tinybeeai 0.0.0-stage → 0.16.1

package/dist/review/render.js

@@ -0,0 +1,2409 @@
+// PR review for QA, rendering (docs/PR-REVIEW-QA.md section 5, plain wording from KAT-96): the
+// sticky PR comment, the check-run title, text and annotations, the <qa_review> block for the verdict model, and the
+// release-notes line for the digest. Pure functions: no I/O, no model call.
+//
+// Every model-written string goes through cell(), inline(), quote() or code(). Escaping
+// follows OpenQodex render/markdown.ts (control characters removed, Markdown and HTML
+// escaped, line breaks to <br> in tables, code spans without backticks), plus one localdost
+// rule: "@" becomes "@" + U+200B so the bot never mentions a user.
+import { createHash } from 'node:crypto';
+import { isTestRepoFile, splitTestRepoFile } from './test-repo-file.js';
+import { skippedSentence, testRepoDetail, testRepoSentence, testsRan } from './test-repo-lines.js';
+import { RISK_WORD, SIZE_WORD } from './change-summary.js';
+import { safeName } from '../runner/artifacts.js';
+import { APP_DID_NOT_ANSWER, appDidNotAnswer, environmentSignature } from './environment.js';
+import { intentWhere, matchIntent } from './intent.js';
+import { isSecurityPassRisk } from './security.js';
+export { skippedSentence, testsRan };
+export const PR_MARKER = '<!-- localdost:pr-summary -->';
+export const QA_MARKER_RE = /<!-- (?:localdost|qadots):qa-review head=([0-9a-f]{0,40}) -->/i;
+export const COMMENT_LIMIT = 65000;
+export const MAX_CHECKLIST = 8;
+export const MAX_BUGS = 6;
+export const MAX_UNTESTED = 6;
+export const MAX_SUGGESTIONS = 6;
+export const MAX_RISK_ROWS = 10;
+export const MAX_TESTS_AT_RISK = 10;
+export const MAX_ANNOTATIONS = 50;
+const SEV = { low: 0, medium: 1, high: 2, critical: 3 };
+const PRIORITY = { must: 0, should: 1, could: 2 };
+const ZWSP = '\u200b';
+// ---------- escaping ----------
+// C0 and C1 controls except tab, line feed and carriage return; zero-width and bidi controls.
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u200b-\u200f\u2028\u2029\u202a-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/g;
+function clean(s) {
+    return String(s ?? '')
+        .replace(CONTROL, '')
+        .replace(/\r\n?/g, '\n');
+}
+function escapeText(s) {
+    return (s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/([\\`*_[\]|~])/g, '\\$1')
+        .replace(/@/g, `@${ZWSP}`)
+        // Escapes what would start a heading or a list. "3." becomes "3\." (CommonMark has no "\3").
+        .replace(/^(\s*)([#+-])/, '$1\\$2')
+        .replace(/^(\s*)(\d+)\./, '$1$2\\.'));
+}
+/** One line of prose outside a table: escaped, line breaks become spaces. */
+export function inline(s) {
+    return escapeText(clean(s)
+        .replace(/\s*\n\s*/g, ' ')
+        .trim());
+}
+/** One line of prose with its square brackets dropped before escaping, so "[UI] Guest" reads "UI Guest" and no stray backslash is left. */
+export function noBrackets(s) {
+    return inline(clean(s).replace(/[[\]]/g, ''));
+}
+/** A table cell: escaped, line breaks become <br>. */
+export function cell(s) {
+    return clean(s)
+        .trim()
+        .split('\n')
+        .map((l) => escapeText(l.trim()))
+        .join('<br>');
+}
+/** A code span. Backticks and line breaks are removed, so the span cannot be closed early. */
+export function code(s) {
+    const t = clean(s)
+        .replace(/`/g, "'")
+        .replace(/\s*\n\s*/g, ' ')
+        .trim();
+    return `\`${t || ' '}\``;
+}
+/** A block quote. Each line is escaped and prefixed. */
+export function quote(s) {
+    const t = clean(s).trim();
+    if (!t)
+        return '';
+    return t
+        .split('\n')
+        .map((l) => `> ${escapeText(l.trim())}`)
+        .join('\n');
+}
+/** Plain text for check-run annotations (not Markdown): controls removed, one line per break. */
+export function plain(s, max = 2000) {
+    const t = clean(s).trim();
+    return t.length > max ? `${t.slice(0, max - 3)}...` : t;
+}
+export function refText(r) {
+    if (!r)
+        return '';
+    return `${r.file}:${r.line}${r.lineEnd && r.lineEnd !== r.line ? `-${r.lineEnd}` : ''}`;
+}
+// ---------- checklist ids and ticks ----------
+export function normalizeScenario(s) {
+    return clean(s)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, ' ')
+        .trim();
+}
+/** Stable checklist id: first 6 hex of sha1(areaId + normalized scenario). */
+export function checklistId(item) {
+    return createHash('sha1')
+        .update(`${item.areaId ?? ''}${normalizeScenario(item.scenario)}`)
+        .digest('hex')
+        .slice(0, 6);
+}
+const ITEM_RE = /^(\s*[-*] \[)([ xX])(\].*?<!-- qa:t:([0-9a-f]{6}) -->)\s*$/;
+/** Checklist lines with ids, in order, from a rendered comment. */
+export function checklistLines(body) {
+    const out = [];
+    for (const line of (body ?? '').split('\n')) {
+        const m = ITEM_RE.exec(line);
+        if (m)
+            out.push({ id: m[4], ticked: m[2].toLowerCase() === 'x', line });
+    }
+    return out;
+}
+export function tickedIds(body) {
+    return new Set(checklistLines(body)
+        .filter((l) => l.ticked)
+        .map((l) => l.id));
+}
+/** The review head the comment was rendered for, as written in its marker. */
+export function commentHead(body) {
+    const m = QA_MARKER_RE.exec(body ?? '');
+    return m ? m[1] : null;
+}
+const EARLIER_OPEN = '<details><summary>Checked earlier';
+/** The fold that holds everything a developer needs. Tick items and the footer sit above it. */
+export const DETAILS_SUMMARY = 'Details for developers';
+const DETAILS_OPEN = `<details><summary>${DETAILS_SUMMARY}</summary>`;
+/**
+ * Ticks again every item of `next` that was ticked in `previous`. Ticked items whose id is
+ * gone move to a collapsed "Checked earlier" list with their tick kept. Without this, every
+ * new push wipes the tester's ticks.
+ */
+export function carryTicks(next, previous) {
+    const before = checklistLines(previous);
+    const ticked = new Set(before.filter((l) => l.ticked).map((l) => l.id));
+    if (!ticked.size)
+        return next;
+    const present = new Set(checklistLines(next).map((l) => l.id));
+    let body = next
+        .split('\n')
+        .map((line) => {
+        const m = ITEM_RE.exec(line);
+        return m && ticked.has(m[4]) ? `${m[1]}x${m[3]}` : line;
+    })
+        .join('\n');
+    // Items that disappeared, including ones already in an earlier "Checked earlier" list.
+    const gone = before.filter((l) => l.ticked && !present.has(l.id));
+    const seen = new Set();
+    const lines = gone.filter((l) => (seen.has(l.id) ? false : (seen.add(l.id), true))).map((l) => l.line.replace(/^\s*[-*] \[[ xX]\]/, '- [x]'));
+    if (!lines.length)
+        return body;
+    // Drop a "Checked earlier" block the new body may already carry, then add the merged one.
+    body = body.replace(/\n?<details><summary>Checked earlier[\s\S]*?<\/details>\n?/, '\n');
+    const block = `${EARLIER_OPEN} (${lines.length})</summary>\n\n${lines.join('\n')}\n\n</details>`;
+    // The block goes above the developer details of the new layout, else above the footer of the older one.
+    const at = Math.max(body.lastIndexOf(`\n${DETAILS_OPEN}`), body.lastIndexOf('\n<sub>localdost'));
+    return at >= 0 ? `${body.slice(0, at)}\n${block}\n${body.slice(at)}` : `${body}\n\n${block}`;
+}
+/** Lead lines that mark a comment as out of date, old and new wording. */
+const STALE_TEXT = ['This report is out of date', 'This review is out of date', 'is out of date, a new review is running'];
+/** How long a reader waits for the new report before asking for one. */
+export const STALE_WAIT_MINUTES = 15;
+const STALE_SUMMARY = 'Earlier report, for the previous push';
+/**
+ * Marks a rendered comment as out of date while a new run tests the latest push. The comment becomes three things: the
+ * hidden markers (the old head stays in its marker), the lead "This report is out of date." with what to do when no new
+ * report lands, and the old report folded away, so old advice is never read as current. The old body keeps its tick items,
+ * so ticks carry over to the new report. Comments in the format before KAT-96 have their "Head `sha` ·" line replaced instead.
+ * `recheckByReply` says whether a reply of `/localdost review` reaches this server; without it the reader pushes a commit.
+ */
+export function markStale(body, newHead, o = {}) {
+    const old = commentHead(body);
+    if (!old || STALE_TEXT.some((t) => body.includes(t)))
+        return body;
+    if (newHead && old && newHead.startsWith(old))
+        return body;
+    const lines = body.split('\n');
+    const legacy = lines.findIndex((l) => /^Head `[0-9a-f]+` · /.test(l));
+    if (legacy >= 0) {
+        lines[legacy] = `**Review of \`${old.slice(0, 12)}\` is out of date, a new review is running** for \`${(newHead || 'a new head').slice(0, 12)}\`.`;
+        return lines.join('\n');
+    }
+    const markers = lines.filter((l) => l.startsWith('<!--') && l.trim().endsWith('-->') && !/<!-- qa:t:/.test(l) && (l.includes('localdost:pr-summary') || QA_MARKER_RE.test(l)));
+    const rest = lines.filter((l) => !markers.includes(l));
+    const ask = o.recheckByReply === false ? 'push a new commit' : 'reply `/localdost review`';
+    return [
+        ...markers,
+        '**This report is out of date.** localdost is checking your latest push now.',
+        `If no new report appears within ${STALE_WAIT_MINUTES} minutes, ${ask}.`,
+        '',
+        `<details><summary>${STALE_SUMMARY}</summary>`,
+        '',
+        ...rest,
+        '',
+        '</details>',
+    ]
+        .join('\n')
+        .replace(/\n{3,}/g, '\n\n');
+}
+/** A spec title as a link to the file at the head sha. Without a repo or a head, the title alone: the path sits in Details. */
+function specTitleLink(o, head, n) {
+    const link = fileLink(o, head, { file: n.file });
+    const url = /\]\((https?:[^)]+)\)$/.exec(link)?.[1];
+    const title = noBrackets(n.title);
+    return url ? `[${title}](${url})` : title;
+}
+/** The Details part that names the file of each test to update, so the default view can show the title alone. */
+function impactNoteFiles(notes) {
+    const list = (notes ?? []).slice(0, MAX_UNTESTED);
+    return list.length ? [`**Tests to update, with files**\n\n${list.map((n) => `- ${noBrackets(n.title)}: ${code(n.file)}`).join('\n')}`] : [];
+}
+function tickLines(item, ticked) {
+    return [`- [${ticked.has(item.id) ? 'x' : ' '}] ${item.first} <!-- qa:t:${item.id} -->`, ...item.more.map((l) => `      ${l}`)];
+}
+/** The tick items for specs that a ticket changes and the PR leaves alone (KAT-304). */
+function impactNoteItems(notes, o, head) {
+    return (notes ?? []).map((n) => {
+        const ticket = n.ticketTitle ? `${n.ticket} (${inline(n.ticketTitle)})` : n.ticket;
+        return {
+            id: n.id,
+            first: `Update the test ${specTitleLink(o, head, n)} for ${ticket}: ${inline(sentence(n.why))}`,
+            more: ['This PR does not change that test. Open it, change what it checks, then run it.'],
+        };
+    });
+}
+/** A ticket key with its title chip: "PROD-123 (Guest checkout)". The key links to the ticket when the tracker gave a URL. */
+function ticketChip(t) {
+    const ref = noBrackets(t.ref);
+    const url = t.url && /^https?:\/\//i.test(t.url) ? t.url.replace(/[()\s]/g, (c) => encodeURIComponent(c)) : '';
+    const key = url ? `[${ref}](${url})` : ref;
+    const title = clipText(t.title, 70);
+    const shown = noBrackets(title);
+    return shown && title.toLowerCase() !== t.ref.toLowerCase() ? `${key} (${shown})` : key;
+}
+/** The lines of "Not covered by this PR": a criterion of a linked ticket that no changed line touches. A question, never a bug. */
+function notCoveredLines(review) {
+    return (review.criteriaNotCovered ?? []).slice(0, MAX_BUGS).map((c) => {
+        const t = review.linkedTickets?.find((x) => x.ref === c.ticket);
+        return `${ticketChip({ ref: c.ticket, title: '', ...(t?.url ? { url: t.url } : {}) })}: "${inline(clipText(c.text, 160))}" Does another PR cover this, or is it left out on purpose?`;
+    });
+}
+/** Details parts for the tickets the review read, and for the ones it could not read (KAT-388). */
+function linkedTicketParts(review) {
+    const parts = [];
+    const read = review.linkedTickets ?? [];
+    if (read.length) {
+        const lines = read.map((t) => {
+            const facts = [
+                t.state,
+                t.labels?.length ? `labels ${t.labels.map((l) => inline(l)).join(', ')}` : '',
+                t.milestone ? `milestone ${inline(t.milestone)}` : '',
+                `${t.criteria} acceptance ${t.criteria === 1 ? 'criterion' : 'criteria'}`,
+            ];
+            return `- ${ticketChip(t)}: ${facts.filter(Boolean).join(', ')}.`;
+        });
+        parts.push(`**Linked tickets read**\n\n${lines.join('\n')}`);
+    }
+    const unread = review.ticketsNotRead ?? [];
+    if (unread.length)
+        parts.push(`**Linked tickets not read**\n\n${unread.map((n) => `- ${inline(n.ref)}: ${inline(n.reason)}.`).join('\n')}\n\nThe review ran without ${unread.length === 1 ? 'it' : 'them'}.`);
+    return parts;
+}
+function areaName(review, areaId) {
+    return review.impactAreas.find((a) => a.id === areaId)?.area ?? '';
+}
+export function shownRisks(review, showFrom = 'medium') {
+    return review.risks
+        .filter((r) => r.verifier.status !== 'refuted' && SEV[r.severity] >= SEV[showFrom])
+        .sort((a, b) => SEV[b.severity] - SEV[a.severity] || statusRank(a.verifier.status) - statusRank(b.verifier.status));
+}
+function statusRank(s) {
+    return s === 'confirmed' ? 0 : s === 'uncertain' ? 1 : s === 'unverified' ? 2 : 3;
+}
+export function orderedTests(review) {
+    const sevOf = (t) => Math.max(-1, ...t.riskIds.map((id) => SEV[review.risks.find((r) => r.id === id)?.severity ?? 'low']));
+    return review.whatToTest
+        .filter((t) => t.verifier.status !== 'refuted')
+        .slice()
+        .sort((a, b) => PRIORITY[a.priority] - PRIORITY[b.priority] || sevOf(b) - sevOf(a) || a.id.localeCompare(b.id, 'en', { numeric: true }));
+}
+function verifierPass(review) {
+    return review.passes.find((p) => p.role === 'verifier');
+}
+/** "verifier confirmed 2, dropped 1", "verifier unavailable" or "not verified". Details only. */
+export function verifierLine(review) {
+    const v = verifierPass(review);
+    const all = [...review.risks, ...review.whatToTest, ...review.testsAtRisk, ...review.testGaps].map((c) => c.verifier.status);
+    const unavailable = all.length > 0 && all.every((s) => s === 'unverified');
+    if (!v)
+        return unavailable ? 'not verified' : 'verifier did not run';
+    if (unavailable)
+        return 'Verifier unavailable';
+    const confirmed = review.risks.filter((r) => r.verifier.status === 'confirmed').length;
+    const uncertain = review.risks.filter((r) => r.verifier.status === 'uncertain').length;
+    return `verifier confirmed ${confirmed}${uncertain ? `, uncertain ${uncertain}` : ''}, dropped ${review.droppedByVerifier.length}`;
+}
+/** The line of the PR comment and the check when a fork pull request got a review and no test run (KAT-384). */
+export const FORK_NOT_RUN_LINE = 'Tests did not run: this PR comes from a fork. Ask a maintainer to check it again.';
+/**
+ * The facts behind the bookkeeping lines of a draft, for the auto-reviewer (KAT-94). Counts and shas
+ * only: nothing here comes from untrusted PR, ticket, or log text.
