Pre-push review: agentic-coding

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex 9a344a1..cad99d4 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2026-09-04]++### Added+- `scripts/ecosystems.json` runner rows: gotestsum, pytest, vitest, jest, `swift test`, and `cargo llvm-cov nextest`, each with a detection rule, required binaries, coverage format, install command, the JUnit flags a Makefile target is inspected for, and per-row notes on known holes; a schema test keeps the script-read and runner keys honest (review-html-tests-diagram, phase 4)+- Tests section for review pages: `review_html/junit.py` parses JUnit XML (nested suites, Surefire and pytest rerun elements collapsing to one flaky case per source), `coverage.py` parses lcov, Cobertura, and Go coverprofile, maps paths, and matches entries to changed files in five global passes that report `no candidate` or `ambiguous` rather than guess, and `redact.py` replaces bearer tokens, cloud keys, credential assignments, URLs with userinfo, and PEM blocks with `[redacted]` before failure messages are truncated. `tests_section.py` renders the Tests card and section (provenance, availability, totals, per-job or per-artifact rows, failed tests, new and removed tests, per-file diff coverage, overall coverage, unmatched report) and feeds uncovered added lines back into the per-file diffs. `render()` prints `summary coverage:` and `summary tests:` to stderr last, after every warning, for the skills' severity floor (review-html-tests-diagram, phase 3)+- Timing tests: a generated 10 MB lcov file and a 5,000-case JUnit file must each parse in under 5 seconds; skipped on loaded hosts+- Blast-radius diagram: `review_html/diagram.py` projects a `diagram.json` description into three columns (dependents, changed, dependencies), excludes test files while counting them per changed node, collapses package-granular groups over 3 and caps side columns at 15 plus a `+N more` node, and lays the result out as inline SVG with fixed-width boxes, `textLength` labels, hover-dimmed edges, and CSS-variable colours with literal fallbacks. `render()` picks it up from the top-level `diagram_file` key unless `change_classification` is `docs-only` (review-html-tests-diagram, phase 2)+- `scripts/blast_radius.py`: derives the one-hop import graph around a change from two trees (a commit SHA, the working tree, or a remote repository via the GitHub API), writes `diagram.json` and `diff-tests.json`, and optionally replaces scanned edges with `go list` output. Language rules live in `scripts/ecosystems.json` (Go, Python, TypeScript, Swift, Rust)+- Test harness for the review renderer: `make test` runs `scripts/tests/` via unittest. A golden fixture (`fixtures/golden.json` and the page the renderer at `9da40cf` produced from it) pins the existing output; unit tests cover guarded reads, the warning collector, hunk arithmetic, binary detection, fragment loading, and uncovered-line marks (review-html-tests-diagram, phase 1)+- `review_html/inputs.py` and `warnings.py`: `read_guarded` refuses inputs over 50 MB, non-UTF-8 content, and XML carrying a DOCTYPE, and warns to stderr through a `Warnings` collector+- `review_html/diffs.py`: `load_fragments`, `added_lines`, `is_binary`, and `render_diff` with an optional set of uncovered new-file line numbers; a `.diff-uncovered` rule marks those lines with a red left border and gutter marker++### Changed+- `pr-review-html`, `pr-overview`, and `pre-push-review` skills: every input now lives in `$CLAUDE_JOB_DIR/review-inputs` (or a `mktemp` directory) and is passed with `--diff-dir`; `pr-review-html` and `pre-push-review` choose a test recipe by reading Makefile text, CLAUDE.md, or the ecosystem row, run it once with a restore procedure for files the run touches, and populate the `tests`, `diagram_file`, and `change_classification` blocks; `pr-overview` collects JUnit and coverage artifacts from GitHub Actions with ordered CI-state rules, falls back to a detached worktree run only for same-repo PRs with a local clone (stated in its read-only disclosure), and looks up a baseline run on the base branch; all three apply a severity floor from the renderer's `summary tests:` stderr line, drop the highlight.js claim, and name the `review_html` package when explaining where to edit the renderer+- `scripts/build_review_html.py` is now a thin entry point over the `scripts/review_html/` package (`common`, `sections`, `css`, `template`, `render`); the command line and output are unchanged, and the golden test proves it. A non-UTF-8 diff fragment now renders a placeholder instead of crashing the run+ ## [2026-07-27]  ### Removed

diff --git a/Makefile b/Makefilenew file mode 100644index 0000000..2962629--- /dev/null+++ b/Makefile@@ -0,0 +1,4 @@+.PHONY: test++test:+	cd scripts && python3 -m unittest discover -s tests -t .

