === 0) return new EmptyChangeError(`No committed changes to review. ${comparison}. Switch to the branch containing your changes, or commit them first.`);
+	const remedy = headRef === baseRef ? "Commit them on a branch, then try again." : "Commit them, then try again.";
+	return new EmptyChangeError(`No committed changes to review. ${comparison}.\n\nYou have ${uncommitted} uncommitted ${uncommitted === 1 ? "change" : "changes"}. PR Review Buddy reviews a fixed snapshot of your code, so uncommitted changes are not included.
+
+` + remedy);
 }
 /**
 * A linked worktree has its own `.git` file pointing into the main repository's directory, so the
@@ -2189,12 +2194,44 @@ async function headBlobShas(repoPath) {
 	}
 	return map;
 }
-async function collectFiles(repoPath, range) {
-	const diffArgs = [
+/**
+* The comparison every question about "what changed" is asked with.
+*
+* One definition, because `resolveTarget` asks whether a change is empty before any worktree
+* exists and `buildChangeSet` asks again inside one. Two spellings of the range would let the two
+* answers drift, and the early refusal would then turn away a change the review could have read.
+*/
+function rangeDiff(range) {
+	return [
 		"diff",
 		"--find-renames",
 		...range
 	];
+}
+async function mergeBaseOf(repoPath, base, head) {
+	return (await git(repoPath, [
+		"merge-base",
+		base.revision,
+		head
+	])).trim();
+}
+/**
+* Whether `head` carries any committed change against `base`, by the same comparison
+* `buildChangeSet` makes.
+*
+* Asks for the file list rather than comparing the merge base with `head`, because those disagree:
+* a branch whose commits cancel out (a change and its revert) is ahead of its base and still has
+* nothing to review, and the change set would refuse it.
+*/
+async function hasCommittedChanges(repoPath, base, head) {
+	return parseNameStatus(await git(repoPath, [
+		...rangeDiff([await mergeBaseOf(repoPath, base, head), head]),
+		"--name-status",
+		"-z"
+	])).length > 0;
+}
+async function collectFiles(repoPath, range) {
+	const diffArgs = rangeDiff(range);
 	const [nameStatus, numstat, combinedPatch] = await Promise.all([
 		git(repoPath, [
 			...diffArgs,
@@ -2581,6 +2618,53 @@ async function verifyDefaultBase(root) {
 	}
 }
 /**
+* Refuse a review of nothing before one is created, rather than from inside it.
+*
+* `buildChangeSet` refuses an empty comparison too, but it runs in the job's `context` phase: after
+* the workspace is minted and a full `git worktree add`, so the refusal was reported as a *paused*
+* review whose "run it again and it carries on" refuses identically for ever. Called from `startJob`
+* rather than `resolveTarget`, because a resolved target may still be handed an existing review, and
+* a branch that has since been merged must keep opening the review it already has.
+*
+* Asks the question `buildChangeSet` asks, through `hasCommittedChanges`, against the base the job
+* will use (`baseFor` in `review_job.ts`), so the two cannot disagree about what "empty" means. A
+* base that does not resolve is left for the job, which already says so in its own words.
+*/
+async function refuseEmptyTarget(target) {
+	const root = target.originRepoPath;
+	let changed;
+	let baseDisplay;
+	try {
+		const base = target.resolvedBase ?? await resolveBase(root, target.base);
+		baseDisplay = base.display;
+		changed = await hasCommittedChanges(root, base, target.sha);
+	} catch {
+		return;
+	}
+	if (changed) return;
+	throw emptyChange(target.branch, baseDisplay, {
+		...target.pullRequest ? { requestNumber: target.pullRequest.number } : {},
+		uncommitted: await uncommittedIn(root, target)
+	});
+}
+/**
+* How many changes `git status` would show, but only when this checkout is the thing under review.
+*
+* Your edits explain an empty review only when they sit on the commit being reviewed. Standing on
+* `main` while naming a level `feat/x`, they are somebody else's business, and `--branch` promises
+* never to read the checkout at all. Untracked files count, because they are visible work too, and
+* the count is by line of `--porcelain` rather than `-z`, where a rename takes two records.
+*/
+async function uncommittedIn(root, target) {
+	if (target.pullRequest) return 0;
+	try {
+		if ((await git(root, ["rev-parse", "HEAD"])).trim() !== target.sha || await branchOf(root) !== target.branch) return 0;
+		return (await git(root, ["status", "--porcelain"])).split("\n").filter((line) => line.trim()).length;
+	} catch {
+		return 0;
+	}
+}
+/**
 * The base half of a target, rebuilt from a review that already recorded one.
 *
 * Three places rebuild a target from a stored review: re-analysing one, resuming a job, and pinning
@@ -3485,6 +3569,81 @@ function saveWorkspace(workspace) {
 	if (!existsSync(workspacePath(workspace.id))) return;
 	writeWorkspace(workspace);
 }
+/**
+* An opaque token representing the observed version of this review's mutable state.
+*
+* **Tokens support equality comparison only.** The implementation derives the token from
+* filesystem metadata; no caller may depend on that, and none may order two tokens. mtime is not a
+* monotonic application revision — a clock change, a file restored from a backup and a filesystem
+* with coarse timestamps all break ordering, and none of them break equality. Keeping the contract
+* this narrow is what lets a counter, a content hash or a composite over several files replace the
+* body of this function later without touching the wire or the page.
+*
+* So a consumer asking "did the workspace change under this page" writes:
+*
+*     if (pageRevision != null && serverRevision != null && pageRevision !== serverRevision) {
+*       // state changed
+*     }
+*
+* Never the bare `!==`, and never `>`. **An absent token means unknown, not equal**: two reviews
+* that both failed to produce one have told you nothing, and a bare `!==` over two `undefined`s
+* silently concludes "unchanged", which is the opposite of what happened.
+*
+* Opaque includes its shape. `mtimeMs` carries sub-millisecond precision, so the token is a float
+* and reaches the page as one; a consumer that `parseInt`s it would throw away the digits that
+* distinguish two writes in the same millisecond. Compare what you were given, unchanged.
+*
+* Nothing reads this yet, deliberately. It is laid down so that a later auto-refresh can ask a
+* cheap question without a protocol having to be invented at the same time as the feature, and
+* building the polling now would be committing to an answer before there is a question.
+*
+* `ENOENT` only. A review whose file has gone is the one condition "unknown" honestly describes,
+* and it is a real race: a route loads the workspace and then stats it, so a deletion in between
+* lands here. Any other stat failure is a fault on this machine and is left to surface, because a
+* permissions problem dressed as an absent token is a product where nothing is wrong and nothing
+* works.
+*/
+function workspaceRevision(workspace) {
+	try {
+		return statSync(workspacePath(workspace.id)).mtimeMs;
+	} catch (error) {
+		if (error?.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+/**
+* Every stored review as an id and a revision token, without reading one of them.
+*
+* Here rather than in `reviews_revision.ts` because this module owns the layout of `workspaces/`,
+* the same reason `deleteWorkspace` is here. What the caller gets is deliberately not a review: it
+* is the pair that answers "has anything the list draws changed", for every review at once.
+*
+* **`stat` only, never a parse.** A review record holds the whole diff and can be megabytes, and
+* this is read on a one-second poll while an analysis runs. Reading them properly through
+* `recentWorkspaces` would be parsing every diff on the machine several times a minute to find out
+* whether anything had changed, which is a worse bargain than the staleness it fixes.
+*
+* **Sorted by id.** `readdirSync` promises no order, so an unsorted answer would produce a
+* different token for an unchanged directory whenever the filesystem felt like enumerating
+* differently. On a design that reloads the page when the token changes, that is a reload the
+* reviewer cannot account for.
+*/
+function workspaceStamps() {
+	let names;
+	try {
+		names = readdirSync(WORKSPACES_DIR);
+	} catch {
+		return [];
+	}
+	const stamps = [];
+	for (const name of names) {
+		if (!name.endsWith(".json")) continue;
+		try {
+			stamps.push([name.slice(0, -5), statSync(join(WORKSPACES_DIR, name)).mtimeMs]);
+		} catch {}
+	}
+	return stamps.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
 function writeWorkspace(workspace) {
 	mkdirSync(WORKSPACES_DIR, { recursive: true });
 	writeFileSync(workspacePath(workspace.id), JSON.stringify(workspace), { mode: 384 });
@@ -3869,149 +4028,416 @@ function pruneOldWorkspaces() {
 	} catch {}
 }
 //#endregion
-//#region ../../packages/review-harness/src/workspace/job_progress.ts
-/**
-* The phases that do work, in the order they run. `done` and `failed` are outcomes, not work.
-*
-* Declared here rather than in `job_store.ts`, which is where it used to live, because this module
-* is imported by the browser bundle and that one opens files. Everything here is a string table
-* and a fold over a record; the store reads this rather than the other way round, so the client
-* can share the phase model without dragging `node:fs` in behind it. The type still comes from the
-* store, which is harmless: types are erased.