+ */
+export function reviewEvidence(x) {
+    const out = [];
+    const r = x.report;
+    if (r?.notRun?.stage === 'skipped')
+        out.push(`Tests skipped: ${r.notRun.reason}`);
+    else if (r?.notRun)
+        out.push(`Tests did not run (stage ${r.notRun.stage}); there is no test report.`);
+    else if (r)
+        out.push(`Test report: ${r.passed} passed, ${r.failed} failed, ${r.flaky} flaky, ${r.skipped} skipped.${r.skipped ? ` ${plural(testsRan(r), 'test')} ran: a skipped test did not run.` : ''}`);
+    const q = x.review;
+    if (q) {
+        const risks = (st) => q.risks.filter((i) => i.verifier.status === st).length;
+        out.push(`Reviewed head ${(q.head || 'unknown').slice(0, 12)}.`);
+        out.push(`Verifier on the ${q.risks.length} risk${q.risks.length === 1 ? '' : 's'}: ${risks('confirmed')} confirmed, ${risks('uncertain')} uncertain, ${risks('unverified')} unverified; ${q.droppedByVerifier.length} refuted and dropped. "confirmed" means the verifier re-read the cited code and agreed the risk is worth testing, not that a bug was reproduced.`);
+        const c = q.coverage;
+        out.push(`Reviewer input: ${c.hunksDelivered} of ${c.hunks} changed ranges delivered, ${c.signalsDisposed} of ${c.signalsShown} signals disposed; review ${c.status}.`);
+        const ciRuns = q.ci?.jobs.length
+            ? ` CI at the reviewed head: ${q.ci.jobs.map((j) => `${j.name} ${j.status === 'completed' ? (j.conclusion ?? 'completed') : j.status}`).join(', ')}; ${q.ci.passed} test lines passed, ${q.ci.failed} failed.`
+            : '';
+        if (ciRuns)
+            out.push(ciRuns.trim());
+        const notRun = q.whatToTest.filter((t) => t.result === 'not_run').length;
+        out.push(`Checklist: ${q.whatToTest.length} test${q.whatToTest.length === 1 ? '' : 's'}, ${notRun} marked not run. Test gaps are a separate list of tests nobody has written: ${q.testGaps.length}.`);
+        for (const p of q.passes)
+            out.push(`${p.role} pass: ${p.model} (${p.backend}), ${p.rounds} round${p.rounds === 1 ? '' : 's'}.`);
+    }
+    if (x.verdict)
+        out.push(`Confidence ${Math.round(x.verdict.confidence * 100)}% is the analysis model's own score for this verdict.`);
+    if (x.newerHead)
+        out.push(`A review of the newer head ${x.newerHead.slice(0, 12)} has started${x.runId ? ` in run ${x.runId}` : ''}. This draft is the previous comment with only its head line changed to say so; its other lines describe the older head.`);
+    return out;
+}
+/**
+ * "85 passed, 53 skipped, 0 failed": passed, skipped and failed always, flaky when there were any. "85 of 138
+ * tests passed" hid 53 skipped tests and read as 53 failures (dogfood ledger).
+ */
+export function testCounts(r) {
+    const parts = [`${r.passed} passed`, `${r.skipped} skipped`, `${r.failed} failed`];
+    if (r.flaky)
+        parts.push(`${r.flaky} flaky`);
+    return parts.join(', ');
+}
+function testsLine(report) {
+    if (!report)
+        return 'No tests ran.';
+    if (report.notRun?.stage === 'skipped')
+        return 'The tests were skipped.';
+    if (report.notRun)
+        return 'The tests did not run.';
+    return `${testCounts(report)}.`;
+}
+/**
+ * What the automated tests did, in plain words, with skipped tests kept out of "ran" (KAT-402): "85 automated tests ran and
+ * passed. 53 were skipped (they do not apply to this project)." A failure or a retry keeps the counts: "3 automated tests ran:
+ * 2 passed, 1 failed." A run of skipped tests only says that all of them were skipped.
+ */
+function ranSentences(r) {
+    const ran = testsRan(r);
+    if (!ran) {
+        return r.skipped === 1
+            ? 'The automated test was skipped (it does not apply to this project).'
+            : `All ${r.skipped} automated tests were skipped (they do not apply to this project).`;
+    }
+    const parts = [`${r.passed} passed`];
+    if (r.failed)
+        parts.push(`${r.failed} failed`);
+    if (r.flaky)
+        parts.push(`${r.flaky} passed on retry`);
+    const head = !r.failed && !r.flaky ? `${plural(ran, 'automated test')} ran and passed.` : `${plural(ran, 'automated test')} ran: ${parts.join(', ')}.`;
+    return r.skipped ? `${head} ${skippedSentence(r.skipped)}` : head;
+}
+/**
+ * The line of the Details under "What I tested", without its bullet. Skipped tests are not part of "ran" (KAT-402):
+ * "Ran 85 selected tests: 85 passed, 0 failed. 53 were skipped (they do not apply to this project)." A run with no skipped test
+ * keeps the full count: "Ran 3 selected tests: 3 passed, 0 skipped, 0 failed."
+ */
+function ranDetail(r) {
+    const ran = testsRan(r);
+    if (!r.skipped)
+        return `Ran ${plural(ran, 'selected test')}: ${testCounts(r)}.`;
+    if (!ran)
+        return `${r.skipped === 1 ? 'The selected test was' : `All ${r.skipped} selected tests were`} skipped (${r.skipped === 1 ? 'it does' : 'they do'} not apply to this project).`;
+    const parts = [`${r.passed} passed`, `${r.failed} failed`];
+    if (r.flaky)
+        parts.push(`${r.flaky} flaky`);
+    return `Ran ${plural(ran, 'selected test')}: ${parts.join(', ')}. ${skippedSentence(r.skipped)}`;
+}
+/** A sentence that says the tests did not run ("no tests ran", "the tests were not run"). A scoped one ("no tests ran in Safari") is a coverage note and stays. */
+const NO_TESTS_RAN_RE = /\bno (?:automated |selected )?tests (?:ran|were run|were executed|have been run|have run)\b(?!\s+(?:in|on|for|against|under|with|across)\b(?!\s+(?:this|the|that)\s+(?:commit|pr|pull request|change|branch|head|run)\b))|\b(?:the )?tests? (?:did not|didn't|were not|was not|have not been|has not been) (?:run|ran|been run|executed)\b(?!\s+(?:in|on|for|against|under|with|across)\b(?!\s+(?:this|the|that)\s+(?:commit|pr|pull request|change|branch|head|run)\b))/i;
+/** The line of a Tests repo batch (testRepoSentence): the ran count, the counts that ran, and the skipped sentence when there is one. */
+const TEST_REPO_LINE_RE = /\bRan (\d+) (?:[^\n.:]*? )?tests? from [^\n:]+: ([^\n]*?)\.(?: (\d+) (?:was|were) skipped \([^)\n]*\)\.)?(?= |$|\n)/g;
+const QUOTE_PAIRS = { '"': '"', "'": "'", '`': '`', '\u201c': '\u201d', '\u2018': '\u2019' };
+const QUOTE_CLOSERS = new Set(Object.values(QUOTE_PAIRS));
+const MASK_OPEN = '\uE000';
+const MASK_CLOSE = '\uE001';
+/** Quoted text and link texts are not the dot's own claim (KAT-337). Each such span becomes a placeholder; `unmask` puts it back. */
+function maskQuoted(text) {
+    const spans = [];
+    const hold = (span) => {
+        spans.push(span);
+        return `${MASK_OPEN}${spans.length - 1}${MASK_CLOSE}`;
+    };
+    let out = text;
+    out = out.replace(/\[[^\]\n]*\]\([^)\n]*\)/g, hold);
+    // A test-plan row (`- `t2` should ...`) describes a check to run, and "claims that no tests ran" names a claim the change removes: neither says the tests did not run.
+    out = out.replace(/^[ \t]*[-*] `t\d+` should\b.*$/gm, hold);
+    out = out.replace(/(\bclaims?\s+(?:that\s+)?)(no\b[^.;\n]*)/gi, (_m, pre, claim) => pre + hold(claim));
+    // Quotes: an opener follows a space or an open bracket and precedes a word; a closer follows a word or punctuation and precedes a space or a close bracket. Nested quotes are counted.
+    const chars = [...out];
+    const res = [];
+    let depth = 0;
+    let start = -1;
+    const stack = [];
+    for (let i = 0; i < chars.length; i++) {
+        const c = chars[i];
+        const prev = i ? chars[i - 1] : ' ';
+        const next = i + 1 < chars.length ? chars[i + 1] : ' ';
+        const isOpenCh = c in QUOTE_PAIRS;
+        const isCloseCh = QUOTE_CLOSERS.has(c);
+        // Markdown emphasis (**, _, ~) around a quote counts as a boundary, so **"no tests ran"** is a quote too.
+        const prevOpens = /[\s([{:;,>*_~-]/.test(prev) || prev === MASK_CLOSE;
+        const nextCloses = /[\s)\]}.,:;!?<*_~-]/.test(next);
+        const opens = isOpenCh && (c === '\u201c' || c === '\u2018' || (prevOpens && !/\s/.test(next)));
+        const closes = isCloseCh && (c === '\u201d' || c === '\u2019' || !/\s/.test(prev)) && nextCloses && stack.length > 0;
+        if (depth > 0 && closes && QUOTE_PAIRS[stack[stack.length - 1]] === c) {
+            stack.pop();
+            depth--;
+            if (depth === 0) {
+                res.push(hold(chars.slice(start, i + 1).join('')));
+                continue;
+            }
+        }
+        else if (opens) {
+            if (depth === 0)
+                start = i;
+            stack.push(c);
+            depth++;
+            continue;
+        }
+        if (depth === 0)
+            res.push(c);
+    }
+    // An unclosed quote is plain text.
+    if (depth > 0)
+        res.push(...chars.slice(start));
+    const unmask = (t) => {
+        let cur = t;
+        for (let k = 0; k < 5 && cur.includes(MASK_OPEN); k++)
+            cur = cur.replace(new RegExp(`${MASK_OPEN}(\\d+)${MASK_CLOSE}`, 'g'), (_m, n) => spans[Number(n)] ?? '');
+        return cur;
+    };
+    return { masked: res.join(''), unmask };
+}
+/** True when the text says the tests did not run in the dot's own voice: quoted text and link texts do not count. */
+export function claimsNoTestsRan(text) {
+    return NO_TESTS_RAN_RE.test(maskQuoted(text).masked);
+}
+/** True when the run has results: tests ran, and the report lists them. */
+export function testsHaveResults(report) {
+    return !!report && !report.notRun && report.passed + report.failed + report.flaky + report.skipped > 0;
+}
+/**
+ * Test facts come from one source: the run's results (KAT-330). The review text is written before the run,
+ * so once the run has results, any sentence or clause that says the tests did not run is dropped.
+ * A run with no results keeps the text as it is.
+ */
+export function withoutNoTestsClaims(text, report) {
+    if (!testsHaveResults(report))
+        return text;
+    const { masked, unmask } = maskQuoted(text);
+    if (!NO_TESTS_RAN_RE.test(masked))
+        return text;
+    return unmask(masked
+        .split('\n')
+        .map((line) => NO_TESTS_RAN_RE.test(line)
+        ? line
+            .split(/(?<=[.!?])\s+/)
+            .map((sent) => {
+            if (!NO_TESTS_RAN_RE.test(sent))
+                return sent;
+            const kept = sent
+                .replace(/[.!?]+$/, '')
+                .split(/\s*[;:]\s+/)
+                .filter((c) => !NO_TESTS_RAN_RE.test(c));
+            return kept.length ? `${kept.join('; ')}.` : '';
+        })
+            .filter(Boolean)
+            .join(' ')
+        : line)
+        .filter((line, i, all) => line.trim() !== '' || (i > 0 && all[i - 1].trim() !== ''))
+        .filter((line) => !/^\s*[-*]\s*$/.test(line))
+        .join('\n')
+        .trim());
+}
+/**
+ * A sentence in the model's own words that gives a test count the run results already give: "Ran 138 tests from the e2e suite:
+ * 85 passed, 53 skipped." or "All 12 automated tests ran against staging." The counts have one source, the run (KAT-402), and
+ * the report check reads the counts line, never the model's prose. The wording is the same wording reportConsistency reads.
+ */
+const MODEL_TEST_COUNT_RE = [
+    /\bRan \d+ (?:[^\n.:]*? )?tests? from [^\n:]+:/,
+    /\b\d+ automated tests? ran\b/,
+    /\bRan \d+ selected tests?:/,
+    /\b\d+ (?:was|were) skipped \(/,
+];
+/** Drops the sentences of model prose that restate the run's test counts, once the run has results. Other sentences stay as written. */
+export function withoutTestCountClaims(text, report) {
+    if (!testsHaveResults(report))
+        return text;
+    const { masked, unmask } = maskQuoted(text);
+    const says = (t) => MODEL_TEST_COUNT_RE.some((re) => re.test(t));
+    if (!says(masked))
+        return text;
+    return unmask(masked
+        .split('\n')
+        .map((line) => says(line)
+        ? line
+            .split(/(?<=[.!?])\s+/)
+            .filter((sent) => !says(sent))
+            .join(' ')
+        : line)
+        .filter((line, i, all) => line.trim() !== '' || (i > 0 && all[i - 1].trim() !== ''))
+        .filter((line) => !/^\s*[-*]\s*$/.test(line))
+        .join('\n')
+        .trim());
+}
+function more(n, what) {
+    return n > 0 ? `And ${n} more ${what} in the run.` : '';
+}
+/** Ends a model sentence with a full stop, so one-line items read as sentences. */
+function sentence(s) {
+    const t = s.trim();
+    return !t || /[.!?:]$/.test(t) ? t : `${t}.`;
+}
+/**
+ * Model scenarios written before KAT-96 often open with "Verify" or "Ensure". A tester reads
+ * "Check" faster, so the lead word changes; the rest of the sentence stays as written.
+ */
+export function plainScenario(s) {
+    return s.trim().replace(/^(?:verify|ensure|validate|confirm)(?:\s+that)?\s+(\S)/i, (_m, c) => `Check ${c}`);
+}
+/** A test idea in a tester's verbs: "assert the total" is "check the total", and the ticket says what is wanted, not "the spec" (KAT-377). */
+export function testerIdea(s) {
+    return plainScenario(s)
+        .replace(/^asserts?\b/i, 'Check')
+        .replace(/\basserts?\b/gi, (w) => (w.toLowerCase() === 'asserts' ? 'checks' : 'check'))
+        .replace(/\bthe spec\b/gi, 'the ticket');
+}
+// ---------- file links ----------
+function basename(p) {
+    return p.split('/').pop() || p;
+}
+/** A file reference as a GitHub link at the head sha, or a code span when there is no repo. */
+export function fileLink(o, head, ref) {
+    const lines = ref.line && ref.line > 0 ? `:${ref.line}${ref.lineEnd && ref.lineEnd !== ref.line ? `-${ref.lineEnd}` : ''}` : '';
+    // A spec of a Tests repo links to that repo at the commit the tests ran at; without the commit it is a code span, never a link into the app repo.
+    const inTests = splitTestRepoFile(ref.file);
+    if (inTests.repo) {
+        const ran = (o.testRepos ?? o.report?.testRepos)?.find((t) => t.repo === inTests.repo && t.sha);
+        if (!ran)
+            return code(`${ref.file}${lines}`);
+        const base = (o.serverUrl ?? 'https://github.com').replace(/\/$/, '');
+        const path = clean(inTests.path)
+            .split('/')
+            .map((x) => encodeURIComponent(x))
+            .join('/');
+        const anchor = ref.line && ref.line > 0 ? `#L${ref.line}${ref.lineEnd && ref.lineEnd !== ref.line ? `-L${ref.lineEnd}` : ''}` : '';
+        return `[${code(`${basename(inTests.path)}${lines}`)}](${base}/${inTests.repo.split('/').map(encodeURIComponent).join('/')}/blob/${ran.sha}/${path}${anchor})`;
+    }
+    if (!o.repo || !head || ref.file === 'PR_BODY' || !/^[0-9a-f]{7,40}$/i.test(head))
+        return code(`${ref.file === 'PR_BODY' ? 'PR description' : ref.file}${lines}`);
+    const base = (o.serverUrl ?? 'https://github.com').replace(/\/$/, '');
+    const path = clean(ref.file)
+        .split('/')
+        .map((s) => encodeURIComponent(s))
+        .join('/');
+    const anchor = ref.line && ref.line > 0 ? `#L${ref.line}${ref.lineEnd && ref.lineEnd !== ref.line ? `-L${ref.lineEnd}` : ''}` : '';
+    const url = `${base}/${encodeURIComponent(o.repo.owner)}/${encodeURIComponent(o.repo.name)}/blob/${head}/${path}${anchor}`;
+    return `[${code(`${basename(ref.file)}${lines}`)}](${url})`;
+}
+/** Where a checklist item points: its existing test, else its first risk's line, else its area's first file. */
+function itemRef(review, t) {
+    if (t.existingTest)
+        return { file: t.existingTest };
+    for (const id of t.riskIds) {
+        const ev = review.risks.find((r) => r.id === id)?.evidence[0];
+        if (ev)
+            return ev;
+    }
+    const file = review.impactAreas.find((a) => a.id === t.areaId)?.files[0];
+    return file ? { file } : null;
+}
+const SEV_WORD = { critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low' };
+export function clipText(s, n) {
+    const t = clean(s).replace(/\s+/g, ' ').trim();
+    return t.length > n ? `${t.slice(0, n - 3).trimEnd()}...` : t;
+}
+function hasPassingTest(review, r) {
+    return review.whatToTest.some((t) => t.riskIds.includes(r.id) && t.result === 'passed');
+}
+/** The label a defect found by reading the code carries in the report, the Inbox card and the tracker. */
+export const READING_LABEL = 'found by reading the code';
+/** Words that say "some input might break it" without naming one. */
+const VAGUE_INPUT = /\b(?:some|certain|various|several|many|other|any|unusual|unexpected|unknown|invalid|bad|wrong|malformed|odd|edge|corner)[- ](?:inputs?|cases?|values?|data|conditions?|scenarios?|situations?|combinations?|requests?|users?)\b|\b(?:might|could|possibly|potentially|perhaps|unclear|not sure|n\/a|tbd)\b|^(?:none|unknown|various|anything|n\/a|tbd)\b/i;
+/** "may" as a hedge, never the month: "may fail" is vague, "May 31, 2026" names an input. */
+const HEDGE_MAY = /\bmay\b(?!\s+\d)|\bMay\b(?!\s+\d)(?=\s+(?:be|break|fail|happen|cause|not|return|throw|crash|lose|show)\b)/;
+/** A value a tester can type: a digit, a quoted or bracketed literal, a code span, or a named literal such as empty or null. */
+const INPUT_VALUE = /\d|["'`[\]{}()=<>]|\b(?:empty|blank|null|undefined|zero|negative|nan|true|false|missing|duplicate|twice|same)\b/i;
+/**
+ * True when a failing input names something a tester can try: "a cart with two items and the coupon SAVE10 twice",
+ * "an empty list". "Some edge cases" and "unexpected values" are vague, not concrete.