diff --git a/claude/skills/pr-overview/SKILL.md b/claude/skills/pr-overview/SKILL.mdindex 1b3b89f..5e7141a 100644--- a/claude/skills/pr-overview/SKILL.md+++ b/claude/skills/pr-overview/SKILL.md@@ -9,6 +9,8 @@ Fetch a GitHub PR, review it through multiple specialized agents (read-only), co  This skill never modifies code, never commits, never pushes, and never resolves comment threads. It only produces an overview. For a workflow that also applies fixes, use `pr-review-html`; for one that addresses reviewer comments, use `pr-review-fixer`. +Two caveats to "never touches the repository": when CI has no usable test artifacts and the PR is a same-repo PR in a repository you have cloned, Phase 1b executes the branch's install scripts and tests on this machine, in a throwaway git worktree under the job directory, with your environment and credentials; and fetching the PR head writes a ref into the clone's `.git` (`FETCH_HEAD`), which touches no working-tree file and no branch.+ ## Phase 1: Fetch the PR  Resolve which PR to look at, in this order:@@ -16,14 +18,77 @@ Resolve which PR to look at, in this order: - Otherwise the PR for the current branch via `gh pr view --json number`  Pull what you need:-- `gh pr view <pr> --json number,title,author,baseRefName,headRefName,body,url,state,commits,files,createdAt`-- `gh pr diff <pr>` for the unified diff -Do **not** run `gh pr checkout`. This skill is read-only — the user may be on a different branch deliberately, and switching branches risks losing work. If the agents need code context beyond the diff, read files at the PR's `headRefName` via `gh api` rather than checking out.+```bash+gh pr view <pr> -R <owner>/<repo> --json number,title,author,baseRefName,headRefName,headRefOid,isCrossRepository,headRepository,body,url,state,commits,files,createdAt+```++**Pin the snapshot.** `SHA=<headRefOid>` from that JSON is the commit every later step describes — the diffs, the CI lookup, the fetch, the worktree, and the diagram all use it, so a branch that moves mid-review cannot give the page data from two trees. `isCrossRepository: true` means a fork PR. Every `gh api` and `gh run` call in this skill carries `-R <owner>/<repo>` so it works without a clone, and list endpoints use `--paginate`.++**Working directory.** Every generated input — diff fragments, downloaded artifacts, the diagram, the overview JSON itself — lives in `$INPUTS`, outside any working tree:++```bash+INPUTS="${CLAUDE_JOB_DIR:-$(mktemp -d)}/review-inputs"; mkdir -p "$INPUTS"+```++Both `$CLAUDE_JOB_DIR` and `mktemp -d` yield absolute paths; never use a relative one, as the Phase 1b subshell would resolve it into the worktree.++**Read the trees without checking out.** Do **not** run `gh pr checkout`. The user may be on a different branch deliberately, and switching branches risks losing work. Decide whether the current directory is a clone of the PR's repository (`git remote get-url origin` names `<owner>/<repo>`):++- *With a clone:* `git fetch origin refs/pull/<n>/head` and verify `test "$(git rev-parse FETCH_HEAD)" = "$SHA"` — the pull ref exists for every PR, forks included, and fetching executes nothing. Stop if the SHAs differ (the PR moved between `gh pr view` and the fetch; re-pin and fetch again). Then `git fetch origin <baseRefName>`, `MERGE_BASE=$(git merge-base origin/<baseRefName> "$SHA")`, and take the full diff for the agents from `git diff "$MERGE_BASE" "$SHA"`. Per-file fragments (Phase 6 step 1) come from `git diff "$MERGE_BASE" "$SHA" -- <path>`. Code context beyond the diff comes from `git show "$SHA":<path>`.+- *Without a clone:* `gh api -R <owner>/<repo> --paginate repos/<owner>/<repo>/compare/<baseRefName>...$SHA` gives `merge_base_commit.sha` as `MERGE_BASE` and one `patch` per entry in `files[]`. The API omits patches for binary files and lists at most 300 files; record any file without a patch as a missing fragment rather than fabricating one. Code context comes from `gh api -R <owner>/<repo> "repos/<owner>/<repo>/contents/<path>?ref=$SHA"`.  