-*/
-var WORK_PHASES = [
-	"preparing",
-	"context",
-	"conversation",
-	"analysing"
-];
-/**
-* Two forms per phase, because a finished step and a running one are different sentences.
-*
-* `done` and `failed` are outcomes rather than work, so they never appear in a checklist; they
-* are named anyway because `JobPhase` includes them and a partial table would make every lookup
-* a possible undefined.
-*/
-var PHASES = {
-	preparing: {
-		doing: "Preparing isolated checkout",
-		done: "Prepared isolated checkout"
-	},
-	context: {
-		doing: "Reading what changed",
-		done: "Read what changed"
-	},
-	conversation: {
-		doing: "Reading pull request conversation",
-		done: "Read pull request conversation"
-	},
-	analysing: {
-		doing: "Analysing the change",
-		done: "Analysed the change"
-	},
-	done: {
-		doing: "Finishing",
-		done: "Finished"
-	},
-	failed: {
-		doing: "Stopped",
-		done: "Stopped"
-	}
-};
+//#region ../../packages/review-harness/src/workspace/exclusive_claim.ts
 /**
-* Whether a phase is part of *this* review, rather than part of the pipeline in general.
-*
-* Only `conversation` is ever optional, and reviewing a branch with no pull request is an ordinary
-* supported thing to do rather than a degraded version of something else. Ticking "Read pull
-* request conversation" on such a review claims a step that did not happen and makes a complete
-* review look like an incomplete one; printing "No pull request found" instead is no better,
-* because a line in a checklist reads as something missing whatever words are in it.
+* At most one holder of a name at a time, across processes, on this machine.
 *
-* So the rule is that an optional stage which did not apply is not rendered at all:
+* Extracted from `job_claim.ts`, which had written all of this for one caller. A second caller then
+* needed the same thing under a different name -- see `review_lock.ts` -- and the alternative was a
+* second concurrency system beside a working one, which is how two mechanisms come to disagree
+* about who holds what.
 *
-* - A pull request review always shows it. It is the point of that review, and it is known before
-*   the phase runs, so the line never appears late.
-* - A branch review shows it only once a conversation was actually attached, which happens when the
-*   branch turns out to have a request on a forge we read. Real work, worth saying.
-* - Everything else — no request, an unsupported host, `gh` missing — shows nothing.
+* The mechanism, and the reasoning behind each half of it, lives here. What a particular claim
+* *means* stays with the module that takes it: "at most one driver owns a job" is a statement about
+* jobs, not about `link()`.
 *
-* The absent cases are still explained, once, at the end: the CLI's closing summary and the page's
-* `conversationNote` both say the review was made without the conversation and why. That is the
-* right place for it, because by then it is a fact about the finished review rather than a gap in
-* a list of things still happening.
+* Never holds a credential, and holds nothing about the thing it names: a claim is a pid, a host,
+* and two timestamps.
 */
-function appliesTo(job, phase) {
-	if (phase !== "conversation") return true;
-	return job.target.pullRequest !== void 0 || job.conversation?.kind === "attached";
-}
 /**
-* Every step this review runs, in order, with what has become of each.
+* One directory for every kind of claim, keyed by name.
 *
-* Read from `job.completed` rather than inferred from the position of `job.phase` in the list.
-* The job records a phase as complete when it is *left*, so a run that died inside a phase leaves
-* it uncompleted — which is the honest shape of that, and the thing a retry resumes from. Working
-* it out from ordering instead would tick a step the job never finished.
+* Kept out of `jobs/`, where `allJobs` reads every `.json` and parses it as a `ReviewJob`: a claim
+* file there would be swept as a job. Keys from different callers share the directory and are kept
+* apart by shape -- a job claim is a UUID, a review lock is `review-<id>` -- so neither can name
+* the other's file by accident.
 */
-function progressSteps(job) {
-	const failedAt = job.phase === "failed" ? job.failure?.phase : void 0;
-	return WORK_PHASES.filter((phase) => appliesTo(job, phase)).map((phase) => {
-		const complete = job.completed.includes(phase) || job.phase === "done";
-		const failed = failedAt === phase;
-		const active = !complete && !failed && job.phase === phase;
-		const state = failed ? "failed" : complete ? "complete" : active ? "active" : "pending";
-		const label = complete ? PHASES[phase].done : PHASES[phase].doing;
-		const note = active && job.progress && !restates(job.progress, label) ? job.progress : void 0;
-		return {
-			phase,
-			label,
-			state,
-			...note ? { note } : {}
-		};
-	});
+var CLAIMS_DIR = join(STORE_ROOT, "claims");
+/** Comfortably inside the lease, so one slow tick is never enough to lose a claim that is held. */
+var CLAIM_RENEW_MS = 3e4;
+function claimPath(key) {
+	return join(CLAIMS_DIR, `${key}.json`);
 }
-/** Same words as the phase heading, give or take the articles and the trailing full stop. */
-function restates(note, label) {
-	const bare = (text) => text.toLowerCase().replace(/\bthe\b/g, "").replace(/[^a-z]/g, "");
-	return bare(note) === bare(label);
+function readClaim(key) {
+	try {
+		return JSON.parse(readFileSync(claimPath(key), "utf8"));
+	} catch {
+		return null;
+	}
 }
-//#endregion
-//#region ../../packages/review-harness/src/workspace/job_store.ts
 /**
-* What a review is doing right now, kept apart from the review itself.
+* Whether the process behind a claim still exists.
 *
-* Separate from `StoredWorkspace` for two reasons that both bite later if they are fused. Pruning
-* a worktree edits a job and must never be a write to a review, or a sweep on a timer becomes a
-* process that rewrites reviews. And a job is finished business within hours while a review is
-* kept for thirty days, so one record with two lifetimes would have to encode both.
+* Signal 0 checks for a process without touching it: `ESRCH` means gone, and `EPERM` means it is
+* there but owned by somebody else, which is still there. Only meaningful for a claim written on
+* this machine, and `~/.prreviewbuddy` can sit on a synced home directory, so a claim from another
+* host is left to the lease alone rather than judged against a pid that means nothing here.
 */
+function ownerAlive(claim) {
+	if (claim.host !== hostname()) return true;
+	try {
+		process.kill(claim.pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
 /**
-* The phases that do work, in the order they run. `done` and `failed` are outcomes, not work.
+* The claim on this key, if one is genuinely held.
 *
-* Defined in `job_progress.ts` and re-exported here, where every existing caller already looks for
-* it. It lives there because the workspace page's client bundle needs the phase model and must not
-* import this module, which opens files.
+* Both conditions, because each covers the other's blind spot. A pid check recovers from a killed
+* holder at once but can be fooled by a reused pid; a lease cannot be fooled but is always late by
+* up to its own length. Requiring both means a reused pid with a stale lease reads as free, and a
+* dead pid with a fresh lease reads as free immediately.
 */
-var JOBS_DIR = join(STORE_ROOT, "jobs");
+function liveClaim$1(key, now = Date.now()) {
+	const claim = readClaim(key);
+	if (!claim) return null;
+	if (now - claim.renewedAt >= 18e4) return null;
+	if (!ownerAlive(claim)) return null;
+	return claim;
+}
 /**
-* Whether this job asks the forge for the conversation, or reads what is already on the workspace.
+* Take the claim on a key, or return null because somebody else holds it.
 *
-* Every job runs every phase, including KISS: the phase list is the same for both lenses, so
-* `resumeFrom` cannot mean two things and a resumed job cannot skip work its record says it did.
-* What differs is what `conversation` does. A KISS run is started against a change a standard run
-* has usually already imported the conversation for, minutes earlier and at the same commit, so
-* asking the forge again would be a second network trip for facts already on disk.
+* Synchronous from the check to the create, with no `await` between them, so two calls inside one
+* process cannot both pass: this keeps the property a module-level `Set` had, and adds the one it
+* lacked.
 *
-* Standard runs always ask, including a reanalyse, because a reanalyse is a deliberate "do this
-* again" and the conversation is the part most likely to have moved since.
+* Across processes the create is `link`, which fails with `EEXIST` if the name is taken and does so
+* atomically, unlike a write with a prior existence check. A stale claim is unlinked first, and
+* only if it is still the same stale claim that was read a line earlier, identified by `holder`.
+* The residual race is two processes stealing the *same* stale claim within the same few
+* microseconds, where the loser can delete the winner's fresh file. Left rather than solved: it
+* needs a crashed holder and two attempts fired at the same instant, and `recordFailure` already
+* refuses to write over a job record that moved underneath it, so the cost of losing that race is
+* duplicated work rather than a corrupted review.