+ */
+export function concreteInput(input) {
+    const t = clean(input ?? '')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return t.length >= 6 && !VAGUE_INPUT.test(t) && !HEDGE_MAY.test(t) && INPUT_VALUE.test(t);
+}
+/** The line a risk cites, when it is a real file and line (not the PR description). */
+function citedLine(r) {
+    const e = r.evidence[0];
+    return e && e.file && e.file !== 'PR_BODY' && Number.isInteger(e.line) && e.line > 0 ? e : null;
+}
+export function bugKey(parts) {
+    return createHash('sha1')
+        .update(parts.map((p) => normalizeScenario(p)).join('\n'))
+        .digest('hex')
+        .slice(0, 10);
+}
+/**
+ * The same bug across runs, PRs and merges: no PR or merge scope in it, unlike bugKey (dogfood ledger: the same
+ * defect filed again from a later PR or commit). A failing test by file and title; a review finding by its title
+ * and the file it cites.
+ */
+export function bugSignature(bug) {
+    const parts = bug.test ? ['test', bug.test.file, bug.test.title] : ['review', bug.title, bug.ref?.file ?? ''];
+    // The same test or finding in two repos of one dot is two bugs. No repo (a single-repo dot) keeps the older signature.
+    if (bug.repo)
+        parts.push(bug.repo.toLowerCase());
+    return createHash('sha256')
+        .update(parts.map((p) => normalizeScenario(p)).join('\n'))
+        .digest('hex')
+        .slice(0, 12);
+}
+/** The signatures of a bug in the other repo shapes (KAT-326), for a lookup that must survive a repo added or removed. */
+export function bugSignatureAlts(bug, altRepos) {
+    return altRepos.map((a) => bugSignature({ ...bug, repo: a ?? undefined }));
+}
+/** Playwright errors carry "Expected: ..." and "Received: ..." lines; they are the expected and actual values. */
+function expectedActual(error) {
+    // Playwright colors the values in the error text; the color codes are not part of them.
+    const e = clean(String(error ?? '').replace(/\u001b\[[0-9;?]*[A-Za-z]/g, ''));
+    const exp = /Expected[^:\n]*:\s*(.+)/.exec(e)?.[1];
+    const rec = /(?:Received|Actual)[^:\n]*:\s*(.+)/.exec(e)?.[1];
+    const first = e.split('\n').find((l) => l.trim()) ?? 'The test failed.';
+    return { expected: clipText(exp ?? 'The test passes.', 160), actual: clipText(rec ?? first, 160) };
+}
+/**
+ * True when the runner cases of a check failed and every one of them shows an environment signature. A check is a repo
+ * spec, a generated Playwright spec or an AI-Vision case: each has its own runner case, found by file (KAT-325).
+ */
+function failedOnlyByEnvironment(item, report, ctx) {
+    if (!report)
+        return false;
+    const { existingTest, id } = item;
+    const generated = `pwgen/${safeName(id, 40)}.spec.ts`;
+    const aiVision = `aivision/${id}.yaml`;
+    const failed = report.cases.filter((c) => (c.status === 'failed' || c.status === 'timedOut') &&
+        ((!!existingTest && (c.file.endsWith(existingTest) || existingTest.endsWith(c.file))) || c.file === generated || c.file === aiVision));
+    return failed.length > 0 && failed.every((c) => environmentSignature(c, ctx));
+}
+/**
+ * Bugs, most severe first: every failed test case, then every confirmed risk at or above showFrom
+ * that no passing test clears. `scope` keeps keys apart per PR (or per merge sha).
+ */
+export function findBugs(review, report, o = {}) {
+    const scope = o.scope ?? '';
+    const repo = o.repo?.toLowerCase();
+    const repoPart = repo ? [repo] : [];
+    const altOf = (parts) => {
+        const keys = (o.altRepos ?? []).map((a) => bugKey(parts(a ? [a.toLowerCase()] : [])));
+        return keys.length ? { altKeys: keys } : {};
+    };
+    const out = [];
+    // A failure the verdict blames on the test or the environment is not a product bug: no defect for it.
+    const testBugs = o.outcome !== 'test_failure' && o.outcome !== 'environment_failure';
+    // An environment signature (full disk, cancelled job, load timeout, a new test's first run) is never a
+    // product bug, whatever the verdict model said (dogfood ledger).
+    const envCtx = { addedFiles: o.addedFiles, ...o.environment };
+    const failed = (testBugs ? (report?.cases ?? []) : []).filter((x) => (x.status === 'failed' || x.status === 'timedOut') && !environmentSignature(x, envCtx));
+    for (const c of failed.slice(0, 10)) {
+        const linked = review?.whatToTest.find((t) => t.existingTest && (c.file.endsWith(t.existingTest) || t.existingTest.endsWith(c.file)));
+        const ea = expectedActual(c.error);
+        // A connection or load-timeout failure the default branch does not show may be the change's own doing: say so.
+        const unanswered = appDidNotAnswer(c, envCtx);
+        out.push({
+            key: bugKey([scope, ...repoPart, 'test', c.file, c.title]),
+            ...altOf((r) => [scope, ...r, 'test', c.file, c.title]),
+            ...(repo ? { repo } : {}),
+            // An older build fails a new spec of the PR as well as a bad change does: say where it failed, and rank it as a risk.
+            title: `"${clipText(c.title, 80)}" ${o.sharedBuild ? 'failed against the shared QA build' : 'fails'}`,
+            severity: o.sharedBuild ? 'medium' : 'high',
+            source: 'test',
+            steps: linked?.steps?.length ? linked.steps : c.steps?.length ? c.steps : [`Run ${c.file}${c.title ? ` › "${clipText(c.title, 80)}"` : ''}.`],
+            ...(linked?.steps?.length || c.steps?.length ? {} : { runOnly: true }),
+            expected: linked?.expected ?? ea.expected,
+            actual: unanswered ? clipText(`${unanswered[0].toUpperCase()}${unanswered.slice(1)}. ${ea.actual}`, 200) : ea.actual,
+            ref: { file: c.file },
+            test: { file: c.file, title: c.title },
+            reproduced: !o.sharedBuild,
+        });
+    }
+    if (review) {
+        // A security and robustness risk is a risk to test: it becomes a bug only through a failed test, listed above.
+        for (const r of shownRisks(review, o.showFrom ?? 'medium').filter((x) => x.verifier.status === 'confirmed' && !hasPassingTest(review, x) && !isSecurityPassRisk(x))) {
+            const t = orderedTests(review).find((x) => x.riskIds.includes(r.id) && (x.steps?.length || x.expected));
+            // A linked check that failed (a spec, a generated test, an AI-Vision step, a CI job) reproduces the risk.
+            // An environment failure (a full disk, a cancelled job) never reproduces a risk (KAT-321). A check the dot ran against the
+            // shared build does not either (KAT-363): only the PR's own CI does.
+            const reproduced = o.outcome !== 'environment_failure' &&
+                review.whatToTest.some((x) => x.riskIds.includes(r.id) && x.result === 'failed' && !(o.sharedBuild && x.resultSource === 'runner') && !failedOnlyByEnvironment(x, report, envCtx));
+            // Not reproduced, but one cited line and one input that breaks it: a code-path risk, filed as a defect.
+            const byReading = !reproduced && o.outcome !== 'environment_failure' && r.kind !== 'prompt_injection' && !!citedLine(r) && concreteInput(r.failingInput);
+            out.push({
+                reproduced,
+                ...(byReading ? { foundByReading: true, failingInput: clipText(r.failingInput ?? '', 200) } : {}),
+                key: bugKey([scope, ...repoPart, 'risk', r.title, r.evidence[0]?.file ?? '']),
+                ...altOf((p) => [scope, ...p, 'risk', r.title, r.evidence[0]?.file ?? '']),
+                ...(repo ? { repo } : {}),
+                title: r.title,
+                severity: r.verifier.severity ?? r.severity,
+                source: 'review',
+                steps: t?.steps?.length ? t.steps : t ? [t.scenario] : [],
+                expected: t?.expected ?? '',
+                actual: r.userImpact,
+                why: r.why,
+                ref: r.evidence[0],
+                riskId: r.id,
+            });
+        }
+    }
+    return out;
+}
+function defectLink(bug, links) {
+    const d = links?.[bug.key];
+    if (!d)
+        return '';
+    if (d.state === 'filed')
+        return d.url ? ` Defect: [filed](${d.url}).` : ' Defect: filed.';
+    if (d.state === 'rejected')
+        return ' Defect: not filed (rejected in the Inbox).';
+    const drafted = d.where ? `drafted for ${d.where}` : 'drafted';
+    return d.url ? ` Defect: [${drafted}, waiting in the Inbox](${d.url}).` : ` Defect: ${drafted}, waiting in the localdost Inbox.`;
+}
+function bugLines(bug, head, o) {
+    const reading = bug.foundByReading ? ` Found by reading the code, not reproduced (lower confidence).` : '';
+    const out = [`- **${inline(sentence(bug.title))}** ${SEV_WORD[bug.severity]}.${reading}${defectLink(bug, o.defects)}`];
+    if (bug.steps.length)
+        out.push(`  - Steps: ${bug.steps
+            .slice(0, 4)
+            .map((s, i) => `${i + 1}) ${inline(clipText(s, 110)).replace(/[.;]+$/, '')}`)
+            .join('; ')}.`);
+    const ea = [bug.expected ? `Expected: ${sentence(inline(bug.expected))}` : '', bug.actual ? `Actual: ${sentence(inline(bug.actual))}` : ''].filter(Boolean);
+    if (ea.length)
+        out.push(`  - ${ea.join(' ')}`);
+    if (bug.foundByReading && bug.failingInput)
+        out.push(`  - Input that breaks it: ${inline(sentence(bug.failingInput))}`);
+    const ev = [];
+    if (bug.test)
+        ev.push(`failing test ${fileLink(o, head, { file: bug.test.file })}`);
+    else if (bug.ref)
+        ev.push(`the code at ${fileLink(o, head, bug.ref)}`);
+    if (o.runUrl)
+        ev.push(`[the run](${o.runUrl}) with logs${bug.test ? ', screenshots and traces' : ''}`);
+    if (ev.length)
+        out.push(`  - Evidence: ${ev.join(', ')}.`);
+    return out;
+}
+/**
+ * The PR as the defect names it: `#12` in the repo the defect is filed in, `owner/name#12` in any other, so a defect
+ * filed in a shared tracker repo points at the PR of the code repo and not at issue 12 of its own repo (KAT-355).
+ */
+export function prRefIn(prNumber, repo, filedIn) {
+    if (!repo || !filedIn || filedIn.toLowerCase() === `${repo.owner}/${repo.name}`.toLowerCase())
+        return `#${prNumber}`;
+    return `${repo.owner}/${repo.name}#${prNumber}`;
+}
+/** Does the tracker show the For developers fold? GitHub renders <details>; Jira gets it as an expand node (markdownToAdf); Linear shows the tags as text. */
+export const foldsDefect = (tracker) => tracker !== 'linear';
+/** The label a defect gets when no one wrote steps a person can follow. */
+export const NEEDS_MANUAL_STEPS_LABEL = 'needs-manual-steps';
+const DEFAULT_EXPECTED = 'The test passes.';
+const unquote = (s) => s.replace(/^(["'`])(.*)\1$/, '$2').trim();
+/** The two values a failed assertion compared, when both are short enough to read in a title. Null for a thrown error or a timeout. */
+function defectValues(bug) {
+    const expected = unquote(clean(bug.expected).trim());
+    const actual = unquote(clean(bug.actual).trim());
+    if (!expected || !actual || expected === DEFAULT_EXPECTED)
+        return null;
+    if (expected.length > 40 || actual.length > 40 || /\n/.test(`${expected}${actual}`))
+        return null;
+    if (/\bexpect\(|^\w*Error\b|\btimeout\b|\bwaiting for\b|\bstrict mode\b/i.test(`${expected} ${actual}`))
+        return null;
+    return { expected, actual };
+}
+const upperFirst = (s) => (s ? `${s[0].toUpperCase()}${s.slice(1)}` : s);
+/** What the reader sees in a tracker list: what went wrong, with both values when the test compared two. */
+export function defectTitle(bug) {
+    if (bug.source === 'test' && bug.test) {
+        const name = upperFirst(clipText(bug.test.title.replace(/^\[[^\]]+\]\s*/, '').replace(/\s*›\s*/g, ' › '), 80));
+        const v = defectValues(bug);
+        return clipText(v ? `${name}: ${v.actual} instead of ${v.expected}` : `${name} fails`, 140);
+    }
+    return clipText(upperFirst(clean(bug.title)), 140);
+}
+/** The command a developer runs to see the test fail. */
+function runCommand(test) {
+    const name = test.title.replace(/^\[[^\]]+\]\s*/, '').replace(/\s*›\s*/g, ' ');
+    const pattern = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/"/g, '\\"');
+    return `npx playwright test ${splitTestRepoFile(test.file).path} -g "${pattern}"`;
+}
+/**
+ * The defect body for the tracker, for a person who reads the issue first and the code later (KAT-377): what it costs
+ * and when it was found, the severity, steps to reproduce, expected and actual, the evidence, the likely cause, and what
+ * it relates to. The run command, the error text, the commit and the bug signature sit under For developers. When the test
+ * names no steps and no test case has any, the steps say to run the automated test and `needsManualSteps` is true, so the
+ * caller labels the issue.
+ */
+export function renderDefect(bug, o) {
+    const reading = !!bug.foundByReading;
+    const values = bug.source === 'test' ? defectValues(bug) : null;
+    // A connection or load failure on a change that touches app code says the change may be the cause (KAT-308).
+    const note = `${APP_DID_NOT_ANSWER[0].toUpperCase()}${APP_DID_NOT_ANSWER.slice(1)}.`;
+    const unanswered = bug.source === 'test' && bug.actual.startsWith(note) ? note : '';
+    const pr = o.prNumber ? prRefIn(o.prNumber, o.repo, o.filedIn) : '';
+    // The first line says what this costs a person. Expected and Actual below hold the two values, so they are not said again here.
+    const feature = clipText((bug.test?.title ?? bug.title)
+        .replace(/^\[[^\]]+\]\s*/, '')
+        .split(/\s*›\s*/)
+        .pop() ?? '', 80);
+    const impact = bug.source === 'test'
+        ? values
+            ? `People who use "${inline(feature)}" get a wrong result.`
+            : `"${inline(feature)}" does not work.${unanswered ? ` ${unanswered}` : ''}`
+        : inline(sentence(bug.actual || bug.title));
+    const found = reading
+        ? 'Found by reading the code, not by running it.'
+        : pr
+            ? o.task === 'post_merge'
+                ? `Found after PR ${pr} merged.`
+                : `Found while ${bug.source === 'review' ? 'reviewing' : 'testing'} PR ${pr}.`
+            : bug.source === 'review'
+                ? 'Found by reading the change.'
+                : 'Found in a test run.';
+    const lines = [`${impact} ${found}`, ''];
+    const attempts = o.attempts && o.attempts > 0 ? ` Failed ${o.attempts} of ${o.attempts} times, so it is not flaky.` : '';
+    lines.push(`Severity: ${SEV_WORD[bug.severity]}.${attempts}`, '');
+    if (reading)
+        lines.push('Confidence: lower. Nobody ran this. It comes from reading the code.', '');
+    // Steps a person can follow: the test's own step names, a review's steps, or the steps of the linked test case.
+    let needsManualSteps = false;
+    const steps = bug.runOnly ? (o.testCase?.steps.length ? o.testCase.steps : []) : bug.steps;
+    if (steps.length)
+        lines.push('**Steps to reproduce**', '', ...steps.slice(0, 8).map((x, i) => `${i + 1}. ${inline(x)}`), '');
+    else if (bug.runOnly) {
+        needsManualSteps = true;
+        lines.push('**Steps to reproduce**', '', 'Run the automated test in For developers.', '');
+    }
+    // A failed test with no two values has only an error text, which is for developers.
+    const showValues = bug.source !== 'test' || !!values;
+    // Two short values read as values ("Expected: $108.00"); a review writes sentences.
+    const say = (x) => (values ? inline(x) : inline(sentence(x)));
+    // One paragraph per fact: a renderer that joins single line breaks (the Inbox, Linear) keeps them apart, and Jira gets one paragraph each.
+    if (showValues && bug.expected)
+        lines.push(`Expected: ${say(values?.expected ?? bug.expected)}`, '');
+    if (showValues && bug.actual)
+        lines.push(`Actual: ${say(values?.actual ?? bug.actual)}`, '');
+    const evidence = [
+        ...(o.evidence?.screenshot ? [`[screenshot](${o.evidence.screenshot})`] : []),
+        ...(o.evidence?.video ? [`[video](${o.evidence.video})`] : []),
+        ...(o.runUrl ? [`[the check](${o.runUrl})`] : []),
+    ];
+    const facts = [];
+    if (evidence.length)
+        facts.push(`Evidence: ${evidence.join(' · ')}`);
+    if (bug.ref && !bug.test) {
+        // A bug found by reading the code always shows the plain file:line, even when the link text is only the file name.