Keep the PR `body`, `author`, `createdAt`, and `url` from the `gh pr view` JSON — these flow into Phase 6's `pr_description` section so the reader can see the author's framing verbatim. -Show the user which PR you're about to summarise (number, title, author, head → base, commit count) before doing the heavier work — a cheap sanity check that catches the wrong PR number early.+Show the user which PR you're about to summarise (number, title, author, head → base, commit count, pinned SHA, fork or not) before doing the heavier work — a cheap sanity check that catches the wrong PR number early.++## Phase 1b: Collect test results++Test data comes from GitHub Actions artifacts for the pinned SHA first, and from a local run in a throwaway worktree only when CI has nothing and the trust conditions below hold. Record what happened in the `tests` block (Phase 6): `provenance.ci_state` and `provenance.fallback_state` are separate fields, so "fork PR with expired artifacts" is two facts.++### CI artifacts++```bash+gh run list -R <owner>/<repo> --commit "$SHA" --json databaseId,status,conclusion,name,url+gh api -R <owner>/<repo> --paginate repos/<owner>/<repo>/actions/runs/<id>/artifacts   # name, expired, size_in_bytes+gh api -R <owner>/<repo> --paginate repos/<owner>/<repo>/actions/runs/<id>/jobs        # name, conclusion, html_url+gh run download <id> -R <owner>/<repo> -n <artifact> -D "$INPUTS/artifacts/<id>/<artifact>"+```++Record every job's name, outcome, and URL in `tests.jobs`. Download only artifacts with `expired: false` and `size_in_bytes` at most 100 MB; list larger ones by name and size in `tests.skipped_artifacts`. Identify files by content, never by name: JUnit is XML whose root element is `testsuites` or `testsuite`; Cobertura is XML rooted at `coverage`; lcov starts with `TN:` or `SF:`; coverprofile starts with `mode: `. Copy each recognised file into `$INPUTS` as `<run_id>-<artifact>--<basename>` so two artifacts or two runs cannot collide, and reference those names from `tests.junit`, `tests.coverage`, and `tests.artifacts[]`.++**CI state** is derived after sniffing, first rule that matches:++1. Any completed run yielded a JUnit file → `artifacts usable`; runs still `in_progress` or `queued` go into `tests.pending_runs` and the page notes them.+2. Any run `in_progress` or `queued` → `run in progress or queued`.+3. No runs → `no run`.+4. At least one artifact exists across completed runs and every one is expired → `artifacts expired`.+5. Any completed run with `conclusion: failure` and zero artifacts → `run failed before upload`.+6. Otherwise → `artifacts absent` (covers artifacts that contain no JUnit).++**Job attribution.** Artifacts belong to a run, not a job, so attribution is a convention: tokenise job and artifact names into lowercase alphanumeric runs; a file is attributed to the job whose token set is a subset of the artifact's token set, choosing the job with the most tokens; a tie leaves it attributed to the artifact. `test (ubuntu)` → `{test, ubuntu}` matches `test-results-ubuntu`. Put the winner in `tests.artifacts[].job`, or omit it.++### Worktree fallback++Permitted only when the CI state is `no run`, `run failed before upload`, `artifacts expired`, or `artifacts absent`. Otherwise `fallback_state` is `not needed` (artifacts usable) or `blocked by run in progress`. Then two trust conditions, checked in this order and recorded as the blocked state when they fail: the PR must be a same-repo PR (`isCrossRepository: false`; otherwise `blocked by fork PR` — fork code never runs here), and the current directory must be a clone of the PR's repository (otherwise `blocked by no local clone`).++Choose the command as `pr-review-html` Phase 5 does: read `~/.claude/scripts/ecosystems.json`, pick the language row covering the most changed files and the runner whose `detect` rule matches, then take the first tier that applies reading text only — a Makefile target whose literal recipe lines contain one of the runner's `junit_flags` (never `make -n`), a documented project test command with such a flag, or the runner's `recipe` with `{junit}`, `{coverage}`, `{inputs}` replaced by absolute paths under `$INPUTS`, its `env` exported, and its `config_files` written first. A missing `requires` binary records `no_data_reason: "required tool missing"`; no row or runner records `runner not detected`. `coverage_scope` is `repository` for the ecosystem recipe and `project-configured` otherwise.