+*
+* **Never waits.** A caller that cannot have the key is told so immediately. Queueing would turn a
+* deletion racing an analysis into a deletion that happens twenty minutes later, when the person
+* who asked for it has stopped looking.
 */
-function reusesImportedConversation(job) {
-	return job.reviewType === "kiss";
-}
-function jobPath(id) {
-	return join(JOBS_DIR, `${id}.json`);
-}
-function createJob(input) {
-	const now = Date.now();
+function acquire(key, now = Date.now()) {
+	const existing = readClaim(key);
+	if (existing) {
+		if (liveClaim$1(key, now)) return null;
+		const current = readClaim(key);
+		if (current && current.holder !== existing.holder) return null;
+		try {
+			unlinkSync(claimPath(key));
+		} catch {}
+	}
+	const claim = {
+		key,
+		holder: randomUUID(),
+		pid: process.pid,
+		host: hostname(),
+		acquiredAt: now,
+		renewedAt: now
+	};
+	mkdirSync(CLAIMS_DIR, { recursive: true });
+	const staging = join(CLAIMS_DIR, `.${claim.holder}.tmp`);
+	writeFileSync(staging, JSON.stringify(claim), { mode: 384 });
+	try {
+		linkSync(staging, claimPath(key));
+	} catch {
+		return null;
+	} finally {
+		rmSync(staging, { force: true });
+	}
+	return startHolding(claim);
+}
+/**
+* Keep the claim fresh for as long as the work runs, and give it up afterwards.
+*
+* The timer is unreferenced on purpose. A heartbeat must never be the reason a process stays alive:
+* the CLI is held open by the await on the job and the workspace server by its socket, and if
+* neither is true any more then this claim is exactly the kind that should be allowed to expire.
+*
+* A renewal that finds the claim *gone* writes it back rather than giving up. A holder whose event
+* loop was blocked past the lease -- parsing a very large diff, say -- can have its claim judged
+* expired and swept while it is still perfectly alive, and a holder that then quietly stopped
+* renewing would leave the key looking free for the rest of its run. Nobody holds the file, so
+* taking it again is the true statement.
+*
+* A renewal that finds the claim held by somebody *else* stops rather than writing over it. By then
+* the other holder is the real one, and reasserting ownership here would produce the two holders
+* this whole file exists to prevent.
+*/
+function startHolding(claim) {
+	let held = claim;
+	const timer = setInterval(() => {
+		const current = readClaim(held.key);
+		if (current && current.holder !== held.holder) {
+			clearInterval(timer);
+			return;
+		}
+		held = {
+			...held,
+			renewedAt: Date.now()
+		};
+		try {
+			writeFileSync(claimPath(held.key), JSON.stringify(held), { mode: 384 });
+		} catch {}
+	}, CLAIM_RENEW_MS);
+	timer.unref?.();
+	return {
+		get claim() {
+			return held;
+		},
+		release() {
+			clearInterval(timer);
+			const current = readClaim(held.key);
+			if (current && current.holder !== held.holder) return;
+			try {
+				unlinkSync(claimPath(held.key));
+			} catch {}
+		}
+	};
+}
+/** Drop a claim without holding it first. For a key being destroyed, and for tests. */
+function clearClaim$1(key) {
+	try {
+		unlinkSync(claimPath(key));
+	} catch {}
+}
+//#endregion
+//#region ../../packages/review-harness/src/workspace/job_claim.ts
+/**
+* Who is driving a job right now, recorded where another process can see it.
+*
+* The invariant this exists to state: **at most one driver owns a job at a time.** `runJob` used to
+* enforce that with a module-level `Set`, which was correct when one process called it and became
+* silently wrong the moment three did -- the MCP server, the workspace server's Retry route, and
+* the CLI. A guard that is invisible across processes is not a guard against the case that
+* actually happens, which is two surfaces on one machine reaching the same job.
+*
+* Idempotence at each collision point was the alternative, and it was rejected: it would have to be
+* rebuilt separately for `createWorktree`, for context building, for the agent spawn and for
+* applying the result, and each one would only ever be as good as the last person who remembered.
+* One claim covers the whole lifecycle.
+*
+* The mechanism is `exclusive_claim.ts`, and this file is now the naming: a job is claimed under
+* its own id, so `claims/<jobId>.json` is where it has always been. The mechanism moved out when a
+* review lock needed the same guarantee under a different name; what stays here is what a job claim
+* means, which is the part that is about jobs rather than about `link()`.
+*/
+/** The claim on this job, if a driver genuinely holds it. */
+function liveClaim(jobId, now = Date.now()) {
+	return liveClaim$1(jobId, now);
+}
+/** Whether a driver owns this job right now. The question every other module actually asks. */
+function isClaimed(jobId, now = Date.now()) {
+	return liveClaim(jobId, now) !== null;
+}
+/**
+* Take the claim on a job, or return null because another driver holds it.
+*
+* Two retries fired together, a retry racing the run `startJob` already kicked off, or a retry
+* racing a driver the sweep wrongly called stopped: all of them land here rather than both reaching
+* `createWorktree` or the analysis spawn.
+*/
+function claimJob(jobId, now = Date.now()) {
+	return acquire(jobId, now);
+}
+/** Drop a job's claim without holding it first. For a job being deleted, and for tests. */
+function clearClaim(jobId) {
+	clearClaim$1(jobId);
+}
+//#endregion
+//#region ../../packages/review-harness/src/workspace/job_progress.ts
+/**
+* The phases that do work, in the order they run. `done` and `failed` are outcomes, not work.
+*
+* Declared here rather than in `job_store.ts`, which is where it used to live, because this module
+* is imported by the browser bundle and that one opens files. Everything here is a string table
+* and a fold over a record; the store reads this rather than the other way round, so the client
+* can share the phase model without dragging `node:fs` in behind it. The type still comes from the
+* store, which is harmless: types are erased.
+*/
+var WORK_PHASES = [
+	"preparing",
+	"context",
+	"conversation",
+	"analysing"
+];
+/** A record written before jobs said what they were for was always a review. */
+function purposeOf(job) {
+	return job.purpose ?? "review";
+}
+/**
+* Two forms per phase, because a finished step and a running one are different sentences.
+*
+* `done` and `failed` are outcomes rather than work, so they never appear in a checklist; they
+* are named anyway because `JobPhase` includes them and a partial table would make every lookup
+* a possible undefined.
+*/
+var PHASES = {
+	preparing: {
+		doing: "Preparing isolated checkout",
+		done: "Prepared isolated checkout"
+	},
+	context: {
+		doing: "Reading what changed",
+		done: "Read what changed"
+	},
+	conversation: {
+		doing: "Reading pull request conversation",
+		done: "Read pull request conversation"
+	},
+	analysing: {
+		doing: "Analysing the change",
+		done: "Analysed the change"
+	},
+	done: {
+		doing: "Finishing",
+		done: "Finished"
+	},
+	failed: {
+		doing: "Stopped",
+		done: "Stopped"
+	}
+};
+/**
+* The same phases, as an update runs them.
+*
+* An update reuses the phase enum because the sweep, the claims and `isTerminal` all key on it, but
+* the work behind each phase is different and so is the order: the conversation is re-read before
+* any checkout is made, because a review with no new commits stops there and needs no checkout.
+*/
+var UPDATE_PHASES = {
+	preparing: {
+		doing: "Fetching the latest commits",
+		done: "Fetched the latest commits"
+	},
+	conversation: {
+		doing: "Re-reading pull request conversation",
+		done: "Re-read pull request conversation"
+	},
+	context: {
+		doing: "Preparing a checkout of the new commits",
+		done: "Prepared a checkout of the new commits"
+	},
+	analysing: {
+		doing: "Reassessing the review against the new commits",
+		done: "Reassessed the review against the new commits"
+	},
+	done: {
+		doing: "Finishing",
+		done: "Finished"
+	},
+	failed: {
+		doing: "Stopped",
+		done: "Stopped"
+	}
+};
+var UPDATE_ORDER = [
+	"preparing",
+	"conversation",
+	"context",
+	"analysing"
+];
+/** The names this job's phases go by. */
+function phasesFor(job) {
+	return purposeOf(job) === "update" ? UPDATE_PHASES : PHASES;
+}
+/**
+* Whether a phase is part of *this* review, rather than part of the pipeline in general.
+*
+* Only `conversation` is ever optional, and reviewing a branch with no pull request is an ordinary
+* supported thing to do rather than a degraded version of something else. Ticking "Read pull
+* request conversation" on such a review claims a step that did not happen and makes a complete
+* review look like an incomplete one; printing "No pull request found" instead is no better,
+* because a line in a checklist reads as something missing whatever words are in it.
+*
+* So the rule is that an optional stage which did not apply is not rendered at all:
+*
+* - A pull request review always shows it. It is the point of that review, and it is known before
+*   the phase runs, so the line never appears late.