+        const link = fileLink(o, o.head, bug.ref);
+        const plainRef = code(refText(bug.ref));
+        facts.push(`Code: ${reading && link !== plainRef ? `${plainRef} (${link})` : link}`);
+    }
+    if (reading && bug.failingInput)
+        facts.push(`Input that breaks it: ${inline(sentence(bug.failingInput))}`);
+    // The suspect holds a PR title, which anyone can write: no mention, no tag, no hidden marker gets through.
+    if (o.suspected)
+        facts.push(`Likely cause: ${noMentions(o.suspected.replace(/</g, '&lt;'))}`);
+    if (o.testCase?.line)
+        facts.push(o.testCase.line);
+    for (const r of o.relates ?? [])
+        facts.push(`${r}.`);
+    lines.push(...facts.flatMap((f) => [f, '']));
+    while (lines[lines.length - 1] === '')
+        lines.pop();
+    const dev = [];
+    if (bug.test)
+        dev.push(`- Run${isTestRepoFile(bug.test.file) ? ` in ${code(splitTestRepoFile(bug.test.file).repo ?? '')}` : ''}: ${code(runCommand(bug.test))}`, `- Test: ${fileLink(o, o.head, { file: bug.test.file })} › "${inline(bug.test.title)}"`);
+    if (o.evidence?.trace)
+        dev.push(`- Trace: ${o.evidence.trace}`);
+    if (o.head)
+        dev.push(`- Commit: ${code(o.head.slice(0, 7))}`);
+    if (o.errorLines?.length)
+        dev.push('', ...o.errorLines);
+    if (o.signature)
+        dev.push('', `localdost bug signature: ${code(o.signature)}`);
+    if (dev.length) {
+        const inner = dev
+            .join('\n')
+            .replace(/^\n+/, '')
+            .replace(/\n{3,}/g, '\n\n')
+            .replace(/\n+$/, '');
+        lines.push('', o.collapse === false ? `**For developers**\n\n${inner}` : `<details><summary>For developers</summary>\n\n${inner}\n\n</details>`);
+    }
+    // Every model-written part went through inline() or code() above, which escape mentions and comment markers.
+    return { title: defectTitle(bug), body: lines.join('\n').trim(), needsManualSteps };
+}
+// ---------- the report ----------
+const RESULT_WORD = { passed: 'Passed', failed: 'Failed', flaky: 'Flaky (passed on retry)' };
+const ENGINE_LABEL = { spec: 'an existing test', playwright: 'a Playwright e2e test', aivision: 'an AI-Vision browser check' };
+/** " (checked by a Playwright e2e test)" for items no existing test covered and a runner engine ran. */
+function engineNote(t) {
+    const engines = (t.coveredBy ?? []).filter((e) => e !== 'spec');
+    return engines.length && t.resultSource === 'runner' ? ` (checked by ${engines.map((e) => ENGINE_LABEL[e]).join(' and ')})` : '';
+}
+function testedLines(review, tests, o) {
+    const out = [];
+    const r = o.report;
+    if (r && !r.notRun) {
+        out.push(`- ${ranDetail(r)}`);
+    }
+    if (r?.hint)
+        out.push(`- ${inline(r.hint)}`);
+    const ci = ciLine(review.ci);
+    if (ci)
+        out.push(ci);
+    for (const t of tests) {
+        if (t.result !== 'passed' && t.result !== 'failed' && t.result !== 'flaky')
+            continue;
+        const ref = itemRef(review, t);
+        const by = t.resultSource === 'manual'
+            ? ' (checked by hand)'
+            : t.resultSource === 'ci'
+                ? ` (${t.result === 'failed' ? 'failed' : 'passed'} in CI job ${inline(t.ciJob ?? 'unknown')})`
+                : engineNote(t);
+        out.push(`- **${RESULT_WORD[t.result]}:** ${inline(sentence(plainScenario(t.scenario)))}${by}${ref ? ` ${fileLink(o, review.head, ref)}` : ''}`);
+    }
+    return out;
+}
+/** "Tests in CI: 12 passed (job unit) on abc1234." Lists only jobs that printed a test line. A job still running adds nothing. */
+function ciLine(ci) {
+    if (!ci)
+        return '';
+    const jobs = ci.jobs.filter((j) => j.status === 'completed' && j.passed + j.failed > 0);
+    const passed = jobs.reduce((n, j) => n + j.passed, 0);
+    const failed = jobs.reduce((n, j) => n + j.failed, 0);
+    if (!passed && !failed)
+        return '';
+    const names = jobs.map((j) => inline(j.name)).join(', ');
+    const counts = failed ? `${passed} passed, ${failed} failed` : `${passed} passed`;
+    return `- Tests in CI: ${counts} (${jobs.length === 1 ? 'job' : 'jobs'} ${names}) on ${code(ci.head.slice(0, 7))}.`;
+}
+const SETTLED = new Set(['passed', 'failed', 'flaky']);
+function whyNotTested(t, ci) {
+    if (t.result === 'skipped')
+        return 'the test was skipped';
+    if (t.noManualStep)
+        return 'no step a tester can run without a screen exists, so a developer test has to cover it';
+    if (t.existingTest && t.result === 'not_run' && ci?.jobs.some((j) => j.status !== 'completed'))
+        return 'the CI job is still running';
+    if (t.existingTest)
+        return t.result === 'not_run' ? 'the test runner did not run this file' : 'it was not in the selected tests';
+    if (t.type === 'manual' || t.type === 'exploratory')
+        return 'it needs a person';
+    return 'no test covers it yet';
+}
+/** A check with steps or an expected result and no test of its own is a thing to try by hand. Anything else stays with the developer. */
+function triedByHand(t) {
+    return !t.existingTest && !!(t.steps?.length || t.expected);
+}
+/** One manual check as a tick item: the scenario, then its steps, its data and its expected result under it. */
+function handItem(t) {
+    const steps = (t.steps ?? [])
+        .slice(0, 6)
+        .map((x) => inline(clipText(x, 140)).replace(/[.;]+$/, ''))
+        .filter(Boolean);
+    const same = steps.length === 1 && normalizeScenario(t.steps?.[0] ?? '') === normalizeScenario(t.scenario);
+    const more = [];
+    if (steps.length && !same)
+        more.push(`Steps: ${steps.map((x, i) => `${i + 1}) ${x}`).join('; ')}.`);
+    if (t.data)
+        more.push(`Data: ${sentence(inline(clipText(t.data, 160)))}`);
+    if (t.expected)
+        more.push(`Expect: ${sentence(inline(clipText(t.expected, 200)))}`);
+    return { id: checklistId(t), first: inline(sentence(plainScenario(t.scenario))), more };
+}
+/**
+ * A risk the review could not confirm, worded for the person who tries it. When the PR description, a linked ticket or the
+ * docs say the change does this on purpose, the item says so and asks whether users should see something else.
+ */
+function possibleBugItem(review, title, areaId, userImpact, why, failingInput) {
+    const intent = matchIntent({ title, actual: userImpact, expected: '', why, reproduced: false }, review.intents ?? []);
+    const id = checklistId({ areaId: areaId ?? '', scenario: `risk ${title}` });
+    const first = inline(sentence(clipText(title, 160)));
+    const input = failingInput ? [`Try this input: ${sentence(inline(clipText(failingInput, 200)))}`] : [];
+    return intent
+        ? { id, first: `${first} ${intentWhere(intent)} this is on purpose.`, more: [...input, 'If users should see something else here, this is a bug.'] }
+        : {
+            id,
+            first,
+            more: [
+                ...input,
+                input.length
+                    ? 'If it breaks, this is a bug.'
+                    : review.backendOnly
+                        ? 'Try it with an API call or a command. If the answer is not what users should get, this is a bug.'
+                        : 'Try it. If this is not what users should see, this is a bug.',
+            ],
+        };
+}
+function openItems(review, tests, risks, o) {
+    const handTests = [];
+    const other = [];
+    for (const t of tests.filter((x) => !SETTLED.has(x.result ?? ''))) {
+        if (triedByHand(t)) {
+            handTests.push({ test: t, item: handItem(t) });
+            continue;
+        }
+        const ref = itemRef(review, t);
+        other.push(`${code(t.id)} ${inline(sentence(plainScenario(t.scenario)))} Not tested: ${whyNotTested(t, review.ci)}${ref ? ` (${fileLink(o, review.head, ref)})` : ''}.`);
+    }
+    const possibleBugs = risks.filter((x) => x.verifier.status !== 'confirmed').map((r) => possibleBugItem(review, r.title, r.areaId, r.userImpact, r.why));
+    return { handTests, possibleBugs, other };
+}
+/** "Note: ..." when the change touches product code and the repo's changelog has no new Unreleased line. */
+export function changelogNoteLine(review) {
+    if (!review.changelog)
+        return '';
+    return `**Note:** this change touches product code, but ${code(review.changelog.file)} has no new line under Unreleased. Add one plain sentence about what changes for the people who use the product.`;
+}
+function suggestionLines(review, o) {
+    const out = [];
+    for (const g of review.testGaps.filter((x) => x.verifier.status !== 'refuted')) {
+        const area = areaName(review, g.areaId);
+        // The first sentence names the gap; the full text stays in Details.
+        const gap = clean(g.missing).split(/(?<=[.!?])\s+/)[0] ?? g.missing;
+        out.push(`- Add ${/^[aeiu]/i.test(g.type) ? 'an' : 'a'} ${g.type} test${area ? ` for ${inline(area)}` : ''}: ${inline(sentence(gap.charAt(0).toLowerCase() + gap.slice(1)))}`);
+    }
+    for (const k of review.testsAtRisk.filter((x) => x.verifier.status !== 'refuted')) {
+        out.push(`- Update ${fileLink(o, review.head, { file: k.path, line: k.testLine })}: ${inline(sentence(k.reason))}`);
+    }
+    return out.slice(0, MAX_SUGGESTIONS);
+}
+/** The lines without repeats, ignoring case and spacing; the first one stays. */
+function uniqueLines(lines) {
+    const seen = new Set();
+    return lines.filter((l) => {
+        const k = l.toLowerCase().replace(/\s+/g, ' ').trim();
+        return !seen.has(k) && seen.add(k);
+    });
+}
+function plural(n, one, many = `${one}s`) {
+    return `${n} ${n === 1 ? one : many}`;
+}
+/** An Expected that hands the decision to someone else, or asks instead of stating a result. */
+const DESIGN_QUESTION = /\b(?:the )?(?:team|product(?: owner)?|owner|maintainers?|reviewers?|a person|someone|stakeholders?)\s+(?:decides?|chooses?|confirms?|agrees?|to decide|should decide|must decide)\b|\bconfirm (?:that )?(?:this|it|the [\w ]+) is (?:wanted|intended|desired|expected|on purpose)\b|\bdecide (?:whether|if|on)\b|\b(?:tbd|to be decided|to be confirmed|undecided|unclear|not specified|unspecified)\b|\bdepends on (?:the|what|whether)\b|\?\s*$/i;
+/**
+ * True when an Expected names a result a tester can check. Empty, a design question ("the team decides",
+ * "confirm this is wanted"), or a question mark is not concrete (dogfood ledger: no Expected, no defect).
+ */
+export function concreteExpected(expected) {
+    const t = clean(expected ?? '').trim();
+    return t.length > 0 && !DESIGN_QUESTION.test(t);
+}
+/**
+ * Splits findings into bugs (reproduced, with a concrete Expected), risks to test (confirmed in the code, not
+ * reproduced), and questions (an Expected that is a design question, or a reproduced finding with no Expected).
+ */
+export function reportFacts(all, intents = []) {
+    // A stated decision wins over every other bucket: the change does what its author said it does.
+    const behaviorChanges = [];
+    const findings = [];
+    for (const b of all) {
+        const intent = matchIntent({ title: b.title, actual: b.actual, expected: b.expected, why: b.why, reproduced: b.reproduced }, intents);
+        if (intent)
+            behaviorChanges.push({ bug: b, intent });
+        else
+            findings.push(b);
+    }
+    const question = (b) => (b.expected.trim() ? !concreteExpected(b.expected) : b.reproduced);
+    return {
+        bugs: findings.filter((b) => b.reproduced && !question(b)),
+        risksToTest: findings.filter((b) => !b.reproduced && !question(b)),
+        questions: findings.filter(question),
+        behaviorChanges,
+    };
+}
+/** The question a finding without a concrete Expected becomes, for the PR comment and the ticket. */
+export function questionFor(b) {
+    const said = clean(b.expected).trim();
+    return `${sentence(clipText(b.title, 160))} What should happen here?${said ? ` The review could only say: "${clipText(said, 120)}".` : ''}${b.actual ? ` Today: ${sentence(clipText(b.actual, 160))}` : ''}`;
+}
+/** What to test items that count (the verifier did not refute them) and have no settled result yet. */
+export function untestedChecks(review) {
+    return (review?.whatToTest ?? []).filter((t) => t.verifier.status !== 'refuted' && !['passed', 'failed', 'flaky'].includes(t.result ?? '')).length;
+}
+export function testSummary(review, report, bugs, untested, risks = 0, questions = 0, behaviorChanges = 0, shared = false) {
+    const names = (review?.impactAreas ?? []).map((a) => clean(a.area)).filter(Boolean);
+    const areas = names.length > 1 ? `${names[0]} and ${names.length - 1} more area${names.length === 2 ? '' : 's'}` : (names[0] ?? '');
+    const notRun = !!report?.notRun;
+    const total = report && !notRun ? report.passed + report.failed + report.flaky + report.skipped : 0;
+    const passed = report && !notRun ? report.passed : 0;
+    const parts = [bugs ? `${plural(bugs, 'bug')} found` : 'no bugs found'];
+    if (risks)
+        parts.push(`${plural(risks, 'risk')} to test`);
+    if (questions)
+        parts.push(`${plural(questions, 'question')} for the team`);
+    if (behaviorChanges)
+        parts.push(`${plural(behaviorChanges, 'behavior change')} to confirm`);
+    if (untested)
+        parts.push(`${plural(untested, 'check')} not tested yet`);
+    if (total && report)
+        parts.push(`tests: ${testCounts(report)}`);
+    const what = areas
+        ? `${notRun ? 'Read the code of' : report ? 'Tested' : 'Reviewed'} ${areas}${shared && report && !notRun ? ' on the shared QA build' : ''}`
+        : notRun
+            ? 'Read the change'
+            : report
+                ? shared
+                    ? 'Tested the shared QA build'
+                    : 'Tested this change'
+                : 'Reviewed this change';
+    const lead = notRun
+        ? report?.notRun?.fork
+            ? `${FORK_NOT_RUN_LINE} `
+            : report?.notRun?.stage === 'skipped'
+                ? 'Tests skipped. '
+                : report?.notRun?.stage === 'checkout'
+                    ? 'No tests have run for this commit yet. '
+                    : 'The tests did not run. '
+        : '';
+    const counted = report && !notRun;
+    const skipped = counted ? report.skipped : 0;
+    const failed = counted ? report.failed : 0;
+    const flaky = counted ? report.flaky : 0;
+    return {
+        areas,
+        bugs,
+        risks,
+        questions,
+        behaviorChanges,
+        untested,
+        passed,
+        skipped,
+        failed,
+        flaky,
+        total,
+        notRun,
+        ...(report?.notRun?.stage === 'skipped' ? { testsSkipped: true } : {}),
+        line: clipText(`${lead}${what}: ${parts.join(', ')}.`, 200),
+    };
+}
+/** One line for a lock screen or a run step, under 120 characters. Never merge advice. */
+export function summaryHeadline(s, prNumber) {
+    const parts = [s.bugs ? `${plural(s.bugs, 'bug')} found` : 'no bugs found'];
+    if (s.risks)
+        parts.push(`${plural(s.risks, 'risk')} to test`);
+    if (s.questions)
+        parts.push(`${plural(s.questions, 'question')} for the team`);
+    if (s.behaviorChanges)
+        parts.push(`${plural(s.behaviorChanges, 'behavior change')} to confirm`);
+    if (s.untested)
+        parts.push(`${s.untested} not tested yet`);
+    if (s.total)
+        parts.push(`tests: ${s.passed} passed, ${s.skipped} skipped, ${s.failed} failed${s.flaky ? `, ${s.flaky} flaky` : ''}`);
+    if (s.notRun)
+        parts.unshift(s.testsSkipped ? 'tests skipped' : 'tests did not run');
+    return clipText(`${prNumber ? `PR #${prNumber}` : 'Change'}: ${parts.join(', ')}.`, 120);
+}
+// ---------- consistency ----------
+/** The counts a summary line or headline states, read back from its text. Null when the text states no counts. */
+export function statedCounts(text) {
+    const t = clean(text);
+    const bugs = /\bno bugs found\b/i.test(t) ? 0 : Number(/\b(\d+) bugs? found\b/i.exec(t)?.[1] ?? NaN);
+    if (!Number.isFinite(bugs))
+        return null;
+    const risks = Number(/\b(\d+) risks? to test\b/i.exec(t)?.[1] ?? 0);
+    const questions = Number(/\b(\d+) questions? for the team\b/i.exec(t)?.[1] ?? 0);
+    const behaviorChanges = Number(/\b(\d+) behavior changes? to confirm\b/i.exec(t)?.[1] ?? 0);
+    const untested = Number(/\b(\d+) (?:checks? )?not tested yet\b/i.exec(t)?.[1] ?? 0);
+    return { bugs, risks, questions, behaviorChanges, untested };
+}
+/** Items listed under a "### Title" section of a report body, plus its "And N more ... in the run." line. */
+function listedUnder(body, title, item) {
+    const lines = body.split('\n');
+    const at = lines.findIndex((l) => l.trim() === `### ${title}`);
+    if (at < 0)
+        return 0;
+    let n = 0;
+    for (const l of lines.slice(at + 1)) {
+        if (/^### |^<details>/.test(l))
+            break;
+        if (item.test(l))
+            n++;
+        const more = /^And (\d+) more \w+ in the run\.$/.exec(l.trim());
+        if (more)
+            n += Number(more[1]);
+    }
+    return n;
+}
+/** The counts the first line of the tester report states ("2 things need a person to try", "1 test failed"), read back from its text. */
+function testerCounts(verdict) {
+    const n = (re) => Number(re.exec(verdict)?.[1] ?? 0);
+    return {
+        failed: n(/\b(\d+) tests? failed\b/i),
+        bugs: n(/\b(\d+) bugs? found\b/i),
+        hand: n(/\b(\d+) things? needs? a person to try\b/i),
+        questions: n(/\b(\d+) questions? for the team\b/i),
+        behaviorChanges: n(/\b(\d+) behavior changes? to confirm\b/i),
+    };
+}
+/** A check title in the tester wording: "1 test failed: ...", "1 bug found: ...", "Passed. 2 things to try by hand". Null for the older title. */
+function testerTitleCounts(title) {
+    if (!/^(?:Passed\b|Nothing failed\b|\d+ tests? failed\b|\d+ bugs? found\b|Tests (?:did not run|skipped)\b|Needs a look\b)/.test(title))
+        return null;
+    const n = (re) => Number(re.exec(title)?.[1] ?? 0);
+    return { failed: n(/^(\d+) tests? failed\b/), bugs: n(/^(\d+) bugs? found\b/), hand: n(/\b(\d+) things? to try by hand\b/) };
+}
+/** The "Bug:" lines of a check summary, plus its "And N more bugs in the run." line. */
+function bugLinesIn(text) {
+    let n = 0;
+    for (const l of text.split('\n')) {
+        if (/^Bug: /.test(l))
+            n++;
+        const more = /^And (\d+) more bugs in the run\.$/.exec(l.trim());
+        if (more)
+            n += Number(more[1]);
+    }
+    return n;
+}
+/**
+ * Every number a report states against the one structured summary it was built from (dogfood ledger: "N checks
+ * not tested yet" that did not match the list below it). Returns one sentence per difference; empty when the
+ * headline, the check title, and each body agree with the summary. `bodies` are reports in the older layout,
+ * `comments` the PR comment in the tester layout, `checks` the visible text of a check in that layout.