++Run everything in **one Bash call** with `timeout: 600000` (the tool's maximum, covering install and tests), with `WT="$CLAUDE_JOB_DIR/wt-<n>-<sha7>"` (or under the same `mktemp -d` parent as `$INPUTS` when the job directory is unset):++```bash+git worktree prune+git fetch origin refs/pull/<n>/head && test "$(git rev-parse FETCH_HEAD)" = "$SHA"+git worktree add --detach "$WT" "$SHA"+(cd "$WT" && <install> && <recipe with absolute $INPUTS paths>); status=$?+python3 ~/.claude/scripts/blast_radius.py --repo "$WT" --snapshot "$SHA" --base "$MERGE_BASE" --tools --out "$INPUTS"+git worktree remove --force "$WT"; git worktree prune+echo "recipe-status=$status"+```++`git worktree prune` at the start drops only entries whose directories are gone and skips locked ones; never remove a worktree that still exists on disk. The recipe's exit status becomes `run_outcome` (`passed` or `failed`) and `fallback_state` becomes `ran`. `blast_radius.py --tools` runs inside the same call because the worktree is the only checkout this skill has and it is gone afterwards; Phase 6 then skips its own `blast_radius.py` invocation. All outputs are under `$INPUTS`, so nothing is lost when the worktree goes.++If the call times out: run `git worktree remove --force "$WT"; git worktree prune` separately, keep whatever JUnit XML was written, set `run_outcome: "timed_out"`, `partial: true`, `fallback_state: "timed out"`, and `no_data_reason: "local run timed out"` when no JUnit was written. Nothing in the user's own checkout is touched, so there is nothing to restore.  ## Phase 2: Fetch unresolved comments @@ -135,7 +200,28 @@ Render `{repo-root}/pr-overview.html` (overwrite if it exists) using the shared  ### Step 1: Write per-file diff fragments -For each changed file in the PR, dump the unified diff to a separate `.txt` file. Use `gh pr diff <pr> -- <path>` or split the full PR diff. Put the fragments in a working directory next to where the JSON will live, e.g. `{repo-root}/.claude/pr-overview-diffs/` or `$CLAUDE_JOB_DIR`. Keep filenames simple (e.g. `diff-services-foo.txt`); the JSON references them by name.+For each changed file, write its diff from the pinned SHA to `$INPUTS/<name>.txt`: `git diff "$MERGE_BASE" "$SHA" -- <path>` with a clone, or the compare API's `files[].patch` without one (a file the API gave no patch for stays a missing fragment). Keep filenames simple (e.g. `diff-services-foo.txt`); the JSON references them by name.++### Step 1b: Baseline, blast radius, and classification++**Baseline** — test results for the merge base, used for new/removed tests and the overall coverage delta:++```bash+gh run list -R <owner>/<repo> --branch <baseRefName> --status success --limit 30 --json databaseId,headSha,url+```++The first candidate whose `headSha` equals `$MERGE_BASE` or is its ancestor wins. With a clone: `git merge-base --is-ancestor <headSha> "$MERGE_BASE"`, treating exit status 128 (commit not present locally) as "skip this candidate". Without a clone: `gh api -R <owner>/<repo> repos/<owner>/<repo>/compare/<headSha>...$MERGE_BASE` with `status` of `identical` or `ahead`. Never use a run later than the merge base — tests added on the base branch since would show as removed. Download and sniff the winner's artifacts exactly as in Phase 1b (same size cap, same content sniffing, same `<run_id>-<artifact>--<basename>` naming) and reference them as `baseline_junit` and `baseline_coverage`, with `baseline_provenance` naming the run. A winning run with no usable artifacts ends the search: `baseline_provenance: null`, and new/removed tests fall back to `diff-tests.json` below.