+* - A branch review shows it only once a conversation was actually attached, which happens when the
+*   branch turns out to have a request on a forge we read. Real work, worth saying.
+* - Everything else — no request, an unsupported host, `gh` missing — shows nothing.
+*
+* The absent cases are still explained, once, at the end: the CLI's closing summary and the page's
+* `conversationNote` both say the review was made without the conversation and why. That is the
+* right place for it, because by then it is a fact about the finished review rather than a gap in
+* a list of things still happening.
+*/
+function appliesTo(job, phase) {
+	if (phase !== "conversation") return true;
+	return job.target.pullRequest !== void 0 || job.conversation?.kind === "attached";
+}
+/**
+* Every step this review runs, in order, with what has become of each.
+*
+* Read from `job.completed` rather than inferred from the position of `job.phase` in the list.
+* The job records a phase as complete when it is *left*, so a run that died inside a phase leaves
+* it uncompleted — which is the honest shape of that, and the thing a retry resumes from. Working
+* it out from ordering instead would tick a step the job never finished.
+*/
+function progressSteps(job) {
+	const failedAt = job.phase === "failed" ? job.failure?.phase : void 0;
+	const update = purposeOf(job) === "update";
+	const names = phasesFor(job);
+	const order = (update ? UPDATE_ORDER : WORK_PHASES).filter((phase) => appliesTo(job, phase));
+	return (update && job.phase === "done" ? order.filter((phase) => job.completed.includes(phase)) : order).map((phase) => {
+		const complete = job.completed.includes(phase) || !update && job.phase === "done";
+		const failed = failedAt === phase;
+		const active = !complete && !failed && job.phase === phase;
+		const state = failed ? "failed" : complete ? "complete" : active ? "active" : "pending";
+		const label = complete ? names[phase].done : names[phase].doing;
+		const note = active && job.progress && !restates(job.progress, label) ? job.progress : void 0;
+		return {
+			phase,
+			label,
+			state,
+			...note ? { note } : {}
+		};
+	});
+}
+/** Same words as the phase heading, give or take the articles and the trailing full stop. */
+function restates(note, label) {
+	const bare = (text) => text.toLowerCase().replace(/\bthe\b/g, "").replace(/[^a-z]/g, "");
+	return bare(note) === bare(label);
+}
+//#endregion
+//#region ../../packages/review-harness/src/workspace/job_store.ts
+/**
+* What a review is doing right now, kept apart from the review itself.
+*
+* Separate from `StoredWorkspace` for two reasons that both bite later if they are fused. Pruning
+* a worktree edits a job and must never be a write to a review, or a sweep on a timer becomes a
+* process that rewrites reviews. And a job is finished business within hours while a review is
+* kept for thirty days, so one record with two lifetimes would have to encode both.
+*/
+/**
+* The phases that do work, in the order they run. `done` and `failed` are outcomes, not work.
+*
+* Defined in `job_progress.ts` and re-exported here, where every existing caller already looks for
+* it. It lives there because the workspace page's client bundle needs the phase model and must not
+* import this module, which opens files.
+*/
+var JOBS_DIR = join(STORE_ROOT, "jobs");
+/**
+* Whether this job asks the forge for the conversation, or reads what is already on the workspace.
+*
+* Every job runs every phase, including KISS: the phase list is the same for both lenses, so
+* `resumeFrom` cannot mean two things and a resumed job cannot skip work its record says it did.
+* What differs is what `conversation` does. A KISS run is started against a change a standard run
+* has usually already imported the conversation for, minutes earlier and at the same commit, so
+* asking the forge again would be a second network trip for facts already on disk.
+*
+* Standard runs always ask, including a reanalyse, because a reanalyse is a deliberate "do this
+* again" and the conversation is the part most likely to have moved since.
+*/
+function reusesImportedConversation(job) {
+	return job.reviewType === "kiss";
+}
+function jobPath(id) {
+	return join(JOBS_DIR, `${id}.json`);
+}
+function createJob(input) {
+	const now = Date.now();
 	return {
 		id: randomUUID(),
 		phase: "preparing",
@@ -4097,23 +4523,48 @@ function fail(job, message, kind, detail) {
 	};
 }
 /**
-* Record a failure, without overwriting a record that has moved on since this run last saw it.
+* Record a failure, unless somebody else is driving this job now.
+*
+* A run only reaches this after an `await` on the git call or the agent spawn that just rejected,
+* and whatever this run's own `job` variable holds by then is a snapshot from before that. If the
+* run that owns the job is no longer this one -- this one's claim lapsed and another driver picked
+* the job up -- saving this run's failure would take a job that is running fine and record it as
+* failed, and nothing downstream could tell the difference from a real one: `saveJob` writes
+* whatever it is given.
 *
-* A run only reaches this after an `await` on the git call or the Claude Code spawn that just
-* rejected, and whatever this run's own `job` variable holds by then is a snapshot from before
-* that. If some other write landed on disk in the meantime -- another run this one should have
-* been refused for racing, had the guard in `runJob` worked, or simply one that started later and
-* is now the run actually driving this job -- saving this run's failure over it would take a job
-* that is running fine and record it as failed, and nothing downstream could tell the difference
-* from a real one: `saveJob` writes whatever it is given.
+* The question is asked of the claim, which is who is driving, and not of `updatedAt`, which is
+* only when the record last moved. Those two came apart the moment the analysis began streaming
+* progress: `runAnalysisFor` writes every line the agent reports onto the record with a fresh
+* `updatedAt` and does not hand the new copy back, so a driver's own commentary made its own
+* snapshot look stale and it declined to record its own failure. The job stayed at `analysing` for
+* ever, the page kept the running rail over it, and the CLI printed `Review ready . 0 findings`.
+*
+* The failure is written onto the record as it now stands rather than onto the snapshot, so the
+* last thing the agent said survives being failed. Only a driver whose own claim has gone is
+* refused, so a job nobody holds -- a crashed driver's, a resumed run's -- is still failable.
 */
-function recordFailure(job, message, kind, detail) {
-	const current = loadJob(job.id);
-	if (current && current.updatedAt !== job.updatedAt) return current;
-	const failed = fail(job, message, kind, detail);
+function recordFailure(job, message, driver, kind, detail) {
+	const current = loadJob(job.id) ?? job;
+	const claim = liveClaim(job.id);
+	if (claim && claim.holder !== driver) return current;
+	const failed = fail(current, message, kind, detail);
 	saveJob(failed);
 	return failed;
 }
+/**
+* When this job stopped doing work.
+*
+* `finishedAt` is written on both terminal transitions, and a record older than the field falls
+* back to the last time anything touched it -- which, for a job that has ended, is the write that
+* ended it. Lifted out of `sweep.ts`, where it was private, once a second caller needed the same
+* question: two runs on one review can overlap, so "which of these ended last" is not answered by
+* which of them started last.
+*
+* Meaningless for a job still running, and no caller asks it of one.
+*/
+function endedAt(job) {
+	return job.finishedAt ?? job.updatedAt;
+}
 function isTerminal(job) {
 	return job.phase === "done" || job.phase === "failed";
 }
@@ -4638,302 +5089,85 @@ async function removeWorktree(input) {
 			path
 		]);
 		return {
-			removed: true,
-			how: "git"
-		};
-	} catch (error) {
-		return {
-			removed: false,
-			reason: "failed",
-			message: message$1(error)
-		};
-	}
-	const marker = readMarker(path);
-	if (!marker) return {
-		removed: false,
-		reason: "no-marker",
-		message: `${path} has no PR Review Buddy marker, so there is no evidence it was created here. It was left alone and needs removing by hand.`
-	};
-	if (realpathOrSelf(marker.originRepoPath) !== realpathOrSelf(input.originRepoPath)) return {
-		removed: false,
-		reason: "marker-mismatch",
-		message: `${path} is marked as belonging to ${marker.originRepoPath}, not ${input.originRepoPath}.`
-	};
-	if (now - marker.createdAt < minAge) return {
-		removed: false,
-		reason: "too-young",
-		message: `${path} is too recent to treat as residue.`
-	};
-	try {
-		rmSync(path, {
-			recursive: true,
-			force: true
-		});
-		await git(input.originRepoPath, ["worktree", "prune"]);
-		return {
-			removed: true,
-			how: "direct"
-		};
-	} catch (error) {
-		return {
-			removed: false,
-			reason: "failed",
-			message: message$1(error)
-		};
-	}
-}
-/** The resolved path if it is genuinely inside the managed root, else null. */
-function withinManagedRoot(candidate) {
-	const root = realpathOrSelf(MANAGED_ROOT);
-	const path = realpathOrSelf(resolve(candidate));
-	if (path === root) return null;
-	return path.startsWith(root + sep) ? path : null;
-}
-/** Ask git, in the origin repository, whether this path is one of its worktrees. */
-async function gitOwns(originRepoPath, path) {
-	let listing;
-	try {
-		listing = await git(originRepoPath, [
-			"worktree",
-			"list",
-			"--porcelain"
-		]);
-	} catch {
-		return false;
-	}
-	return listing.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => realpathOrSelf(line.slice(9).trim())).includes(path);
-}
-/**
-* macOS puts temporary directories behind `/private`, and git reports the resolved form while a
-* caller may hold the symlinked one. Comparing them unresolved makes the ownership check fail on
-* exactly the machines this is developed on.