+ */
+export function reportConsistency(s, parts) {
+    const out = [];
+    const want = { bugs: s.bugs, risks: s.risks, questions: s.questions ?? 0, behaviorChanges: s.behaviorChanges ?? 0, untested: s.untested };
+    const word = {
+        bugs: 'bugs',
+        risks: 'risks',
+        questions: 'questions',
+        behaviorChanges: 'behavior changes',
+        untested: 'not tested yet',
+    };
+    const compare = (what, got) => {
+        if (!got)
+            return;
+        for (const k of Object.keys(want))
+            if (got[k] !== want[k])
+                out.push(`${what} says ${got[k]} ${word[k]}, the summary has ${want[k]}.`);
+    };
+    const same = (what, label, got, expected) => {
+        if (got !== expected)
+            out.push(`${what} says ${got} ${label}, the summary has ${expected}.`);
+    };
+    // A skipped test did not run (KAT-402): "N automated tests ran" and "Ran N selected tests" count passed, failed and flaky tests,
+    // and "N were skipped" counts the skipped ones. A text that adds the skipped tests to the ran count says more than the run did.
+    const ran = s.passed !== undefined && s.failed !== undefined && s.flaky !== undefined ? s.passed + s.failed + s.flaky : undefined;
+    const testWords = (what, whole) => {
+        // A Tests repo line is one batch of the run: "Ran 85 tests from e2e: 85 passed. 53 were skipped (...)". Its counts are part of the
+        // run's counts, never more, and a skipped test never sits in its ran count ("..., 53 skipped") (KAT-402).
+        let repoRan = 0;
+        let repoSkipped = 0;
+        const text = whole.replace(TEST_REPO_LINE_RE, (_all, n, parts, skipped) => {
+            repoRan += Number(n);
+            repoSkipped += skipped ? Number(skipped) : 0;
+            if (/\b\d+ skipped\b/.test(parts))
+                out.push(`${what} counts skipped tests as ran in a Tests repo line.`);
+            return ' ';
+        });
+        if (repoRan && ran !== undefined && repoRan > ran)
+            out.push(`${what} says ${repoRan} tests ran from the Tests repos, the summary has ${ran}.`);
+        if (repoSkipped && s.skipped !== undefined && repoSkipped > s.skipped)
+            out.push(`${what} says ${repoSkipped} tests were skipped in the Tests repos, the summary has ${s.skipped}.`);
+        const said = /\b(\d+) automated tests? ran\b/.exec(text) ?? /^- Ran (\d+) selected tests?:/m.exec(text);
+        if (said && ran !== undefined)
+            same(what, 'automated tests ran', Number(said[1]), ran);
+        // A later line in the old wording, "138 automated tests ran: 85 passed, 53 skipped", adds the skipped tests to ran. The counts line
+        // comes first and `said` reads only that one, so every line that lists skipped tests under a ran count is read too (KAT-402).
+        if (ran !== undefined)
+            for (const m of text.matchAll(/(?:\b(\d+) automated tests? ran|^- Ran (\d+) selected tests?): [^\n.]*\b[1-9]\d* skipped\b/gm)) {
+                const n = Number(m[1] ?? m[2]);
+                if (n !== ran)
+                    same(what, 'automated tests ran', n, ran);
+                else
+                    out.push(`${what} counts skipped tests as ran.`);
+            }
+        const skipped = /\b(\d+) (?:was|were) skipped \(/.exec(text);
+        if (skipped && s.skipped !== undefined)
+            same(what, 'tests skipped', Number(skipped[1]), s.skipped);
+    };
+    compare('The summary line', statedCounts(s.line));
+    if (parts.headline)
+        compare('The headline', statedCounts(parts.headline));
+    // A clipped title may have lost its last count, so only a whole one is read.
+    if (parts.checkTitle && !parts.checkTitle.endsWith('...')) {
+        const t = testerTitleCounts(parts.checkTitle);
+        if (!t)
+            compare('The check title', statedCounts(parts.checkTitle));
+        else {
+            if (/^\d+ tests? failed/.test(parts.checkTitle) && s.failed !== undefined)
+                same('The check title', 'tests failed', t.failed, s.failed);
+            if (/^\d+ bugs? found/.test(parts.checkTitle))
+                same('The check title', 'bugs', t.bugs, s.bugs);
+            if (/things? to try by hand/.test(parts.checkTitle) && s.hand !== undefined)
+                same('The check title', 'things to try by hand', t.hand, s.hand);
+        }
+    }
+    for (const body of parts.bodies ?? []) {
+        testWords('The report body', body);
+        // Test facts have one source, the run's results: a report that lists results cannot also say no tests ran.
+        if (claimsNoTestsRan(body) && (/^- Ran \d+ selected tests?:/m.test(body) || /\btests: \d+ passed/.test(s.line)))
+            out.push('The report body says no tests ran, and the summary lists test results.');
+        compare('The report body', {
+            bugs: listedUnder(body, 'Bugs found', /^- \*\*/),
+            risks: listedUnder(body, 'Risks to test', /^- \*\*/),
+            questions: listedUnder(body, 'Questions for the team', /^- /),
+            behaviorChanges: listedUnder(body, 'Behavior changes to confirm', /^- \*\*/),
+            untested: listedUnder(body, 'Not tested yet', /^- \[[ xX]\] /),
+        });
+    }
+    const tick = /^- \[[ xX]\] /;
+    for (const body of parts.comments ?? []) {
+        testWords('The report', body);
+        const lead = /^\*\*localdost: (.*)\*\*$/m.exec(body)?.[1] ?? '';
+        const said = testerCounts(lead);
+        // Only a failed check names the failed tests; a failure on the shared build leaves the check neutral and says nothing of it.
+        const failedCheck = lead.startsWith('the check failed.');
+        if (failedCheck && s.failed !== undefined)
+            same('The first line', 'tests failed', said.failed, s.failed);
+        if (!said.failed)
+            same('The first line', 'bugs', said.bugs, s.bugs);
+        if (s.hand !== undefined)
+            same('The first line', 'things to try by hand', said.hand, s.hand);
+        same('The first line', 'questions', said.questions, want.questions);
+        same('The first line', 'behavior changes', said.behaviorChanges, want.behaviorChanges);
+        same('The report body', 'bugs', listedUnder(body, 'Bugs found', /^- \*\*/), s.bugs);
+        same('The report body', 'questions', listedUnder(body, 'Questions for the team', /^- /), want.questions);
+        same('The report body', 'behavior changes', listedUnder(body, 'Behavior changes to confirm', /^- \*\*/), want.behaviorChanges);
+        if (s.hand !== undefined)
+            same('The report body', 'things to try by hand', listedUnder(body, 'Please try by hand', tick), s.hand);
+        if (s.update !== undefined)
+            same('The report body', 'tests to update', listedUnder(body, 'Tests to update', tick), s.update);
+    }
+    for (const text of parts.checks ?? []) {
+        same('The check text', 'bugs', bugLinesIn(text), s.bugs);
+        testWords('The check text', text);
+    }
+    return [...new Set(out)];
+}
+/** GitHub cuts a check title longer than this. */
+export const CHECK_TITLE_MAX = 60;
+/** A check title that fits: cut at a word, with "..." when it was cut. */
+export function clipCheckTitle(s) {
+    const t = clean(s).replace(/\s+/g, ' ').trim();
+    if (t.length <= CHECK_TITLE_MAX)
+        return t;
+    const cut = t.slice(0, CHECK_TITLE_MAX - 3);
+    const at = cut.lastIndexOf(' ');
+    return `${(at > 30 ? cut.slice(0, at) : cut).replace(/[\s,;:.]+$/, '')}...`;
+}
+/** "Passed" for a verdict outcome that passed, a failure for the failed ones, neutral for the rest. The test conclusion before reviews add bugs. */
+export function verdictConclusion(v) {
+    if (!v || v.outcome === 'pass')
+        return 'success';
+    return v.outcome === 'product_failure' || v.outcome === 'test_failure' ? 'failure' : 'neutral';
+}
+function listOf(names) {
+    return names.length < 2 ? (names[0] ?? '') : `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+}
+/** Tests the PR's own CI jobs ran at the reviewed head. */
+function ciCounts(ci) {
+    const jobs = (ci?.jobs ?? []).filter((j) => j.status === 'completed' && j.passed + j.failed > 0);
+    return { passed: jobs.reduce((n, j) => n + j.passed, 0), failed: jobs.reduce((n, j) => n + j.failed, 0) };
+}
+/** Words of the test tool, not of the product: the default view never shows them (simplicity spec, word map). */
+const TOOL_WORDS = /\b(?:smoke|spec|specs|e2e|ci|runner|engine|probe|playwright|selector|fixture|sha)\b|@\w+|\.(?:spec|test)\.\w+|\w+\/\w+\.\w{2,4}\b/i;
+/**
+ * What a passing test checked, for the counts line: the scenario's own words with a leading imperative taken off
+ * ("Run the smoke spec to confirm the app still loads" becomes "the app still loads"). Empty when what is left
+ * still holds a tool word or still reads as a command, so a tester never reads "smoke spec" in the first lines.
+ */
+export function testedWhat(scenario) {
+    let t = clean(plainScenario(scenario))
+        .replace(/\s+/g, ' ')
+        .trim()
+        .replace(/[.!?]+$/, '');
+    const run = /^(?:run|execute|start)\b.*?\b(?:to|and) (?:confirm|check|verify|make sure|ensure)(?: that)?\s+(.+)$/i.exec(t);
+    if (run)
+        t = run[1];
+    else
+        t = t.replace(/^(?:check|confirm|verify|make sure|ensure)(?: that)?\s+(?=\S)/i, '');
+    t = clipText(t, 70).replace(/[.!?]+$/, '');
+    if (!t || TOOL_WORDS.test(t) || /^(?:run|execute|start|open|click|type|go to)\b/i.test(t))
+        return '';
+    return t;
+}
+/**
+ * The one line with the counts, in plain words: what the automated tests did, what a person checked by hand, and what
+ * has no automated test. The numbers appear here once; the Details fold holds the rest.
+ */
+function countsLine(review, tests, o) {
+    const r = o.report;
+    const ci = ciCounts(review.ci);
+    const out = [];
+    if (r?.notRun)
+        out.push(r.notRun.fork
+            ? FORK_NOT_RUN_LINE
+            : r.notRun.stage === 'skipped'
+                ? 'Automated tests were skipped for this change.'
+                : r.notRun.stage === 'checkout'
+                    ? 'No tests have run for this commit yet.'
+                    : 'The automated tests did not run.');
+    else if (r) {
+        const total = r.passed + r.failed + r.flaky + r.skipped;
+        // A run whose every test is from a Tests repo has that repo's line below, which says the same with the repo named.
+        const onlyTestRepos = !!r.testRepos?.length && total > 0 && r.cases.length > 0 && r.cases.every((c) => isTestRepoFile(c.file));
+        if (!total)
+            out.push('No automated tests were selected for this change.');
+        else if (onlyTestRepos) {
+            // The Tests repo line below says the same with the repo named.
+        }
+        else if (!r.failed && !r.flaky && !r.skipped) {
+            const only = r.passed === 1 ? tests.filter((t) => t.result === 'passed' && t.resultSource === 'runner') : [];
+            const what = only.length === 1 ? testedWhat(only[0].scenario) : '';
+            out.push(`${plural(r.passed, 'automated test')} passed${what ? ` (${inline(what.charAt(0).toLowerCase() + what.slice(1))})` : ''}.`);
+        }
+        else
+            out.push(ranSentences(r));
+        if (o.sharedBuild && testsRan(r))
+            out.push('They ran on the shared QA build, not on a build of this PR.');
+    }
+    else if (!ci.passed && !ci.failed)
+        out.push('No automated tests ran.');
+    // The Tests repos of the run say what they ran in one line each, with the repo named (KAT-86).
+    for (const t of r?.testRepos ?? [])
+        out.push(testRepoSentence(t));
+    if (ci.passed || ci.failed)
+        out.push(`The build ran ${plural(ci.passed + ci.failed, 'test')}: ${ci.passed} passed${ci.failed ? `, ${ci.failed} failed` : ''}.`);
+    const byHand = tests.filter((t) => t.resultSource === 'manual' && t.result === 'passed').length;
+    if (byHand)
+        out.push(`${plural(byHand, 'thing')} checked by hand.`);
+    const gaps = [
+        ...new Set(review.testGaps
+            .filter((g) => g.verifier.status !== 'refuted')
+            .map((g) => clean(areaName(review, g.areaId)).trim())
+            .filter(Boolean)),
+    ];
+    if (review.testGaps.some((g) => g.verifier.status !== 'refuted'))
+        out.push(gaps.length
+            ? `No automated test covers ${listOf(gaps.slice(0, 3).map(inline))}${gaps.length > 3 ? ` and ${gaps.length - 3} more` : ''} yet.`
+            : 'No automated test covers part of this change yet.');
+    // KAT-388: the tickets the review read next to the diff, each with its title chip.
+    if (review.linkedTickets?.length)
+        out.push(`Checked against ${review.linkedTickets.map(ticketChip).join(', ')}.`);
+    return out.join(' ');
+}
+/** The first line of the report: whether anything blocks, then what needs a person. */
+function verdictText(a) {
+    const what = a.task === 'post_merge' ? 'this change' : 'this PR';
+    const parts = [];
+    let lead;
+    let readingBug = false;
+    if (a.conclusion === 'failure') {
+        const cause = a.outcome === 'environment_failure' ? 'a test setup problem' : a.outcome === 'test_failure' ? 'a broken test' : '';
+        // A check that failed on a bug found by reading the code says so once, with the count; the bug is not counted again below.
+        readingBug = a.failedTests === 0 && !a.testRunFailed;
+        lead = `the check failed. ${a.failedTests > 0
+            ? `${plural(a.failedTests, 'test')} failed.${cause ? ` localdost reads this as ${cause}, not a bug in this PR.` : ''}`
+            : a.testRunFailed
+                ? 'The test run found a failure.'