++**Blast radius** — skip this when Phase 1b's worktree run already wrote `$INPUTS/diagram.json`. Otherwise run without `--tools` (there is no checkout to run a dependency tool in):++```bash+python3 ~/.claude/scripts/blast_radius.py --repo . --snapshot "$SHA" --base "$MERGE_BASE" --out "$INPUTS"          # with a clone+python3 ~/.claude/scripts/blast_radius.py --remote <owner>/<repo> --snapshot "$SHA" --base "$MERGE_BASE" --out "$INPUTS"   # without one+```++With a clone the script reads both trees from the fetched git objects, never from the working tree, so it works for fork PRs too. `--remote` reads them through the trees and blobs API, capped at 500 blob calls; past the cap the dependents column is marked partial. Both forms write `$INPUTS/diagram.json` and `$INPUTS/diff-tests.json`; reference them by file name and never transcribe them into the JSON.++**Classification** — the change is `docs-only` when every changed file is documentation (`.md`, `.rst`, `.adoc`, anything under a `docs/` directory), a `README`, `CHANGELOG`, `LICENSE`, `CONTRIBUTING`, or `CODEOWNERS` file with any extension, an image, a lockfile, or an editor/VCS dotfile such as `.gitignore`. Anything else — CI workflows, build configuration, dependency manifests, `.txt` files elsewhere — makes it `code`.  ### Step 2: Assemble `overview.json` @@ -223,6 +309,41 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect      "diff_file": "diff-services-foo.txt"}   ], +  "change_classification": "code",            // from Step 1b: code | docs-only+  "diagram_file": "diagram.json",             // written by blast_radius.py, relative to $INPUTS++  "tests": {                                  // from Phase 1b and Step 1b; present for every code change,+    "provenance": {                           // with no_data_reason set when nothing could be collected+      "source":   "ci",                       // ci | local (local = the worktree fallback ran)+      "run_ids":  [123], "run_urls": ["https://github.com/.../actions/runs/123"],   // CI+      "timestamp": "2026-09-04T10:22:00+10:00",                                     // local+      "snapshot": {"sha": "<SHA>", "dirty": false},+      "ci_state": "artifacts usable",         // no run | run in progress or queued | run failed before upload |+                                              // artifacts expired | artifacts absent | artifacts usable+      "fallback_state": "not needed"          // not needed | ran | blocked by fork PR | blocked by no local clone |+    },                                        // blocked by run in progress | timed out+    "baseline_provenance": {"source": "ci", "run_id": 120,  // or null+                            "run_url": "https://github.com/.../actions/runs/120", "sha": "<headSha>"},+    "coverage_scope": "project-configured",   // project-configured for CI and tiers 1-2; repository for the ecosystem recipe+    "run_outcome": "passed",                  // passed | failed | timed_out | not_run (CI source: not_run)+    "partial": false,                         // true when a fallback timeout cut the run short+    "junit":    ["123-test-results-ubuntu--junit.xml"],       // file names under $INPUTS+    "coverage": ["123-test-results-ubuntu--coverage.out"],+    "baseline_junit":    ["120-test-results-ubuntu--junit.xml"],+    "baseline_coverage": ["120-test-results-ubuntu--coverage.out"],+    "path_map": {"strip": null, "prepend": null},   // only when suffix matching cannot resolve coverage paths+    "jobs":      [{"run_id": 123, "name": "test (ubuntu)", "outcome": "success", "url": "…"}],+    "artifacts": [{"name": "test-results-ubuntu", "run_id": 123,+                   "junit": ["123-test-results-ubuntu--junit.xml"],+                   "coverage": ["123-test-results-ubuntu--coverage.out"],+                   "job": "test (ubuntu)"}],  // omit job when attribution failed+    "pending_runs": [{"run_id": 124, "name": "integration", "status": "in_progress", "url": "…"}],+    "skipped_artifacts": [{"name": "build-output", "size_in_bytes": 412000000}],+    "run_touched_files": [],                  // always empty here: the fallback runs in a worktree+    "diff_tests_file": "diff-tests.json",     // written by blast_radius.py; used when there is no baseline+    "no_data_reason": null                    // no tests found | runner not detected | required tool missing |+  },                                          // local run failed | local run timed out | ci+   "publish_metadata": {     "title":    "PR #123 — Add foo (overview)",     "repoUrl":  "https://github.com/owner/repo",@@ -233,15 +354,19 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect } ``` +`no_data_reason: "ci"` tells the renderer to word the no-data card from `ci_state` and `fallback_state` (adding that the workflow must upload a JUnit XML artifact when the state is `no run`, `artifacts absent`, or `artifacts expired`). With `change_classification: "docs-only"` the Tests card, Tests section, and diagram are all omitted, whatever else is present.+ **Rendering contract** (implemented by the script — informational, you don't enforce it): - Pass-through HTML fields: `subtitle`, `at_a_glance` items, `verdict.detail`, every `explanation` panel, `decisions[].body`, `double_check[].body`. Write actual HTML. - All other fields are HTML-escaped automatically. Write plain text. - `pr_description.body` and `unresolved_comments[].body` are HTML-escaped and rendered in a `pre-wrap` monospace block — markdown markers (`##`, lists, fenced code) survive on screen as the author wrote them. **Do not** rewrite, trim, or summarise. Verbatim is the whole point. - Each unresolved comment renders as a warning-bordered card with a type pill (code/review/discussion), author, file:line (if code-level), date, and a "view on GitHub" link. Replies collapse into a `<details>` block.-- Diffs are escaped and dropped into `<pre><code class="language-diff">…</code></pre>` with highlight.js, then restyled to the Prism Dark green/red tokens.+- Diffs are escaped and coloured by the script's own stylesheet — no external assets. Added lines that have coverage data and zero hits carry an uncovered mark; added lines in files with no coverage data carry none. - The three-level explanation renders as CSS-only radio-button tabs in Beginner → Intermediate → Expert order. - Important-change cards show a magenta-bordered **Takeaway** callout and a cyan-bordered **Rationale** callout. - Findings counts derive from the `status` field; in this skill every finding is `"raised"`.+- `tests` renders a Tests card in the overview grid (pass rate, new tests, diff coverage) and a Tests section: provenance with CI links, CI state and fallback state, availability of run / JUnit / coverage / baseline as independent states, totals with the flaky count, pending runs, one row per job (or per artifact when unattributed), failed tests with messages redacted for secrets and truncated to 500 characters, new and removed tests (by identity with a baseline, by declaration name from `diff_tests_file` without one), a per-file diff-coverage table, the overall coverage delta when both sides have it, skipped artifacts, and any warnings. With no readable results it renders a no-data card from `no_data_reason`, `ci_state`, and `fallback_state`.+- `diagram_file` renders the Blast radius section as inline SVG before the per-file diffs: dependents, changed files, dependencies, grouped by package or directory, changed nodes linked to their diff. Test files leave the side columns, packages with more than 3 expansion-only files collapse, side columns cap at 15 nodes, and a column the script could not derive shows the reason instead. An absent or invalid file warns and omits the section. - TOC, overview cards, and section anchors are generated automatically. Empty sections vanish. - `publish_metadata` is emitted as a `<script type="application/json" id="review-meta">` block in `<head>`. @@ -249,16 +374,20 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect  ```bash python3 ~/.claude/scripts/build_review_html.py \-  --data    /path/to/overview.json \+  --data    "$INPUTS/overview.json" \   --output  {repo-root}/pr-overview.html \-  --diff-dir /path/to/diff-fragments+  --diff-dir "$INPUTS" ``` -The script prints the output path on success. Surface that path to the user so they can open it in a browser.