-*/
-function realpathOrSelf(path) {
-	try {
-		return realpathSync(path);
-	} catch {
-		return resolve(path);
-	}
-}
-function message$1(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-//#endregion
-//#region ../../packages/review-harness/src/workspace/exclusive_claim.ts
-/**
-* At most one holder of a name at a time, across processes, on this machine.
-*
-* Extracted from `job_claim.ts`, which had written all of this for one caller. A second caller then
-* needed the same thing under a different name -- see `review_lock.ts` -- and the alternative was a
-* second concurrency system beside a working one, which is how two mechanisms come to disagree
-* about who holds what.
-*
-* The mechanism, and the reasoning behind each half of it, lives here. What a particular claim
-* *means* stays with the module that takes it: "at most one driver owns a job" is a statement about
-* jobs, not about `link()`.
-*
-* Never holds a credential, and holds nothing about the thing it names: a claim is a pid, a host,
-* and two timestamps.
-*/
-/**
-* One directory for every kind of claim, keyed by name.
-*
-* Kept out of `jobs/`, where `allJobs` reads every `.json` and parses it as a `ReviewJob`: a claim
-* file there would be swept as a job. Keys from different callers share the directory and are kept
-* apart by shape -- a job claim is a UUID, a review lock is `review-<id>` -- so neither can name
-* the other's file by accident.
-*/
-var CLAIMS_DIR = join(STORE_ROOT, "claims");
-/** Comfortably inside the lease, so one slow tick is never enough to lose a claim that is held. */
-var CLAIM_RENEW_MS = 3e4;
-function claimPath(key) {
-	return join(CLAIMS_DIR, `${key}.json`);
-}
-function readClaim(key) {
-	try {
-		return JSON.parse(readFileSync(claimPath(key), "utf8"));
-	} catch {
-		return null;
-	}
-}
-/**
-* Whether the process behind a claim still exists.
-*
-* Signal 0 checks for a process without touching it: `ESRCH` means gone, and `EPERM` means it is
-* there but owned by somebody else, which is still there. Only meaningful for a claim written on
-* this machine, and `~/.prreviewbuddy` can sit on a synced home directory, so a claim from another
-* host is left to the lease alone rather than judged against a pid that means nothing here.
-*/
-function ownerAlive(claim) {
-	if (claim.host !== hostname()) return true;
-	try {
-		process.kill(claim.pid, 0);
-		return true;
-	} catch (error) {
-		return error.code === "EPERM";
-	}
-}
-/**
-* The claim on this key, if one is genuinely held.
-*
-* Both conditions, because each covers the other's blind spot. A pid check recovers from a killed
-* holder at once but can be fooled by a reused pid; a lease cannot be fooled but is always late by
-* up to its own length. Requiring both means a reused pid with a stale lease reads as free, and a
-* dead pid with a fresh lease reads as free immediately.
-*/
-function liveClaim$1(key, now = Date.now()) {
-	const claim = readClaim(key);
-	if (!claim) return null;
-	if (now - claim.renewedAt >= 18e4) return null;
-	if (!ownerAlive(claim)) return null;
-	return claim;
-}
-/**
-* Take the claim on a key, or return null because somebody else holds it.
-*
-* Synchronous from the check to the create, with no `await` between them, so two calls inside one
-* process cannot both pass: this keeps the property a module-level `Set` had, and adds the one it
-* lacked.
-*
-* Across processes the create is `link`, which fails with `EEXIST` if the name is taken and does so
-* atomically, unlike a write with a prior existence check. A stale claim is unlinked first, and
-* only if it is still the same stale claim that was read a line earlier, identified by `holder`.
-* The residual race is two processes stealing the *same* stale claim within the same few
-* microseconds, where the loser can delete the winner's fresh file. Left rather than solved: it
-* needs a crashed holder and two attempts fired at the same instant, and `recordFailure` already
-* refuses to write over a job record that moved underneath it, so the cost of losing that race is
-* duplicated work rather than a corrupted review.
-*
-* **Never waits.** A caller that cannot have the key is told so immediately. Queueing would turn a
-* deletion racing an analysis into a deletion that happens twenty minutes later, when the person
-* who asked for it has stopped looking.
-*/
-function acquire(key, now = Date.now()) {
-	const existing = readClaim(key);
-	if (existing) {
-		if (liveClaim$1(key, now)) return null;
-		const current = readClaim(key);
-		if (current && current.holder !== existing.holder) return null;
-		try {
-			unlinkSync(claimPath(key));
-		} catch {}
-	}
-	const claim = {
-		key,
-		holder: randomUUID(),
-		pid: process.pid,
-		host: hostname(),
-		acquiredAt: now,
-		renewedAt: now
-	};
-	mkdirSync(CLAIMS_DIR, { recursive: true });
-	const staging = join(CLAIMS_DIR, `.${claim.holder}.tmp`);
-	writeFileSync(staging, JSON.stringify(claim), { mode: 384 });
-	try {
-		linkSync(staging, claimPath(key));
-	} catch {
-		return null;
-	} finally {
-		rmSync(staging, { force: true });
-	}
-	return startHolding(claim);
-}
-/**
-* Keep the claim fresh for as long as the work runs, and give it up afterwards.
-*
-* The timer is unreferenced on purpose. A heartbeat must never be the reason a process stays alive:
-* the CLI is held open by the await on the job and the workspace server by its socket, and if
-* neither is true any more then this claim is exactly the kind that should be allowed to expire.
-*
-* A renewal that finds the claim *gone* writes it back rather than giving up. A holder whose event
-* loop was blocked past the lease -- parsing a very large diff, say -- can have its claim judged
-* expired and swept while it is still perfectly alive, and a holder that then quietly stopped
-* renewing would leave the key looking free for the rest of its run. Nobody holds the file, so
-* taking it again is the true statement.
-*
-* A renewal that finds the claim held by somebody *else* stops rather than writing over it. By then
-* the other holder is the real one, and reasserting ownership here would produce the two holders
-* this whole file exists to prevent.
-*/
-function startHolding(claim) {
-	let held = claim;
-	const timer = setInterval(() => {
-		const current = readClaim(held.key);
-		if (current && current.holder !== held.holder) {
-			clearInterval(timer);
-			return;
-		}
-		held = {
-			...held,
-			renewedAt: Date.now()
-		};
-		try {
-			writeFileSync(claimPath(held.key), JSON.stringify(held), { mode: 384 });
-		} catch {}
-	}, CLAIM_RENEW_MS);
-	timer.unref?.();
-	return {
-		get claim() {
-			return held;
-		},
-		release() {
-			clearInterval(timer);
-			const current = readClaim(held.key);
-			if (current && current.holder !== held.holder) return;
-			try {
-				unlinkSync(claimPath(held.key));
-			} catch {}
-		}
+			removed: true,
+			how: "git"
+		};
+	} catch (error) {
+		return {
+			removed: false,
+			reason: "failed",
+			message: message$1(error)
+		};
+	}
+	const marker = readMarker(path);
+	if (!marker) return {
+		removed: false,
+		reason: "no-marker",
+		message: `${path} has no PR Review Buddy marker, so there is no evidence it was created here. It was left alone and needs removing by hand.`
+	};
+	if (realpathOrSelf(marker.originRepoPath) !== realpathOrSelf(input.originRepoPath)) return {
+		removed: false,
+		reason: "marker-mismatch",
+		message: `${path} is marked as belonging to ${marker.originRepoPath}, not ${input.originRepoPath}.`
+	};
+	if (now - marker.createdAt < minAge) return {
+		removed: false,
+		reason: "too-young",
+		message: `${path} is too recent to treat as residue.`
 	};
-}
-/** Drop a claim without holding it first. For a key being destroyed, and for tests. */
-function clearClaim$1(key) {
 	try {
-		unlinkSync(claimPath(key));
-	} catch {}
+		rmSync(path, {
+			recursive: true,
+			force: true
+		});
+		await git(input.originRepoPath, ["worktree", "prune"]);
+		return {
+			removed: true,
+			how: "direct"
+		};
+	} catch (error) {
+		return {
+			removed: false,
+			reason: "failed",
+			message: message$1(error)
+		};
+	}
 }
-//#endregion
-//#region ../../packages/review-harness/src/workspace/job_claim.ts
-/**
-* Who is driving a job right now, recorded where another process can see it.