+                : a.bugs > 0
+                    ? `${plural(a.bugs, 'bug')} found by reading the code.`
+                    : 'localdost found a bug by reading the code.'}`;
+    }
+    else {
+        lead = a.notRun ? `the tests ${a.notRun.stage === 'skipped' ? 'were skipped' : 'did not run'}. Nothing blocks ${what}.` : `nothing blocks ${what}.`;
+    }
+    if (a.bugs > 0 && a.failedTests === 0 && !readingBug)
+        parts.push(`${plural(a.bugs, 'bug')} found.`);
+    if (a.hand > 0)
+        parts.push(`${plural(a.hand, 'thing')} ${a.hand === 1 ? 'needs' : 'need'} a person to try.`);
+    if (a.questions > 0)
+        parts.push(`${plural(a.questions, 'question')} for the team.`);
+    if (a.behaviorChanges > 0)
+        parts.push(`${plural(a.behaviorChanges, 'behavior change')} to confirm.`);
+    if (!parts.length && a.conclusion !== 'failure' && !a.notRun)
+        parts.push('Nothing is left to try by hand.');
+    return [lead, ...parts].join(' ');
+}
+/** The GitHub check title: the result in a few words, under CHECK_TITLE_MAX characters. */
+function checkTitleFor(a) {
+    const r = a.report;
+    if (r?.notRun)
+        return r.notRun.stage === 'skipped' ? 'Tests skipped' : 'Tests did not run';
+    const failedCases = (r?.cases ?? []).filter((c) => c.status === 'failed' || c.status === 'timedOut');
+    const failed = r?.failed ?? 0;
+    if (failed > 0) {
+        const name = failedCases[0]?.title ?? a.bugs.find((b) => b.test)?.test?.title;
+        return clipCheckTitle(`${plural(failed, 'test')} failed${a.sharedBuild ? ' on the shared QA build' : ''}${name && !a.sharedBuild ? `: ${clipText(name, 80)}` : ''}`);
+    }
+    if (a.bugs.length)
+        return clipCheckTitle(`${plural(a.bugs.length, 'bug')} found: ${clipText(a.bugs[0].title, 80)}`);
+    const lead = a.conclusion === 'neutral' ? 'Nothing failed' : 'Passed';
+    const tail = [
+        a.hand > 0 ? `${plural(a.hand, 'thing')} to try by hand` : '',
+        a.questions > 0 ? `${plural(a.questions, 'question')} for the team` : '',
+        a.behaviorChanges > 0 ? `${plural(a.behaviorChanges, 'behavior change')} to confirm` : '',
+    ].filter(Boolean);
+    if (tail.length)
+        return clipCheckTitle(`${lead}. ${tail.join(', ')}`);
+    if (a.conclusion === 'neutral') {
+        if (r && r.passed + r.flaky + r.skipped > 0)
+            return clipCheckTitle(`Nothing failed. ${[`${r.passed} passed`, r.flaky ? `${r.flaky} flaky` : '', r.skipped ? `${r.skipped} skipped` : ''].filter(Boolean).join(', ')}`);
+        return 'Nothing failed. Needs a look';
+    }
+    return 'Passed';
+}
+/** What the visible sections say about each bug, in tester words: expected and got, how often it failed, and what happened to its bug report. */
+function bugItem(bug, o) {
+    const out = [`- **${inline(sentence(bug.title))}**${bug.foundByReading ? ' Found by reading the code. Nobody reproduced it.' : ''}`];
+    const times = bug.test ? failedTimes(bug.test, o.report) : '';
+    const ea = [bug.expected ? `Expected: ${sentence(inline(bug.expected))}` : '', bug.actual ? `Got: ${sentence(inline(bug.actual))}` : '', times].filter(Boolean);
+    if (ea.length)
+        out.push(`  ${ea.join(' ')}`);
+    if (bug.foundByReading && bug.failingInput)
+        out.push(`  Try this input: ${sentence(inline(bug.failingInput))}`);
+    const d = defectSentence(bug, o.defects);
+    if (d)
+        out.push(`  ${d}`);
+    return out;
+}
+/** "Failed 3 of 3 times." from the runner's case, when it ran the test more than once. */
+function failedTimes(test, report) {
+    const c = report?.cases.find((x) => x.file === test.file && x.title === test.title && (x.status === 'failed' || x.status === 'timedOut'));
+    return c && c.retries > 0 ? `Failed ${c.retries + 1} of ${c.retries + 1} times.` : '';
+}
+/** What became of the bug report for a bug, in plain words. Empty when the dot made none. */
+function defectSentence(bug, links) {
+    const d = links?.[bug.key];
+    if (!d)
+        return '';
+    if (d.state === 'filed')
+        return d.url ? `Bug report filed: [open it](${d.url}).` : 'Bug report filed.';
+    if (d.state === 'rejected')
+        return 'No bug report filed yet.';
+    return d.url ? `A bug report is ready to review: [open it](${d.url}).` : 'A bug report is ready to review in localdost.';
+}
+/**
+ * The reader-facing report (KAT-96, KAT-376): written for a manual tester. It opens with what happened and whether anything
+ * blocks, then one line of counts, then what a person does: bugs, questions, and tick items to try by hand. Everything a
+ * developer needs sits in `details`. It gives no merge advice: the team decides the merge.
+ */
+export function renderQaSection(review, o = {}) {
+    const showFrom = o.showFrom ?? 'medium';
+    const ticked = o.ticked ?? new Set();
+    const risks = shownRisks(review, showFrom);
+    const tests = orderedTests(review);
+    const facts = reportFacts(o.bugs ?? findBugs(review, o.report, { showFrom, ...(o.sharedBuild ? { sharedBuild: true } : {}) }), review.intents);
+    const bugs = facts.bugs;
+    const open = openItems(review, tests, risks, o);
+    // Specs a ticket changes and this PR leaves alone come first: the list is cut at MAX_UNTESTED, and these must not be the lines that drop.
+    const update = impactNoteItems(o.impactNotes, o, review.head);
+    // A confirmed risk that no test reproduced is worth a try too, unless a check with steps already covers it.
+    const covered = new Set(open.handTests.flatMap((h) => h.test.riskIds));
+    const riskItems = facts.risksToTest
+        .filter((b) => !(b.riskId && covered.has(b.riskId)))
+        .map((b) => {
+        const r = b.riskId ? review.risks.find((x) => x.id === b.riskId) : undefined;
+        return b.source === 'test'
+            ? {
+                id: checklistId({ areaId: '', scenario: `risk ${b.title}` }),
+                first: inline(sentence(clipText(b.title, 160))),
+                more: ['Run it on a build of this PR. If it fails there too, this is a bug.'],
+            }
+            : possibleBugItem(review, b.title, r?.areaId, b.actual, b.why ?? '', b.foundByReading ? b.failingInput : undefined);
+    });
+    const hand = [...open.handTests.map((h) => h.item), ...open.possibleBugs, ...riskItems];
+    const untested = update.length + open.handTests.length + open.possibleBugs.length + open.other.length;
+    const summary = {
+        ...testSummary(review, o.report, bugs.length, untested, facts.risksToTest.length, facts.questions.length, facts.behaviorChanges.length, o.sharedBuild),
+        hand: hand.length,
+        update: update.length,
+    };
+    const questionLines = facts.questions.slice(0, MAX_BUGS).map((b) => inline(questionFor(b)));
+    const behaviorLines = facts.behaviorChanges
+        .slice(0, MAX_BUGS)
+        .map(({ bug, intent }) => `**${inline(sentence(bug.title))}** ${intentWhere(intent)}: "${inline(intent.text)}" Confirm this is the behavior you want.`);
+    const body = [];
+    if (bugs.length) {
+        body.push('', '### Bugs found', '');
+        body.push(...bugs.slice(0, MAX_BUGS).flatMap((b) => bugItem(b, o)));
+        const rest = more(bugs.length - MAX_BUGS, 'bugs');
+        if (rest)
+            body.push('', rest);
+    }
+    if (facts.questions.length) {
+        // No concrete Expected, so no bug and no defect: the team or the ticket answers it.
+        body.push('', '### Questions for the team', '');
+        body.push(...questionLines.map((l) => `- ${l}`));
+        const rest = more(facts.questions.length - MAX_BUGS, 'questions');
+        if (rest)
+            body.push('', rest);
+    }
+    const notCovered = notCoveredLines(review);
+    if (notCovered.length) {
+        // A criterion of a linked ticket that no changed line touches: a question for the team, no bug and no defect.
+        body.push('', '### Not covered by this PR', '');
+        body.push(...notCovered.map((l) => `- ${l}`));
+        const rest = more((review.criteriaNotCovered?.length ?? 0) - MAX_BUGS, 'criteria');
+        if (rest)
+            body.push('', rest);
+    }
+    if (facts.behaviorChanges.length) {
+        // The author says the change does this on purpose: a note for the team to confirm, never a defect.
+        body.push('', '### Behavior changes to confirm', '');
+        body.push(...behaviorLines.map((l) => `- ${l}`));
+        const rest = more(facts.behaviorChanges.length - MAX_BUGS, 'behavior changes');
+        if (rest)
+            body.push('', rest);
+    }
+    if (hand.length) {
+        body.push('', '### Please try by hand', '');
+        body.push(...hand.slice(0, MAX_UNTESTED).flatMap((i) => tickLines(i, ticked)));
+        const rest = more(hand.length - MAX_UNTESTED, 'things');
+        if (rest)
+            body.push('', rest);
+    }
+    if (update.length) {
+        body.push('', '### Tests to update', '');
+        body.push(...update.slice(0, MAX_UNTESTED).flatMap((i) => tickLines(i, ticked)));
+        const rest = more(update.length - MAX_UNTESTED, 'tests');
+        if (rest)
+            body.push('', rest);
+    }
+    const conclusion = checkConclusionFor(o.testConclusion ?? verdictConclusion(o.verdict), o.report, [...bugs, ...facts.risksToTest, ...facts.questions], o.blockOn, o.sharedBuild);
+    const failedTests = o.report && !o.report.notRun ? o.report.failed : 0;
+    const verdict = verdictText({
+        conclusion,
+        ...(o.task ? { task: o.task } : {}),
+        failedTests,
+        testRunFailed: (o.testConclusion ?? verdictConclusion(o.verdict)) === 'failure',
+        bugs: bugs.length,
+        hand: hand.length,
+        questions: facts.questions.length,
+        behaviorChanges: facts.behaviorChanges.length,
+        ...(o.verdict ? { outcome: o.verdict.outcome } : {}),
+        ...(o.report?.notRun ? { notRun: o.report.notRun } : {}),
+    });
+    const checkTitle = checkTitleFor({
+        conclusion,
+        ...(o.report ? { report: o.report } : {}),
+        bugs,
+        hand: hand.length,
+        questions: facts.questions.length,
+        behaviorChanges: facts.behaviorChanges.length,
+        ...(o.sharedBuild ? { sharedBuild: true } : {}),
+        ...(o.verdict ? { outcome: o.verdict.outcome } : {}),
+    });
+    return {
+        bugs,
+        facts,
+        summary,
+        head: inline(summary.line),
+        body: body.join('\n'),
+        details: [
+            ...impactNoteFiles(o.impactNotes),
+            ...linkedTicketParts(review),
+            ...developerParts(review, o, tests, bugs, facts.risksToTest, open.other),
+            ...detailParts(review, o, risks, tests),
+        ],
+        verdict,
+        counts: countsLine(review, tests, o),
+        conclusion,
+        checkTitle,
+        ticks: hand.length + update.length,
+        handLines: hand.map((i) => i.first),
+        questionLines,
+        behaviorLines,
+        updateLines: update.map((i) => i.first),
+    };
+}
+/** What a developer wants first in Details: bugs with steps and evidence, risks, what ran, suggestions, and the open checks nobody does by hand. */
+function developerParts(review, o, tests, bugs, risksToTest, other) {
+    const parts = [];
+    const listed = (list, what) => {
+        const rest = more(list.length - MAX_BUGS, what);
+        return `${list
+            .slice(0, MAX_BUGS)
+            .flatMap((b) => bugLines(b, review.head, o))
+            .join('\n')}${rest ? `\n\n${rest}` : ''}`;
+    };
+    if (bugs.length)
+        parts.push(`**Bugs, with steps and evidence**\n\n${listed(bugs, 'bugs')}`);
+    if (risksToTest.length)
+        parts.push(`**Risks to test**\n\n${listed(risksToTest, 'risks')}`);
+    const tested = testedLines(review, tests, o);
+    if (tested.length)
+        parts.push(`**What I tested**\n\n${tested.join('\n')}`);
+    if (other.length) {
+        const rest = more(other.length - MAX_UNTESTED, 'checks');
+        parts.push(`**Not tested yet, for developers**\n\n${other
+            .slice(0, MAX_UNTESTED)
+            .map((l) => `- ${l}`)
+            .join('\n')}${rest ? `\n\n${rest}` : ''}`);
+    }
+    const suggestions = suggestionLines(review, o);
+    if (suggestions.length)
+        parts.push(`**Suggestions**\n\n${suggestions.join('\n')}`);
+    const note = changelogNoteLine(review);
+    if (note)
+        parts.push(note);
+    return parts;
+}
+function seconds(ms) {
+    return ms >= 60_000 ? `${Math.round(ms / 60_000)} min` : `${Math.max(1, Math.round(ms / 1000))} s`;
+}
+/** Everything internal: ids, verifier counts, scope, head sha, engines, timings. */
+function detailParts(review, o, risks, tests) {
+    const parts = [];
+    parts.push(`**Test run:** ${testsLine(o.report)}`);
+    if (o.report?.testRepos?.length)
+        parts.push(`**Tests repo**\n\n${o.report.testRepos.map((t) => `- ${inline(testRepoDetail(t))}`).join('\n')}`);
+    if (review.ci?.jobs.length) {
+        const lines = review.ci.jobs.map((j) => `- ${inline(j.name)}: ${j.status === 'completed' ? (j.conclusion ?? 'completed') : j.status}${j.passed + j.failed ? `, ${j.passed} passed, ${j.failed} failed` : ''}`);
+        parts.push(`**CI at ${code(review.ci.head.slice(0, 7))}**\n\n${lines.join('\n')}`);
+    }
+    const v = o.verdict;
+    const notes = v?.summary ? withoutTestCountClaims(withoutNoTestsClaims(withoutMergeAdvice(safeSummaryMarkdown(v.summary.trim())), o.report), o.report) : '';
+    if (notes)
+        parts.push(`**Test notes**\n\n${noHiddenMarkers(noMentions(notes))}`);
+    const changeSummary = withoutTestCountClaims(withoutNoTestsClaims(inline(review.summary ?? ''), o.report), o.report);
+    if (changeSummary)
+        parts.push(`**Change summary:** ${changeSummary}`);
+    if (risks.length) {
+        const lines = risks.slice(0, MAX_RISK_ROWS).map((r) => {
+            const out = [
+                `- ${code(r.id)} ${inline(r.title)} · ${r.severity}, ${r.likelihood} · verifier ${r.verifier.status}${r.verifier.severity ? `, lowered to ${r.verifier.severity}` : ''} · ${code(refText(r.evidence[0]))}`,
+                `  Why: ${inline(r.why)} User impact: ${inline(r.userImpact)}`,
+            ];
+            if (r.verifier.status === 'uncertain' && r.verifier.missing)
+                out.push(`  Verifier could not confirm: ${inline(r.verifier.missing)}`);
+            return out.join('\n');
+        });
+        parts.push(`**Risks**\n\n${lines.join('\n')}`);
+    }
+    if (tests.length) {
+        const lines = tests.slice(0, MAX_CHECKLIST).map((t) => {
+            const extra = [
+                t.existingTitle ? `test "${inline(t.existingTitle)}"` : '',
+                t.steps?.length ? `steps: ${t.steps.map((x) => inline(x).replace(/[.;]+$/, '')).join('; ')}` : '',
+                t.expected ? `expected: ${inline(t.expected)}` : '',
+                t.data ? `data: ${inline(t.data)}` : '',
+                t.riskIds.length ? `risks ${t.riskIds.join(', ')}` : '',
+            ].filter(Boolean);
+            const ref = itemRef(review, t);
+            if (ref)
+                extra.push(`start at ${fileLink(o, review.head, ref)}`);
+            return `- ${code(t.id)} ${t.priority} · ${t.type}${areaName(review, t.areaId) ? ` · ${inline(areaName(review, t.areaId))}` : ''}${extra.length ? ` · ${extra.join(' · ')}` : ''}`;
+        });
+        parts.push(`**Checks**\n\n${lines.join('\n')}`);
+    }
+    const atRisk = review.testsAtRisk.filter((k) => k.verifier.status !== 'refuted');
+    if (atRisk.length) {
+        const lines = atRisk
+            .slice(0, MAX_TESTS_AT_RISK)
+            .map((k) => `- ${code(`${k.path}${k.testLine ? `:${k.testLine}` : ''}`)}${k.title ? ` ${inline(k.title)}` : ''}: ${inline(k.reason)}`);
+        const rest = more(atRisk.length - MAX_TESTS_AT_RISK, 'tests at risk');
+        parts.push(`**Tests the change may break**\n\n${lines.join('\n')}${rest ? `\n\n${rest}` : ''}`);
+    }
+    const scope = review.regressionScope;
+    const scopeAreas = scope.areaIds.map((id) => areaName(review, id)).filter(Boolean);
+    const scopeReason = scope.reason ? withoutTestCountClaims(withoutNoTestsClaims(inline(scope.reason), o.report), o.report) : '';
+    parts.push(`**Regression scope:** ${scope.level}${scopeAreas.length ? ` (${scopeAreas.map(inline).join(', ')})` : ''}.${scopeReason ? ` ${scopeReason}` : ''}`);
+    const c = review.coverage;
+    const head = review.head ? fileLinkCommit(o, review.head) : code('unknown');
+    const review_ = [
+        `Head ${head}${review.staleFor ? `, out of date: newer head ${code(review.staleFor.slice(0, 12))}` : ''}.`,
+        `Coverage ${c.status}: ${c.hunksDelivered} of ${c.hunks} changed ranges, signals ${c.signalsDisposed} of ${c.signalsShown} disposed${c.signalsNotShown ? `, ${c.signalsNotShown} not shown` : ''}.`,
+        `${sentence(verifierLine(review).replace(/^v/, 'V'))}`,
+    ];
+    if (c.status === 'incomplete')
+        for (const m of c.missing.slice(0, 3))