+Always pass `--diff-dir` explicitly; every file the JSON references (fragments, JUnit, coverage, baseline, `diagram.json`, `diff-tests.json`) is resolved against it. The script prints the output path on success. Surface that path to the user so they can open it in a browser.++**Error handling.** Missing diff fragments show as `(diff fragment 'name.txt' missing)` placeholders. A test, coverage, or diagram input that is missing, malformed, not UTF-8, over 50 MB, or XML with a `DOCTYPE` prints a `warning:` line naming the file, is listed in the Tests section, and the rest of the page still renders with exit status 0. Only an unreadable `overview.json` exits non-zero.++**Severity floor.** When a `tests` block is present and the change is not docs-only, the script's last two stderr lines are `summary coverage: matched=N unmatched=N` and `summary tests: passed=N failed=N errored=N skipped=N flaky=N` (head JUnit only, every job aggregated). Grep stderr for the `summary tests:` prefix. If `failed` or `errored` is non-zero: set `verdict.tone` to `warning` unless it is already `error`, prepend the failure count to `verdict.detail` (e.g. "3 failing tests — "), raise `publish_metadata.severity` to `needs-changes` unless it is already `blocking`, and run the script again to the same output path. When the line is absent there is no test data and no floor applies. Flaky tests and coverage values never change the verdict or severity. -### When to edit the script vs the SKILL.md+### When to edit the renderer vs the SKILL.md -- **Edit the script** (`~/.claude/scripts/build_review_html.py`) when you need a new card, callout colour, layout tweak, or theme adjustment. Changes there are shared with `pre-push-review` and `pr-review-html`.+- **Edit the renderer** (the `~/.claude/scripts/review_html/` package; `build_review_html.py` is only the command line) when you need a new card, callout colour, layout tweak, or theme adjustment. The Prism Dark palette lives in `review_html/css.py`; section markup in `sections.py`, the Tests section in `tests_section.py`, the diagram in `diagram.py`. Changes there are shared with `pre-push-review` and `pr-review-html`; `make test` in the agentic-coding repo covers them. - **Edit this SKILL.md** when you change the JSON contract, the output location, or phase semantics specific to PR overviews.  ### Populating `publish_metadata`@@ -268,7 +397,7 @@ Always populate this field. Mapping rules: - `title`: human-readable, typically the PR title with `(overview)` suffix. - `repoUrl`: the PR's repo URL (from `gh pr view --json url` or `git remote get-url origin`). - `pr`: the PR number as an integer. **Do not** also set `branch`.-- `severity`: derive from the findings and the unresolved-comments count — no findings or unresolved comments → `lgtm`; nits or low-stakes unresolved threads only → `suggestions`; major findings or substantive unresolved threads → `needs-changes`; blocking/security/correctness issues → `blocking`.+- `severity`: derive from the findings and the unresolved-comments count — no findings or unresolved comments → `lgtm`; nits or low-stakes unresolved threads only → `suggestions`; major findings or substantive unresolved threads → `needs-changes`; blocking/security/correctness issues → `blocking`. Failing or errored tests floor it at `needs-changes` (Step 3). - `summary`: 1–3 sentences leading with the headline takeaway (e.g. "3 unresolved threads, all on error handling in foo.go").  ## Phase 7: Publish@@ -279,4 +408,4 @@ Check whether the `pulsar` binary is on PATH (`command -v pulsar`). If it is, in  End with a short verdict for the user: **Looks good**, **Worth a closer look** (with the top 2–3 findings), or **Blocking concerns** (with the must-address list). Mention the unresolved-comment count and link to the HTML output (or the archived path returned by Phase 7 if publish ran). -This skill never pushes, commits, merges, or resolves threads — surface what's there and let the user decide what to do next.+This skill never pushes, commits, merges, or resolves threads — surface what's there and let the user decide what to do next. If Phase 1b ran the worktree fallback, say so, and if it was blocked, say why (fork PR, no local clone, run in progress).