-*
-* The invariant this exists to state: **at most one driver owns a job at a time.** `runJob` used to
-* enforce that with a module-level `Set`, which was correct when one process called it and became
-* silently wrong the moment three did -- the MCP server, the workspace server's Retry route, and
-* the CLI. A guard that is invisible across processes is not a guard against the case that
-* actually happens, which is two surfaces on one machine reaching the same job.
-*
-* Idempotence at each collision point was the alternative, and it was rejected: it would have to be
-* rebuilt separately for `createWorktree`, for context building, for the agent spawn and for
-* applying the result, and each one would only ever be as good as the last person who remembered.
-* One claim covers the whole lifecycle.
-*
-* The mechanism is `exclusive_claim.ts`, and this file is now the naming: a job is claimed under
-* its own id, so `claims/<jobId>.json` is where it has always been. The mechanism moved out when a
-* review lock needed the same guarantee under a different name; what stays here is what a job claim
-* means, which is the part that is about jobs rather than about `link()`.
-*/
-/** The claim on this job, if a driver genuinely holds it. */
-function liveClaim(jobId, now = Date.now()) {
-	return liveClaim$1(jobId, now);
+/** The resolved path if it is genuinely inside the managed root, else null. */
+function withinManagedRoot(candidate) {
+	const root = realpathOrSelf(MANAGED_ROOT);
+	const path = realpathOrSelf(resolve(candidate));
+	if (path === root) return null;
+	return path.startsWith(root + sep) ? path : null;
 }
-/** Whether a driver owns this job right now. The question every other module actually asks. */
-function isClaimed(jobId, now = Date.now()) {
-	return liveClaim(jobId, now) !== null;
+/** Ask git, in the origin repository, whether this path is one of its worktrees. */
+async function gitOwns(originRepoPath, path) {
+	let listing;
+	try {
+		listing = await git(originRepoPath, [
+			"worktree",
+			"list",
+			"--porcelain"
+		]);
+	} catch {
+		return false;
+	}
+	return listing.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => realpathOrSelf(line.slice(9).trim())).includes(path);
 }
 /**
-* Take the claim on a job, or return null because another driver holds it.
-*
-* Two retries fired together, a retry racing the run `startJob` already kicked off, or a retry
-* racing a driver the sweep wrongly called stopped: all of them land here rather than both reaching
-* `createWorktree` or the analysis spawn.
+* macOS puts temporary directories behind `/private`, and git reports the resolved form while a
+* caller may hold the symlinked one. Comparing them unresolved makes the ownership check fail on
+* exactly the machines this is developed on.
 */
-function claimJob(jobId, now = Date.now()) {
-	return acquire(jobId, now);
+function realpathOrSelf(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
 }
-/** Drop a job's claim without holding it first. For a job being deleted, and for tests. */
-function clearClaim(jobId) {
-	clearClaim$1(jobId);
+function message$1(error) {
+	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
 //#region ../../packages/review-harness/src/workspace/review_lock.ts
@@ -6907,7 +7141,14 @@ var REVIEW_ATTENTIONS = [
 * reply then finds the block *inside* a string and hands back a snippet of Ruby as the review,
 * which fails to parse and loses the whole thing.
 *
-* So a fence is only believed when what it wraps looks like the object or array being asked for.
+* So a fence is believed only when what it wraps is the object or array being asked for **and
+* parses whole**. Looking at the opening alone is not enough, because the marker that ends the
+* match need not be the one that ends the fence: a model that wraps its answer *and* puts a
+* fenced `bash` snippet in one of its own strings closes the non-greedy match 24KB early, in the
+* middle of a string, on a candidate that still begins with `{`. A live review answered in
+* exactly that shape and lost 26KB of perfectly good JSON. A fence says where the answer is, not
+* where it ends, so a candidate that does not parse is passed over rather than returned, and the
+* scanner below -- which tracks strings and reads such an object whole -- gets its turn.
 *
 * With no fence anywhere, the value is cut out of whatever surrounds it. The prompt asks for JSON
 * and nothing else, and that is the *only* instruction in the session this product controls: the
@@ -6923,10 +7164,19 @@ function extractJsonText(raw) {
 	const text = raw.trim();
 	for (const match of text.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)) {
 		const inner = match[1].trim();
-		if (inner.startsWith("{") || inner.startsWith("[")) return inner;
+		if ((inner.startsWith("{") || inner.startsWith("[")) && parses(inner)) return inner;
 	}
 	return firstJsonValue(text) ?? text;
 }
+/** Whether this is a whole JSON value, which is the only thing that makes a candidate an answer. */
+function parses(candidate) {
+	try {
+		JSON.parse(candidate);
+		return true;
+	} catch {
+		return false;
+	}
+}
 /**
 * The first slice of this text that is a whole JSON value.
 *
@@ -8412,6 +8662,7 @@ async function startJob(input) {
 		base: input.base,
 		resolveRequest: input.resolveRequest
 	}), input.base);
+	await refuseEmptyTarget(target);
 	const agent = input.agentId ? agentById(input.agentId) : defaultAgent();
 	const review = input.review ?? { type: "standard" };
 	const workspace = createWorkspace({
@@ -8427,6 +8678,7 @@ async function startJob(input) {
 			workspaceId: workspace.id,
 			target,
 			env: agent.captureEnv(),
+			purpose: "review",
 			...review.type === "kiss" ? {
 				reviewType: "kiss",
 				audience: review.audience
@@ -8458,13 +8710,13 @@ async function startJob(input) {
 * The previous result is snapshotted before the session is replaced, so the review keeps saying who
 * made the analysis it is retiring as well as who made the one it now shows.
 */
-async function reanalyseReview(workspaceId, agentId) {
+async function reanalyseReview(workspaceId, agentId, onStarted) {
 	const workspace = loadWorkspace(workspaceId);
 	if (!workspace) throw new Error("No such review.");
 	const sha = workspace.session.metadata?.commitSha;
 	if (!sha) throw new Error("This review does not record which commit it describes, so it cannot be analysed again.");
 	const agent = agentId ? agentById(agentId) : agentById(agentIdOf(workspace.session));
-	if (isBusy(await withReviewLock(workspaceId, () => {
+	const started = await withReviewLock(workspaceId, () => {
 		if (workspace.session.result) workspace.previousResult = {
 			result: workspace.session.result,
 			commitSha: sha,
@@ -8481,13 +8733,17 @@ async function reanalyseReview(workspaceId, agentId) {
 		const job = createJob({
 			workspaceId: workspace.id,
 			target,
-			env: agent.captureEnv()
+			env: agent.captureEnv(),
+			purpose: "review"
 		});
 		saveJob(job);
 		workspace.jobId = job.id;
 		workspace.session = beginReviewSession(sha, agent);
 		saveWorkspace(workspace);
-	}))) throw new ReviewBeingDeletedError();
+		return job;
+	});
+	if (isBusy(started)) throw new ReviewBeingDeletedError();
+	onStarted?.(started.id);
 	return runJob(workspaceId);
 }
 /**
@@ -8528,7 +8784,7 @@ async function runJob(workspaceId, runners = {}, reviewType = "standard") {
 	});
 	if (isBusy(started)) throw busyReason(workspaceId, reviewType);
 	try {
-		return await drive(started.jobId, workspaceId, runners);
+		return await drive(started.jobId, workspaceId, runners, started.claim.claim.holder);
 	} finally {
 		started.claim.release();
 	}
@@ -8581,7 +8837,7 @@ function runOfJob(workspace, jobId) {
 	if (!run) throw new Error("This KISS job has no run to write its answer to.");
 	return run;
 }
-async function drive(jobId, workspaceId, runners) {
+async function drive(jobId, workspaceId, runners, driver) {
 	let job = loadJob(jobId);
 	if (!job) throw new Error("No such job.");
 	const startedAt = Date.now();
@@ -8688,7 +8944,7 @@ async function drive(jobId, workspaceId, runners) {
 	} catch (error) {
 		const kind = error instanceof GuideRejected || error instanceof KissRejected ? "agent_output_invalid" : error instanceof AgentRunError ? error.kind : void 0;
 		const raw = message(error);
-		job = recordFailure(job, explain(job, raw), kind, raw);
+		job = recordFailure(job, explain(job, raw), driver, kind, raw);
 		if (job.reviewType === "kiss") failCurrentKissRun(workspaceId, job, job.failure?.message ?? raw, kind, error instanceof KissRejected ? error.answer : void 0);
 		finished(job, workspaceId, startedAt, false);
 		return job;
@@ -8957,6 +9213,7 @@ async function recordKissRun(input) {
 			workspaceId: workspace.id,
 			target,
 			env: agent.captureEnv(),
+			purpose: "review",
 			reviewType: "kiss",
 			audience: input.audience
 		});
@@ -9350,6 +9607,56 @@ function countByStatus(issues) {
 	return counts;
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/running_jobs.ts
+/**
+* What is being made right now, as opposed to what a record says.