+            review_.push(`Incomplete: ${inline(m)}`);
+    if (review.droppedByVerifier.length) {
+        const d = review.droppedByVerifier
+            .slice(0, 5)
+            .map((x) => `"${inline(x.title)}": ${inline(x.reason)}${x.evidence ? ` at ${code(refText(x.evidence))}` : x.namedTest ? ` (${code(x.namedTest)})` : ''}`);
+        review_.push(`Dropped by verifier: ${review.droppedByVerifier.length} (${d.join('; ')}).`);
+    }
+    if (review.belowFloor.length)
+        review_.push(`Below the confidence floor: ${review.belowFloor.length}.`);
+    if (review.belowThreshold)
+        review_.push(`${review.belowThreshold} lower risk${review.belowThreshold === 1 ? '' : 's'} below the display threshold.`);
+    parts.push(`**Review:** ${review_.join(' ')}`);
+    if (review.passes.length) {
+        const engines = review.passes.map((p) => `${p.role === 'reviewer' ? 'Reviewer' : 'Verifier'} ${inline(p.model)} (${p.backend}), ${p.rounds} round${p.rounds === 1 ? '' : 's'}${p.durationMs ? `, ${seconds(p.durationMs)}` : ''}${p.errors.length ? `, ${p.errors.length} check error${p.errors.length === 1 ? '' : 's'} left` : ''}.`);
+        const run = o.report?.durationMs ? ` Tests took ${seconds(o.report.durationMs)}.` : '';
+        parts.push(`**Engines and timings:** ${engines.join(' ')}${run}`);
+    }
+    if (v)
+        parts.push(`**Model confidence:** ${Math.round(v.confidence * 100)}%.`);
+    const gaps = review.testGaps.filter((g) => g.verifier.status !== 'refuted');
+    if (review.impactAreas.length || gaps.length) {
+        const lines = review.impactAreas.map((a) => `- ${code(a.id)} ${inline(a.area)}: ${a.files.slice(0, 6).map(code).join(', ')}${a.files.length > 6 ? `, and ${a.files.length - 6} more` : ''}${a.userFlows.length ? ` · flows: ${a.userFlows.map(inline).join(', ')}` : ''}`);
+        for (const g of gaps)
+            lines.push(`- Gap ${code(g.id)} · ${inline(areaName(review, g.areaId) || 'unmapped')} · ${inline(g.missing)}`);
+        parts.push(`**Impact areas and test gaps**\n\n${lines.join('\n')}`);
+    }
+    const rn = review.releaseNotesImpact;
+    parts.push(rn.userVisible && rn.note
+        ? `**Release notes:** user-visible${rn.breaking ? ', breaking' : ''}. "${inline(rn.note)}"`
+        : '**Release notes:** not user-visible.');
+    return parts;
+}
+function fileLinkCommit(o, head) {
+    const short = code(head.slice(0, 12));
+    if (!o.repo || !/^[0-9a-f]{7,40}$/i.test(head))
+        return short;
+    const base = (o.serverUrl ?? 'https://github.com').replace(/\/$/, '');
+    return `[${short}](${base}/${encodeURIComponent(o.repo.owner)}/${encodeURIComponent(o.repo.name)}/commit/${head})`;
+}
+/** Merge advice the dot does not give (KAT-96): the team decides the merge. */
+const MERGE_ADVICE_RE = /safe to (merge|release)|merge (readiness|safety)|\b(do not|don't|ok to|okay to|ready to) merge\b|\bhold (the|this) (pr|merge)\b|\bblocks? the merge\b|\bbefore (you )?merge\b/i;
+/** Model text with every line and sentence that gives merge advice removed. */
+export function withoutMergeAdvice(md) {
+    return md
+        .split('\n')
+        .map((line) => MERGE_ADVICE_RE.test(line)
+        ? line
+            .split(/(?<=[.!?])\s+/)
+            .filter((x) => !MERGE_ADVICE_RE.test(x))
+            .join(' ')
+        : line)
+        .filter((line, i, all) => line.trim() !== '' || (i > 0 && all[i - 1].trim() !== ''))
+        .filter((line) => !/^\s*[-*]\s*$/.test(line))
+        .join('\n')
+        .trim();
+}
+/** Wraps Details parts in one collapsed section. */
+export function detailsBlock(parts, summary = DETAILS_SUMMARY) {
+    return parts.length ? `<details><summary>${summary}</summary>\n\n${parts.join('\n\n')}\n\n</details>` : '';
+}
+// ---------- the change summary (KAT-144) ----------
+export const MAX_SUMMARY_AREAS = 6;
+export const TEST_RESULT_LABEL = '**Test result:**';
+/** "What this change does" and one table row per area: size with files and lines, and risk. No file names: the run page lists them. */
+export function changeSummaryLines(c) {
+    const out = [`**What this change does:** ${inline(c.whatItDoes)}`];
+    if (!c.areas.length)
+        return out;
+    out.push('', '| Area | Size | Risk |', '|---|---|---|');
+    for (const a of c.areas.slice(0, MAX_SUMMARY_AREAS))
+        out.push(`| ${cell(a.area)} | ${SIZE_WORD[a.size]}: ${plural(a.files.length, 'file')}, +${a.additions} -${a.deletions} | ${RISK_WORD[a.risk]} |`);
+    const rest = c.areas.length - MAX_SUMMARY_AREAS;
+    if (rest > 0)
+        out.push(`| ${plural(rest, 'more area')} | | |`);
+    return out;
+}
+/** Breaks every @mention with a zero-width space; the rest of the Markdown stays as written. */
+export function noMentions(s) {
+    return s.replace(/@(?=[A-Za-z0-9_-])/g, `@${ZWSP}`);
+}
+/** Shows `<!--` as text, so model-written Markdown cannot add a hidden checklist id or marker. */
+export function noHiddenMarkers(s) {
+    return s.replace(/<!--/g, '&lt;!--');
+}
+/** The older footer of ticket and CI comments. */
+export function footer(runUrl) {
+    return `<sub>localdost${runUrl ? ` · [Open the run](${runUrl})` : ''}</sub>`;
+}
+/** Who ticks the boxes, and what a tick does. Shown only above a list that has tick items. */
+export const WHO_TICKS = 'Who ticks: the PR author or QA (anyone with write access). localdost keeps each tick.';
+/**
+ * The last lines of the report above its Details: the link to the full check, and how to ask for a new one. The link shows
+ * only when the server has a public address. A reply of `/localdost review` works only where GitHub sends events to the server.
+ */
+export function reportFooter(o) {
+    // A fork PR gets the same "tests did not run" after a new push, so the report does not offer a new check (KAT-384).
+    // Its own line already says who can lift that.
+    if (o.report?.notRun?.fork)
+        return o.runUrl ? `[Open the full check](${o.runUrl})` : '';
+    const again = o.recheckByReply === false ? 'Push a new commit to check again.' : 'Reply `/localdost review` to check again.';
+    return o.runUrl ? `[Open the full check](${o.runUrl}) · ${again}` : again;
+}
+/**
+ * The verdict summary keeps light Markdown (bold, lists, code) but loses everything that can point
+ * elsewhere or render: raw HTML, images, and links (kept as their text). Model output can echo PR text.
+ */
+export function safeSummaryMarkdown(s) {
+    return s
+        .replace(/<[^>]*>/g, '')
+        .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
+        .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+        .replace(/\[([^\]]+)\]\[[^\]]*\]/g, '$1')
+        .replace(/^\s*\[[^\]]+\]:\s*\S+.*$/gm, '')
+        .split(/(`[^`\n]*`)/)
+        .map((part, i) => (i % 2 ? part : codeBareUrls(part)))
+        .join('');
+}
+/**
+ * Wraps bare URLs in inline code so GitHub does not autolink them. URLs already inside a code span
+ * are left alone, and trailing punctuation stays outside the span: "at http://x:4400, so" becomes
+ * "at `http://x:4400`, so" (KAT-70, seen in the recorded demo as "``http://localhost:4400,`").
+ */
+function codeBareUrls(s) {
+    return s.replace(/\bhttps?:\/\/[^\s`<>]*[^\s`<>.,;:!?'")\]]/g, (u) => `\`${u}\``);
+}
+/**
+ * The sticky PR comment (KAT-96, KAT-376), written for a manual tester: the verdict and whether anything blocks, one line of
+ * counts, the bugs and questions, tick items to try by hand, who ticks, and how to check again. Everything else sits in one
+ * collapsed section for developers. Stays under COMMENT_LIMIT by dropping parts of that section from the end before truncating.
+ * A change in two or more areas keeps its areas table above the sections; a change in one area explains itself in Details.
+ */
+export function renderStickyComment(x) {
+    const v = x.verdict;
+    const top = [PR_MARKER];
+    if (!x.review) {
+        const ticked = new Set([...(x.ticked ?? []), ...tickedIds(x.previous)]);
+        top.push(renderPlainComment(v, {
+            ticked,
+            runUrl: x.runUrl,
+            kind: x.task ?? 'pr_check',
+            report: x.report,
+            bugs: x.bugs,
+            defects: x.defects,
+            repo: x.repo,
+            serverUrl: x.serverUrl,
+            impactNotes: x.impactNotes,
+            ...(x.recheckByReply === false ? { recheckByReply: false } : {}),
+        }).replace(`${PR_MARKER}\n`, ''));
+        return carryTicks(top.join('\n'), x.previous);
+    }
+    top.push(`<!-- localdost:qa-review head=${(x.review.head || '').slice(0, 12)} -->`);
+    const ticked = new Set([...(x.ticked ?? []), ...tickedIds(x.previous)]);
+    const qa = renderQaSection(x.review, { ...x, ticked });
+    const cs = x.review.changeSummary;
+    const areas = !!cs && cs.areas.length >= 2;
+    const foot = reportFooter(x);
+    const who = qa.ticks ? [WHO_TICKS] : [];
+    const details = [...(cs && !areas ? [`**What this change does:** ${inline(cs.whatItDoes)}`] : []), ...qa.details];
+    const lead = [`**localdost: ${qa.verdict}**`, qa.counts, ...(cs && areas ? ['', ...changeSummaryLines(cs)] : [])];
+    const build = () => [...top, ...lead, qa.body, '', ...who, ...(who.length ? [''] : []), foot, '', detailsBlock(details)].join('\n').replace(/\n{3,}/g, '\n\n');
+    let body = carryTicks(build(), x.previous);
+    while (body.length > COMMENT_LIMIT && details.length) {
+        details.pop();
+        body = carryTicks(build(), x.previous);
+    }
+    if (body.length > COMMENT_LIMIT)
+        body = `${body.slice(0, COMMENT_LIMIT - 60)}\n\nComment truncated. Open the run for the rest.`;
+    return body;
+}
+const CI_CAUSE = {
+    product_failure: 'a bug in the change',
+    test_failure: 'a broken test',
+    environment_failure: 'a CI setup problem',
+    flaky: 'a flaky test',
+};
+/** Lower-case words and digits only, so a bullet and the line it repeats compare equal whatever the markup. */
+function plainWords(s) {
+    return s
+        .toLowerCase()
+        .replace(/&(?:amp|lt|gt);/g, ' ')
+        .replace(/[^\p{L}\p{N}]+/gu, ' ')
+        .trim();
+}
+/** Bold labels the comment already has as headings. Any other label names a list of its own and stays with its bullets. */
+const SHOWN_LABEL = /^(?:risks?|open questions?|questions?|findings?|suggestions?|(?:test )?ideas|what qa will test)$/i;
+/**
+ * The model summary of a ticket review without what the comment already lists: headings, labels such as **Risks**, and
+ * bullets whose words start with a question, a risk or a test idea shown above. Prose and bullets that explain stay,
+ * and so does a label of its own (**Existing code and tests at risk**) with the bullets under it. A label whose bullets
+ * all repeat something shown goes too, so no label hangs over nothing.
+ */
+function withoutRepeats(summary, shown) {
+    const keep = [];
+    // Index in `keep` of a label of its own, until a line of content follows it.
+    let open = -1;
+    const closeLabel = () => {
+        if (open >= 0)
+            keep.splice(open, 1);
+        open = -1;
+    };
+    for (const line of summary.split('\n')) {
+        const t = line.trim();
+        if (!t) {
+            keep.push('');
+            continue;
+        }
+        const label = /^\*\*([^*]+?):?\*\*:?$/.exec(t);
+        if (/^#{1,6}\s/.test(t) || label) {
+            closeLabel();
+            if (label && !SHOWN_LABEL.test(label[1].trim())) {
+                open = keep.length;
+                keep.push(line);
+            }
+            continue;
+        }
+        const bullet = /^(?:[-*+]|\d+[.)])\s+(?:\[[ x]\]\s+)?(.*)$/.exec(t);
+        if (bullet) {
+            const words = plainWords(bullet[1]);
+            if (shown.some((x) => words === x || words.startsWith(`${x} `) || x.startsWith(`${words} `)))
+                continue;
+        }
+        open = -1;
+        keep.push(line);
+    }
+    closeLabel();
+    return keep
+        .join('\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+/**
+ * A comment from a verdict alone: CI triage, ticket review, and PR or merge checks without a QA
+ * review. Same report shape as the sticky comment: a summary line, Bugs found, What I tested, Not
+ * tested yet, Questions, then Details. Trackers do not render <details>, so `collapse: false`
+ * gives a plain Details heading.
+ */
+export function renderPlainComment(v, o) {
+    const safe = (s) => noHiddenMarkers(noMentions(s));
+    const ideas = (v.testIdeas ?? []).slice(0, MAX_CHECKLIST);
+    const questions = v.openQuestions ?? [];
+    const findings = [...(v.findings ?? [])]
+        .sort((a, b) => ['high', 'medium', 'low'].indexOf(a.severity) - ['high', 'medium', 'low'].indexOf(b.severity))
+        .slice(0, MAX_RISK_ROWS);
+    const ro = { repo: o.repo, serverUrl: o.serverUrl, defects: o.defects, runUrl: o.runUrl };
+    const out = [PR_MARKER];
+    const details = [];
+    const finding = (f) => `- **${SEV_WORD[f.severity]}:** ${inline(sentence(f.title))}${f.file ? ` ${code(`${f.file}${f.line ? `:${f.line}` : ''}`)}` : ''}`;
+    // The Details of a ticket review hold explanations only. Lines of the summary that repeat a question, a risk or a test idea go.
+    const ticketDetails = [];
+    let hasWhy = false;
+    if (o.kind === 'ticket_review') {
+        // The summary counts the lines that are rendered below, after the cap and after repeated lines are dropped,
+        // never the model's own count (KAT-371).
+        const questionTexts = uniqueLines(questions.map((q) => inline(sentence(q)))).slice(0, 8);
+        const riskRows = uniqueLines(findings.map((f) => `${SEV_WORD[f.severity]}: ${inline(sentence(f.title))}`));
+        const ideaTexts = uniqueLines((v.testIdeas ?? []).map((t) => inline(sentence(testerIdea(t))))).slice(0, MAX_CHECKLIST);
+        const subject = o.ticket?.key ? inline(o.ticket.key) : 'This ticket';
+        const q = questionTexts.length;
+        // A review after an answer (KAT-393) says which questions of the last review are answered now, and who answered.
+        const answered = (v.answeredQuestions ?? []).slice(0, 8);
+        if (!q && !riskRows.length && !ideaTexts.length)
+            out.push(`**${inline(sentence(v.headline || `${subject} was reviewed`))}**`);
+        else if (v.outcome === 'needs_attention')
+            out.push(`**${subject} is not ready to build yet.${q ? ` ${plural(q, 'question')} ${q === 1 ? 'needs' : 'need'} an answer first.` : ` ${plural(riskRows.length, 'risk')} to look at.`}**`);
+        else
+            out.push(`**${subject} is testable as written.${q ? ` ${plural(q, 'question')} ${q === 1 ? 'is' : 'are'} still open.` : ''}**`);
+        if (answered.length) {
+            out.push('', `${plural(answered.length, 'question')} from the last review ${answered.length === 1 ? 'is' : 'are'} answered now.`, '', '### Answered since the last review', '', ...answered.map((a) => `- ${inline(sentence(a.question))} ${inline(a.by)} answered${a.quote.trim() ? `: "${inline(a.quote).replace(/"/g, "'")}"` : '.'}`));
+        }
+        if (q)
+            out.push('', `${inline(o.ticket?.reporter || 'Reporter')}, answering these now saves a round of rework.`);
+        if (q)
+            out.push('', '### Questions', '', ...questionTexts.map((t, i) => `${i + 1}. ${t}`));
+        if (riskRows.length)
+            out.push('', '### Risks', '', ...riskRows.map((t) => `- ${t}`));
+        if (ideaTexts.length)
+            out.push('', '### What QA will test', '', ...ideaTexts.map((t) => `- ${t}`));
+        // KAT-304: the existing tests this ticket changes. Specs have their own heading, as titled links.
+        const impact = o.impact;
+        if (impact?.cases.length)
+            out.push('', '### Existing test cases to review', '', ...impact.cases.slice(0, 8).map((c) => `- ${c.key} ${inline(c.title)}: ${c.word}. ${inline(sentence(c.why))}`));
+        if (impact?.specs.length) {
+            out.push('', '### Automated tests to update', '', ...impact.specs.slice(0, 8).map((x) => {
+                const title = noBrackets(x.title);
+                const link = x.url && /^https?:\/\//.test(x.url) ? `[${title}](${x.url})` : title;
+                return `- ${link}: ${inline(sentence(x.why))}`;
+            }));
+            const unlinked = impact.specs.slice(0, 8).filter((x) => !(x.url && /^https?:\/\//.test(x.url)) && x.file);
+            if (unlinked.length)
+                ticketDetails.push(`**Automated test files:** ${unlinked.map((x) => code(x.file)).join(', ')}`);
+        }
+        // The explanation of each risk, then whatever prose the model wrote that is not one of the lines above.
+        const why = findings.filter((f) => f.detail?.trim());
+        hasWhy = why.length > 0;
+        if (why.length)
+            ticketDetails.push(why.map((f) => `- ${inline(f.title)}: ${inline(f.detail)}`).join('\n'));
+        // The tests the change may break are listed in Details, so a bullet that only names one of them is not said twice.
+        const shown = [
+            ...questionTexts,
+            ...answered.map((a) => a.question),
+            ...riskRows,
+            ...ideaTexts,
+            ...findings.map((f) => f.title),
+            ...(v.testsAtRisk ?? []).slice(0, 10),
+        ]
+            .map(plainWords)
+            .filter(Boolean);
+        const notes = v.summary?.trim() ? withoutTestCountClaims(withoutMergeAdvice(safeSummaryMarkdown(v.summary.trim())), o.report) : '';
+        const rest = withoutRepeats(notes, shown);
+        if (rest)
+            ticketDetails.unshift(safe(rest));
+        if (o.contextNote)
+            ticketDetails.push(safe(o.contextNote));
+    }
+    else if (o.kind === 'ci_failure') {
+        const bugs = reportFacts(o.bugs ?? findBugs(undefined, o.report, { outcome: v.outcome })).bugs;
+        out.push(`CI failed because of ${CI_CAUSE[v.outcome] ?? 'something localdost could not pin down'}. ${inline(sentence(v.headline ?? ''))}`);
+        if (bugs.length)
+            out.push('', '### Bugs found', '', ...bugs.slice(0, MAX_BUGS).flatMap((b) => bugLines(b, undefined, ro)));
+        const r = o.report;
+        if (r && !r.notRun)
+            out.push('', '### What I tested', '', `- ${ranDetail(r)}`);
+        if (r?.hint)
+            out.push('', inline(r.hint));
+        const notes = impactNoteItems(o.impactNotes, o, undefined);
+        details.push(...impactNoteFiles(o.impactNotes));
+        if (ideas.length || notes.length)
+            out.push('', '### Not tested yet', '', ...notes.flatMap((i) => tickLines(i, new Set())), ...ideas.map((t) => `- [ ] ${inline(sentence(t))}`));
+        if (findings.length)
+            out.push('', '### Findings', '', ...findings.map(finding));
+        if (questions.length)
+            out.push('', '### Questions', '', ...questions.slice(0, 8).map((q) => `- ${inline(sentence(q))}`));
+    }
+    else {
+        // A PR or merge report without a QA review: the same tester layout as the sticky comment.
+        const bugs = reportFacts(o.bugs ?? findBugs(undefined, o.report, { outcome: v.outcome })).bugs;
+        const r = o.report;
+        const asks = questions.slice(0, 8);
+        const update = impactNoteItems(o.impactNotes, o, undefined);
+        const conclusion = checkConclusionFor(verdictConclusion(v), r, bugs);
+        out.push(`**localdost: ${verdictText({
+            conclusion,
+            task: o.kind,
+            failedTests: r && !r.notRun ? r.failed : 0,
+            testRunFailed: verdictConclusion(v) === 'failure',
+            bugs: bugs.length,
+            hand: ideas.length,
+            questions: asks.length,
+            behaviorChanges: 0,
+            outcome: v.outcome,
+            ...(r?.notRun ? { notRun: r.notRun } : {}),
+        })}**`, countsLine({ ci: undefined, testGaps: [], impactAreas: [] }, [], { report: r, ...(o.sharedBuild ? { sharedBuild: true } : {}) }));
+        if (bugs.length)
+            out.push('', '### Bugs found', '', ...bugs.slice(0, MAX_BUGS).flatMap((b) => bugItem(b, { defects: o.defects, report: r })));
+        if (asks.length)
+            out.push('', '### Questions for the team', '', ...asks.map((q) => `- ${inline(sentence(q))}`));
+        // Each idea has a hidden id, so its tick survives the next rewrite, and the comment says who ticks.
+        const ticked = o.ticked ?? new Set();
+        const idea = (t) => ({ id: checklistId({ areaId: '', scenario: `hand ${t}` }), first: inline(sentence(t)), more: [] });
+        if (ideas.length)
+            out.push('', '### Please try by hand', '', ...ideas.flatMap((t) => tickLines(idea(t), ticked)));
+        if (update.length)
+            out.push('', '### Tests to update', '', ...update.flatMap((i) => tickLines(i, ticked)));
+        out.push('', ...(ideas.length || update.length ? [WHO_TICKS, ''] : []), reportFooter({ runUrl: o.runUrl, recheckByReply: o.recheckByReply, report: o.report }));
+        details.push(...impactNoteFiles(o.impactNotes));
+        if (bugs.length)
+            details.push(`**Bugs, with steps and evidence**\n\n${bugs
+                .slice(0, MAX_BUGS)
+                .flatMap((b) => bugLines(b, undefined, ro))
+                .join('\n')}`);
+        if (r && !r.notRun)
+            details.push(`**What I tested**\n\n- ${ranDetail(r)}${r.hint ? `\n- ${inline(r.hint)}` : ''}`);
+        if (r?.testRepos?.length)
+            details.push(`**Tests repo**\n\n${r.testRepos.map((t) => `- ${inline(testRepoDetail(t))}`).join('\n')}`);
+        if (findings.length)
+            details.push(`**Suggestions**\n\n${findings.map(finding).join('\n')}`);
+    }
+    if (o.kind === 'ticket_review') {
+        details.push(...ticketDetails);
+        if (v.testsAtRisk?.length)
+            details.push(`**Tests the change may break:** ${v.testsAtRisk.slice(0, 10).map(code).join(', ')}`);
+        if (v.suspectedCause)
+            details.push(`**Suspected cause:** ${inline(v.suspectedCause)}`);
+        const fold = hasWhy ? 'Why these risks' : 'Details';
+        if (details.length)
+            out.push('', o.collapse === false ? `**${fold}**\n\n${details.join('\n\n')}` : detailsBlock(details, fold));
+        // A tracker shows <sub> as text, so the ticket comment keeps the italic footer even when Details fold.
+        out.push('', `_localdost${o.runUrl ? ` · [Open the check](${o.runUrl})` : ''}_`);
+        return out.join('\n');
+    }
+    const notes = v.summary?.trim() ? withoutTestCountClaims(withoutMergeAdvice(safeSummaryMarkdown(v.summary.trim())), o.report) : '';
+    if (notes)
+        details.push(safe(notes));
+    if (o.extra)
+        details.push(o.extra);
+    if (findings.length)
+        details.push(findings.map((f) => `- ${inline(f.title)}: ${inline(f.detail)}`).join('\n'));
+    if (v.testsAtRisk?.length)
+        details.push(`**Tests the change may break:** ${v.testsAtRisk.slice(0, 10).map(code).join(', ')}`);
+    if (v.suspectedCause)
+        details.push(`**Suspected cause:** ${inline(v.suspectedCause)}`);
+    if (Number.isFinite(v.confidence))
+        details.push(`**Model confidence:** ${Math.round(v.confidence * 100)}%.`);
+    // A PR or merge report ends above its Details; the older kinds keep their footer last.
+    const tester = o.kind === 'pr_check' || o.kind === 'post_merge';
+    out.push('', o.collapse === false ? `**Details**\n\n${details.join('\n\n')}` : detailsBlock(details, tester ? DETAILS_SUMMARY : 'Details'));
+    if (!tester)
+        out.push('', o.collapse === false ? `_localdost${o.runUrl ? ` · [Open the run](${o.runUrl})` : ''}_` : footer(o.runUrl));
+    return out.join('\n');
+}
+/** True when blockOn is set and a confirmed risk is at or above it. */
+export function blocks(review, blockOn) {
+    if (!blockOn)
+        return false;
+    return review.risks.some((r) => r.verifier.status === 'confirmed' && SEV[r.severity] >= SEV[blockOn]);
+}
+/** Check-run annotations from risks and tests at risk (section 5.2). First evidence ref only. */
+export function annotationsFor(review, o = {}) {
+    const showFrom = o.showFrom ?? 'medium';
+    const out = [];
+    const scenarioFor = (r) => orderedTests(review).find((t) => t.riskIds.includes(r.id))?.scenario;
+    for (const r of review.risks) {
+        const ev = r.evidence[0];
+        if (!ev || ev.file === 'PR_BODY' || ev.line < 1 || r.severity === 'low')
+            continue;
+        const st = r.verifier.status;
+        const test = scenarioFor(r);
+        if (st === 'confirmed') {
+            const level = SEV[r.severity] >= SEV.high ? (o.blockOn && SEV[r.severity] >= SEV[o.blockOn] ? 'failure' : 'warning') : 'notice';
+            out.push({
+                path: ev.file,
+                startLine: ev.line,
+                endLine: ev.lineEnd,
+                level,
+                title: plain(r.title, 255),
+                message: plain(`${r.why}${test ? `\nTest: ${test}` : ''}`),
+            });
+        }
+        else if ((st === 'uncertain' || st === 'unverified') && SEV[r.severity] >= SEV[showFrom]) {
+            const why = st === 'uncertain' ? `Verifier could not confirm: ${r.verifier.missing ?? r.verifier.reason}` : 'Not verified.';
+            out.push({
+                path: ev.file,
+                startLine: ev.line,
+                endLine: ev.lineEnd,
+                level: 'notice',
+                title: plain(`Check: ${r.title}`, 255),
+                message: plain(`${r.why}\n${why}`),
+            });
+        }
+    }
+    for (const k of review.testsAtRisk) {
+        if (k.verifier.status === 'refuted' || !k.evidence || k.evidence.line < 1)
+            continue;
+        out.push({
+            path: k.evidence.file,
+            startLine: k.evidence.line,
+            endLine: k.evidence.lineEnd,
+            level: 'notice',
+            title: plain(`Test at risk: ${k.path}`, 255),
+            message: plain(k.reason),
+        });
+    }
+    return out;
+}
+/**
+ * The check conclusion follows results, never merge advice: failure when a selected test failed;
+ * for bugs only the review found, failure when `blockOn` is set and a bug is at or above it, else
+ * neutral; neutral when the tests could not run; success when everything selected passed and no
+ * bug was found.
+ */
+export function checkConclusionFor(testConclusion, report, bugs, blockOn, 
+/** The tests ran against the shared QA build (KAT-363): their failures leave the check neutral, since they may not be the PR's. */
+sharedBuild = false) {
+    const failedTests = (report?.failed ?? 0) > 0;
+    if ((!sharedBuild && (failedTests || bugs.some((b) => b.source === 'test'))) || testConclusion === 'failure')
+        return 'failure';
+    const reviewBugs = bugs.filter((b) => b.source === 'review');
+    if (blockOn && reviewBugs.some((b) => SEV[b.severity] >= SEV[blockOn]))
+        return 'failure';
+    if (reviewBugs.length || (sharedBuild && failedTests) || (report?.notRun && report.notRun.stage !== 'skipped'))
+        return 'neutral';
+    return testConclusion;
+}
+/** Why a user cares about a bug, in the words of the risk it belongs to. Empty when no risk is linked. */
+function impactOf(review, bug) {
+    const risk = bug.riskId
+        ? review.risks.find((r) => r.id === bug.riskId)
+        : review.risks.find((r) => review.whatToTest.some((t) => t.existingTest && bug.test && bug.test.file.endsWith(t.existingTest) && t.riskIds.includes(r.id)));
+    return risk ? clean(risk.userImpact).trim() : '';
+}
+/** The areas a bug is in: those of its test, its risks and its file, else every area of the change. */
+function bugAreas(review, bug) {
+    const linked = bug.test ? review.whatToTest.find((t) => t.existingTest && bug.test.file.endsWith(t.existingTest)) : undefined;
+    const riskIds = new Set([...(linked?.riskIds ?? []), ...(bug.riskId ? [bug.riskId] : [])]);
+    const ids = new Set([
+        ...(linked ? [linked.areaId] : []),
+        ...review.risks.filter((r) => riskIds.has(r.id) && r.areaId).map((r) => r.areaId),
+        ...review.impactAreas.filter((a) => bug.ref && a.files.some((f) => f === bug.ref.file)).map((a) => a.id),
+    ]);
+    const hit = review.impactAreas.filter((a) => ids.has(a.id));
+    const named = (hit.length ? hit : review.impactAreas).map((a) => clean(a.area).trim()).filter(Boolean);
+    return [...new Set(named)];
+}
+/**
+ * What the GitHub check shows first (KAT-376): one sentence on what users may see and whether the check blocks merging, the
+ * counts, each bug with what was expected and what happened, and what is left to try by hand. The developer details follow in `text`.
+ */
+function checkSummaryFor(review, qa, o) {
+    const block = qa.conclusion === 'failure' ? 'This check is marked as failed. It blocks merging only if your repo requires it.' : 'This check does not block merging.';
+    const impact = qa.bugs[0] ? impactOf(review, qa.bugs[0]) : '';
+    const out = [`${impact ? `${inline(sentence(impact))} ` : ''}${block}`, '', qa.counts];
+    for (const b of qa.bugs.slice(0, MAX_BUGS)) {
+        const areas = bugAreas(review, b).map(inline);
+        const times = b.test ? failedTimes(b.test, o.report) : '';
+        // The first line already says what users may see: it is not said twice.
+        const said = clean(impactOf(review, b)).trim() === clean(b.actual).trim();
+        const ea = [b.expected ? `Expected: ${sentence(inline(b.expected))}` : '', b.actual && !said ? `Got: ${sentence(inline(b.actual))}` : '', times]
+            .filter(Boolean)
+            .join(' ');
+        const d = defectSentence(b, o.defects);
+        out.push('', `Bug: ${inline(clipText(b.title, 140))}${areas.length ? ` in ${listOf(areas)}` : ''}.`);
+        if (ea)
+            out.push(ea);
+        if (d)
+            out.push(d);
+    }
+    const rest = more(qa.bugs.length - MAX_BUGS, 'bugs');
+    if (rest)
+        out.push('', rest);
+    // The sections of the comment, in the same order, so the check loses none of them.
+    const section = (title, lines, total, cap, what) => {
+        if (!lines.length)
+            return;
+        out.push('', title, ...lines.slice(0, cap).map((l) => `- ${l}`));
+        const rest = more(total - Math.min(lines.length, cap), what);
+        if (rest)
+            out.push('', rest);
+    };
+    section('Questions for the team:', qa.questionLines, qa.facts.questions.length, MAX_BUGS, 'questions');
+    section('Behavior changes to confirm:', qa.behaviorLines, qa.facts.behaviorChanges.length, MAX_BUGS, 'behavior changes');
+    section('Left to try by hand:', qa.handLines, qa.handLines.length, MAX_UNTESTED, 'things');
+    section('Tests to update:', qa.updateLines, qa.updateLines.length, MAX_UNTESTED, 'tests');
+    if (o.runUrl)
+        out.push('', `[Open the check](${o.runUrl})`);
+    return out.join('\n');
+}
+/** Check-run output for a review. */
+export function renderCheckRun(review, testConclusion, o = {}) {
+    const qa = renderQaSection(review, { ...o, testConclusion });
+    const text = detailsBlock(qa.details).replace(/ <!-- qa:t:[0-9a-f]{6} -->/g, '');
+    return {
+        conclusion: qa.conclusion,
+        title: qa.checkTitle,
+        summary: checkSummaryFor(review, qa, o).slice(0, COMMENT_LIMIT),
+        text: text.slice(0, COMMENT_LIMIT),
+        annotations: annotationsFor(review, o),
+        blocked: blocks(review, o.blockOn),
+        bugs: qa.bugs,
+        counts: qa.summary,
+    };
+}
+// ---------- verdict model and digest ----------
+/** The QaReview for analyze(), as one fenced block: it quotes PR text, so it is data. */
+export function renderQaReviewBlock(review, showFrom = 'low') {
+    const lines = [];
+    lines.push(`head ${review.head.slice(0, 12)} · coverage ${review.coverage.status} · regression scope ${review.regressionScope.level}`);
+    lines.push(`summary: ${clean(review.summary)}`);
+    for (const r of shownRisks(review, showFrom)) {
+        lines.push(`risk ${r.id} [${r.severity}, ${r.likelihood}, verifier ${r.verifier.status}] ${clean(r.title)} at ${refText(r.evidence[0])}: ${clean(r.why)}`);
+    }
+    for (const t of orderedTests(review)) {
+        lines.push(`test ${t.id} [${t.priority}, ${t.type}${t.existingTest ? `, existing ${t.existingTest}` : ', new'}${t.result ? `, result ${t.result}` : ''}] risks ${t.riskIds.join(',') || 'none'}: ${clean(t.scenario)}`);
+    }
+    for (const k of review.testsAtRisk)
+        lines.push(`test at risk ${k.id} [verifier ${k.verifier.status}] ${k.path}: ${clean(k.reason)}`);
+    const body = lines.join('\n').replace(/<\/?(untrusted|qa_review)/gi, (m) => m.replace('<', '&lt;'));
+    return `<qa_review>\n<untrusted source="qa-review">\n${body}\n</untrusted>\n</qa_review>`;
+}
+/**
+ * The release note of a review as data, or null when the change is not user-visible or has no note line. The digest line and the
+ * release-note list (src/release-notes.ts) both read it, so a note is user-visible in one place only.
+ */
+export function releaseNoteOf(review) {
+    const rn = review.releaseNotesImpact;
+    if (!rn.userVisible || !rn.note)
+        return null;
+    return { ...rn, note: rn.note };
+}
+/** One release-notes line for the digest, or null when the change is not user-visible. */
+export function releaseNotesLine(review, label) {
+    const rn = releaseNoteOf(review);
+    if (!rn)
+        return null;
+    const tags = [rn.breaking ? 'breaking' : '', rn.audience !== 'end_users' && rn.audience !== 'none' ? rn.audience.replace('_', ' ') : ''].filter(Boolean);
+    return `- ${label}: ${inline(rn.note)}${tags.length ? ` (${tags.join(', ')})` : ''}`;
+}
+//# sourceMappingURL=render.js.map