+*
+* Its own module because two commands need the same answer and neither should have to import the
+* other to get it: `uninstall` refuses while anything is running, and deleting a review refuses
+* while that review is. Splitting it out is the same move `store_root.ts` made out of `store.ts`.
+*/
+/**
+* Reviews being made at this moment.
+*
+* `liveClaim` rather than the job phase alone, and the distinction matters more here than anywhere:
+* a job whose driver was killed sits in a working phase for up to half an hour before the sweep
+* calls it stopped, and refusing over one of those would be refusing on behalf of a review that
+* nothing is making. The claim answers about a process rather than about a record.
+*/
+function runningJobs(now = Date.now()) {
+	return allJobs().filter((job) => !isTerminal(job)).flatMap((job) => {
+		const claim = liveClaim(job.id, now);
+		return claim ? [{
+			job,
+			claim
+		}] : [];
+	});
+}
+/**
+* Somebody is already bringing this review up to date, so a second update was not started.
+*
+* Refused rather than run alongside, because two updates cannot both be kept. Each reconciles
+* against its own copy of the review and saves the whole of it, so the one that finished last
+* silently replaced the other's result, and the snapshot kept for rolling back described the wrong
+* predecessor. Thrown from under the review's lock; see `claimCheckoutJob`.
+*/
+var UpdateAlreadyRunningError = class extends Error {
+	constructor(message = "This review is already being updated.") {
+		super(message);
+		this.name = "UpdateAlreadyRunningError";
+	}
+};
+/**
+* The update being made to this review right now, if one is.
+*
+* Found in the job store rather than recorded on the workspace. An update's job is transient, and
+* an id written onto the review would be a second copy of "is one running" that could outlive the
+* answer. The newest where there are two, which only a race between two surfaces can produce.
+*/
+function liveUpdateFor(reviewId, now = Date.now()) {
+	return runningJobs(now).map((running) => running.job).filter((job) => job.workspaceId === reviewId && purposeOf(job) === "update").sort((a, b) => b.startedAt - a.startedAt || (a.id < b.id ? -1 : 1))[0] ?? null;
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/pinned_checkout.ts
 /**
 * A checkout of one commit, for anything that needs to read the reviewed code.
@@ -9382,8 +9689,62 @@ var NoCheckoutError = class extends Error {};
 * look. Claimed inside the lock too, so there is no instant where a job record for this review
 * exists unclaimed and a deletion between the two would see nothing running.
 */
-async function pinCheckout(workspace, sha) {
+async function pinCheckout(workspace, sha, held) {
+	const owned = held === void 0;
+	const claimed = held ?? await claimCheckoutJob(workspace, sha, { purpose: "ask" });
+	const { claim } = claimed;
+	let job = loadJob(claimed.job.id) ?? claimed.job;
+	try {
+		const path = await createWorktree({
+			originRepoPath: workspace.repoPath,
+			jobId: job.id,
+			sha
+		});
+		job = {
+			...job,
+			target: {
+				...job.target,
+				sha
+			},
+			worktreePath: path
+		};
+		saveJob(job);
+		return {
+			path,
+			job,
+			claim
+		};
+	} catch (error) {
+		if (owned) {
+			saveJob(fail(job, error instanceof Error ? error.message : String(error)));
+			claim.release();
+		}
+		throw error;
+	}
+}
+/**
+* Register and claim the job a checkout will belong to, before the checkout exists.
+*
+* Separate from `pinCheckout` because an update needs its job long before it needs a directory: the
+* fetch and the conversation re-read come first and can take a while, and a job that only appeared
+* once they were over left the terminal and the page with nothing to show for them.
+*
+* Created under the review's lock, which is what makes the claim arrive before a deletion could
+* look. Claimed inside the lock too, so there is no instant where a job record for this review
+* exists unclaimed and a deletion between the two would see nothing running.
+*
+* The same lock carries a second invariant, for the same reason the first needed one:
+*
+* > **No update job for a review is created while another update of that review is claimed.**
+*
+* The check is inside the lock and creating an update job requires the lock, so the answer cannot
+* go stale between asking and creating. The lock is a file, so this holds between the page's button
+* in the daemon and `prreviewbuddy review --update` in a terminal, which is the pair that raced.
+* Only an update blocks an update: an analysis, a KISS run or an ask checkout is different work.
+*/
+async function claimCheckoutJob(workspace, sha, fields) {
 	const started = await withReviewLock(workspace.id, () => {
+		if (fields.purpose === "update" && liveUpdateFor(workspace.id)) throw new UpdateAlreadyRunningError();
 		const target = {
 			originRepoPath: workspace.repoPath,
 			branch: workspace.changeSet.headRef,
@@ -9393,7 +9754,8 @@ async function pinCheckout(workspace, sha) {
 		const job = createJob({
 			workspaceId: workspace.id,
 			target,
-			env: captureEnv()
+			env: captureEnv(),
+			...fields
 		});
 		saveJob(job);
 		const claim = claimJob(job.id);
@@ -9404,29 +9766,7 @@ async function pinCheckout(workspace, sha) {
 		};
 	});
 	if (isBusy(started)) throw new ReviewBeingDeletedError();
-	let { job } = started;
-	const { claim } = started;
-	try {
-		const path = await createWorktree({
-			originRepoPath: workspace.repoPath,
-			jobId: job.id,
-			sha
-		});
-		job = {
-			...job,
-			worktreePath: path
-		};
-		saveJob(job);
-		return {
-			path,
-			job,
-			claim
-		};
-	} catch (error) {
-		saveJob(fail(job, error instanceof Error ? error.message : String(error)));
-		claim.release();
-		throw error;
-	}
+	return started;
 }
 /**
 * Which checkout each open review's questions are being answered against.
@@ -9695,27 +10035,45 @@ var FETCH_TIMEOUT_MS = 6e4;
 */
 async function updateReview(workspace, runners = {}) {
 	const reviewedSha = workspace.session.metadata?.commitSha || null;
+	const held = await claimCheckoutJob(workspace, reviewedSha ?? "", {
+		purpose: "update",
+		...workspace.prContext ? { conversation: {
+			kind: "attached",
+			context: workspace.prContext
+		} } : {}
+	});
+	runners.onStarted?.(held.job.id);
+	const current = () => loadJob(held.job.id) ?? held.job;
+	const step = (phase) => saveJob(advance(current(), phase));
+	try {
+		const outcome = await bringForward(workspace, runners, reviewedSha, held, step);
+		saveJob(outcome.stop === "analysis-failed" ? fail(current(), outcome.message) : advance(current(), "done", outcome.message));
+		return outcome;
+	} catch (error) {
+		saveJob(fail(current(), error instanceof Error ? error.message : String(error)));
+		throw error;
+	} finally {
+		held.claim.release();
+	}
+}
+async function bringForward(workspace, runners, reviewedSha, held, step) {
 	const remote = await remoteHead(workspace);
 	if (!remote.sha) return refuse(reviewedSha, remote.fetchFailed, noRemoteHeadMessage(workspace));
+	if (workspace.prContext) step("conversation");
 	const conversationOk = await reReadConversation(workspace, runners.runRefresh);
 	if (reviewedSha && !await commitPresent(workspace.repoPath, reviewedSha)) return settled(reviewedSha, remote.sha, remote.fetchFailed, conversationOk, "baseline-gone", BASELINE_GONE_MESSAGE);
 	if (!reviewedSha || reviewedSha === remote.sha) return settled(reviewedSha, remote.sha, remote.fetchFailed, conversationOk, "already-current", alreadyCurrentMessage(conversationOk));
+	step("context");
 	let worktreePath;
-	let job;
-	let claim;
 	try {
-		({path: worktreePath, job, claim} = await pinCheckout(workspace, remote.sha));
+		({path: worktreePath} = await pinCheckout(workspace, remote.sha, held));
 	} catch (error) {
 		if (error instanceof ReviewBeingDeletedError) throw error;
 		return settled(reviewedSha, remote.sha, remote.fetchFailed, conversationOk, "analysis-failed", "A checkout of the new commits could not be prepared, so nothing was reassessed.");
 	}
-	try {
-		return await reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath);
-	} finally {
-		saveJob(advance(job, "done"));
-	}
+	return reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, held.job.id);
 }
-async function reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath) {
+async function reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, jobId) {
 	const newHead = remote.sha;
 	let delta;
 	try {
@@ -9729,10 +10087,19 @@ async function reconcile(workspace, runners, reviewedSha, remote, conversationOk
 	}
 	const previous = workspace.session.result;
 	if (!previous) return settled(reviewedSha, newHead, remote.fetchFailed, conversationOk, "no-result", "This review has no analysis to bring up to date.");
+	step("analysing");
+	const onProgress = (text) => {
+		const current = loadJob(jobId);
+		if (current) saveJob({
+			...current,
+			progress: text,
+			updatedAt: Date.now()
+		});
+	};
 	let raw;
 	try {
 		const prompt = buildUpdatePrompt(workspace, delta, reviewedSha, newHead, worktreePath);
-		raw = runners.run ? await runners.run(prompt, worktreePath, agentEnvOf(workspace)) : await runUpdate(workspace.id, prompt, worktreePath, workspace.repoPath, agentEnvOf(workspace));
+		raw = runners.run ? await runners.run(prompt, worktreePath, agentEnvOf(workspace), onProgress) : await runUpdate(workspace.id, prompt, worktreePath, workspace.repoPath, agentEnvOf(workspace), onProgress);
 	} catch (error) {
 		return settled(reviewedSha, newHead, remote.fetchFailed, conversationOk, "analysis-failed", error instanceof RefreshUnavailableError ? error.message : "The agent could not finish reassessing the review, so the findings are exactly as they were.");
 	}
@@ -10056,7 +10423,7 @@ ${buildReconciliationInstructions({
 * that captured the daemon's environment instead was reconciling one review's findings with
 * whichever agent and account the workspace server happened to be started under.
 */
-async function runUpdate(workspaceId, prompt, cwd, originRepoPath, env) {
+async function runUpdate(workspaceId, prompt, cwd, originRepoPath, env, onProgress) {
 	try {
 		return await withUsageRecorded(workspaceId, "update", env, (onUsage) => agentFor(env).run({
 			capability: "read-code",
@@ -10065,6 +10432,7 @@ async function runUpdate(workspaceId, prompt, cwd, originRepoPath, env) {
 			originRepoPath,
 			env,
 			timeoutMs: UPDATE_TIMEOUT_MS,
+			onProgress,
 			onUsage
 		}));
 	} catch (error) {
@@ -10542,32 +10910,6 @@ async function discardJob(job, options = {}) {
 	return { removed: true };
 }
 //#endregion
-//#region ../../packages/review-harness/src/workspace/running_jobs.ts
-/**
-* What is being made right now, as opposed to what a record says.
-*
-* Its own module because two commands need the same answer and neither should have to import the
-* other to get it: `uninstall` refuses while anything is running, and deleting a review refuses
-* while that review is. Splitting it out is the same move `store_root.ts` made out of `store.ts`.
-*/
-/**
-* Reviews being made at this moment.
-*
-* `liveClaim` rather than the job phase alone, and the distinction matters more here than anywhere:
-* a job whose driver was killed sits in a working phase for up to half an hour before the sweep
-* calls it stopped, and refusing over one of those would be refusing on behalf of a review that
-* nothing is making. The claim answers about a process rather than about a record.
-*/
-function runningJobs(now = Date.now()) {
-	return allJobs().filter((job) => !isTerminal(job)).flatMap((job) => {
-		const claim = liveClaim(job.id, now);
-		return claim ? [{
-			job,
-			claim
-		}] : [];
-	});
-}
-//#endregion
 //#region ../../packages/review-harness/src/workspace/delete_review.ts
 /**
 * Removing one review, or everything on one card.
@@ -10735,4 +11077,4 @@ function relativeTime(ms) {
 	return `${days} day${days === 1 ? "" : "s"} ago`;
 }
 //#endregion
-export { checkCodeFreshness as $, agentEnvOf as A, processDiscussion as At, BUILD_VERSION as B, STORE_ROOT as Bt, statedWorkspacePort as C, touchWorkspace as Ct, refreshPrContext as D, issuesOutstanding as Dt, updateReview as E, isQuestionOutstanding as Et, startJob as F, agentIdOf as Ft, forgeResolver as G, detectAgents as Gt, feedbackUrl as H, DEFAULT_AGENT_ID as Ht, readEvents as I, clearAgentPreference as It, clearClaim as J, fillFileUrlTemplate as K, AgentCancelledError as Kt, record as L, readAgentPreference as Lt, startKissJob as M, resolveTarget as Mt, reanalyseReview as N, displayRef as Nt, isUnchanged as O, questionsOutstanding as Ot, runJob as P, git as Pt, removeWorktree as Q, recordTelemetryUploadConsent as R, writeAgentPreference as Rt, resolveWorkspacePort as S, summarise as St, RefreshUnavailableError as T, isIssueOutstanding as Tt, withUsageRecorded as U, agentById as Ut, PACKAGE_NAME as V, AGENT_IDS as Vt, EXPLAIN_SIMPLY_PROMPT as W, agentFor as Wt, MANAGED_ROOT as X, isClaimed as Y, readMarker as Z, writeServerRecord as _, recentReviewGroups as _t, liveJobsFor as a, saveJob as at, MIN_WORKSPACE_PORT as b, reviewedRepositories as bt, discardJob as c, followedRefName as ct, clearServerRecord as d, lineageKeyFor as dt, checkFreshness as et, ensureServer as f, lineagePosition as ft, workspaceUrl as g, previousKissResult as gt, stopServer as h, positionInLineage as ht, lineageIds as i, loadJob as it, recordKissRun as j, describeAuthorship as jt, askCheckout as k, reviewerDispositions as kt, readIndexToken as l, groupByLineage as lt, reviewsUrl as m, matchingWorkspaceIds as mt, deleteLineage as n, fail as nt, wasBlocked as o, PHASES as ot, readServerRecord as p, loadWorkspace as pt, ReviewBeingDeletedError as q, AgentUnavailableError as qt, deleteReview as r, isTerminal as rt, runningJobs as s, progressSteps as st, relativeTime as t, allJobs as tt, bootstrapUrl as u, latestKissRun as ut, DEFAULT_WORKSPACE_PORT as v, recentWorkspaces as vt, writePortPreference as w, doneVerb as wt, parseWorkspacePort as x, saveWorkspace as xt, MAX_WORKSPACE_PORT as y, reviewedCommit as yt, telemetryUploadConsent as z, CONFIG_PATH as zt };
+export { checkCodeFreshness as $, AgentCancelledError as $t, liveUpdateFor as A, workspaceStamps as At, recordTelemetryUploadConsent as B, displayRef as Bt, writePortPreference as C, recentWorkspaces as Ct, isUnchanged as D, summarise as Dt, refreshPrContext as E, saveWorkspace as Et, reanalyseReview as F, questionsOutstanding as Ft, withUsageRecorded as G, writeAgentPreference as Gt, BUILD_VERSION as H, agentIdOf as Ht, runJob as I, reviewerDispositions as It, fillFileUrlTemplate as J, AGENT_IDS as Jt, EXPLAIN_SIMPLY_PROMPT as K, CONFIG_PATH as Kt, startJob as L, processDiscussion as Lt, agentEnvOf as M, isIssueOutstanding as Mt, recordKissRun as N, isQuestionOutstanding as Nt, askCheckout as O, touchWorkspace as Ot, startKissJob as P, issuesOutstanding as Pt, removeWorktree as Q, detectAgents as Qt, readEvents as R, describeAuthorship as Rt, statedWorkspacePort as S, recentReviewGroups as St, updateReview as T, reviewedRepositories as Tt, PACKAGE_NAME as U, clearAgentPreference as Ut, telemetryUploadConsent as V, git as Vt, feedbackUrl as W, readAgentPreference as Wt, MANAGED_ROOT as X, agentById as Xt, ReviewBeingDeletedError as Y, DEFAULT_AGENT_ID as Yt, readMarker as Z, agentFor as Zt, DEFAULT_WORKSPACE_PORT as _, lineagePosition as _t, liveJobsFor as a, loadJob as at, parseWorkspacePort as b, positionInLineage as bt, readIndexToken as c, phasesFor as ct, ensureServer as d, clearClaim as dt, AgentUnavailableError as en, checkFreshness as et, readServerRecord as f, isClaimed as ft, writeServerRecord as g, lineageKeyFor as gt, workspaceUrl as h, latestKissRun as ht, lineageIds as i, isTerminal as it, runningJobs as j, doneVerb as jt, UpdateAlreadyRunningError as k, workspaceRevision as kt, bootstrapUrl as l, progressSteps as lt, stopServer as m, groupByLineage as mt, deleteLineage as n, endedAt as nt, wasBlocked as o, saveJob as ot, reviewsUrl as p, followedRefName as pt, forgeResolver as q, STORE_ROOT as qt, deleteReview as r, fail as rt, discardJob as s, PHASES as st, relativeTime as t, allJobs as tt, clearServerRecord as u, purposeOf as ut, MAX_WORKSPACE_PORT as v, loadWorkspace as vt, RefreshUnavailableError as w, reviewedCommit as wt, resolveWorkspacePort as x, previousKissResult as xt, MIN_WORKSPACE_PORT as y, matchingWorkspaceIds as yt, record as z, resolveTarget as zt };