diff --git a/claude/skills/pr-review-html/SKILL.md b/claude/skills/pr-review-html/SKILL.mdindex 2b99268..2276cdf 100644--- a/claude/skills/pr-review-html/SKILL.md+++ b/claude/skills/pr-review-html/SKILL.md@@ -14,14 +14,26 @@ Resolve which PR to review, in this order: - Otherwise the PR for the current branch via `gh pr view --json number`  Pull what you need to review:-- `gh pr view <pr> --json number,title,author,baseRefName,headRefName,body,url,state,commits,files`-- `gh pr diff <pr>` for the unified diff+- `gh pr view <pr> --json number,title,author,baseRefName,headRefName,headRefOid,isCrossRepository,body,url,state,commits,files,createdAt`+- `gh pr diff <pr>` for the unified diff the review agents read (Phase 7 regenerates per-file diffs from the working tree after fixes) -If the user isn't on the PR branch, run `gh pr checkout <pr>` so any fixes land on the right local branch. If the working tree is dirty, stop and ask before checking out — silently switching branches risks losing work.+Record `headRefOid` (the head SHA), `isCrossRepository` (true for a fork PR), and `baseRefName`; Phases 5 and 7 use them. Note `<owner>/<repo>` from `url` — every `gh api` and `gh run` call in this skill carries `-R <owner>/<repo>`, and list endpoints use `--paginate`.++If the user isn't on the PR branch, run `gh pr checkout <pr>` so any fixes land on the right local branch. If the working tree is dirty, stop and ask before checking out — silently switching branches risks losing work. After checkout, `git fetch origin <baseRefName>` and record `MERGE_BASE=$(git merge-base origin/<baseRefName> HEAD)`; the diffs, the diagram, and the baseline lookup all compare against it.++Phases 4 and 5 execute the branch's install scripts and tests on this machine, with your environment and credentials. That applies to fork PRs too: this skill checks out and runs whatever PR it is asked to review.  Keep the PR `body`, `author`, `createdAt`, and `url` from the `gh pr view` JSON — these flow into Phase 7's `pr_description` section so the reader can see the author's framing verbatim. -Show the user which PR you're about to review (number, title, author, head → base, commit count) before doing the heavier work — it's a cheap sanity check that catches a wrong PR number early.+Show the user which PR you're about to review (number, title, author, head → base, commit count, fork or not) before doing the heavier work — it's a cheap sanity check that catches a wrong PR number early.++**Working directory.** Every generated input — diff fragments, JUnit and coverage files, the diagram, the review JSON itself — lives in `$INPUTS`, outside the working tree so nothing lands in `git status`:++```bash+INPUTS="${CLAUDE_JOB_DIR:-$(mktemp -d)}/review-inputs"; mkdir -p "$INPUTS"+```++Both `$CLAUDE_JOB_DIR` and `mktemp -d` yield absolute paths; never use a relative one, as later steps run in subshells where it would resolve into the wrong directory.  ## Phase 2: Locate the spec (if any) @@ -77,10 +89,26 @@ Aggregate the agent findings and fix them on the checked-out PR branch. The user  ## Phase 5: Verify -After fixes:-- Run the project's test suite (use Makefile commands if present)-- Run linters and validators per project config-- If a test fails, treat it as a regression in the fix — investigate and revert/adjust rather than editing the test to make it pass+The verification run is also the source of the page's test results, so choose a command that emits JUnit XML before running anything, and run it once.++### Choose the command++Read `~/.claude/scripts/ecosystems.json`. The language row is the one whose `extensions` cover the most changed files; the runner within it is the first whose `detect` rule matches (`files` globs at the repo root, or top-level `package_json_keys` in `package.json`). Then, reading text only and executing nothing, take the first tier that applies:++1. **Makefile target.** A target whose literal recipe lines (read from the Makefile — never `make -n`, which still expands `$(shell …)` and runs `+` lines) contain one of the runner's `junit_flags`. Pass over a target whose output path is a `$(VAR)` reference you cannot read. Run the target and copy the outputs the recipe names into `$INPUTS`.+2. **Project instructions.** A command in CLAUDE.md or the README described as the test command, if it contains such a flag.+3. **Ecosystem recipe.** The runner's `recipe` with `{junit}`, `{coverage}`, and `{inputs}` replaced by absolute paths under `$INPUTS`, its `env` exported, and any `config_files` templates written under `$INPUTS` first. Every binary in `requires` must be on PATH; a missing one records `no_data_reason: "required tool missing"`. No row, or no runner whose `detect` rule matches, records `runner not detected`. Read the row's `notes` — they say where the coverage file lands, which extra JUnit files appear, and what the install line assumes.++A Makefile target or project command that emits nothing structured is passed over in favour of the next tier, not run as a second suite. `coverage_scope` is `repository` for tier 3 and `project-configured` for tiers 1 and 2; the page shows it.++### Run once++- **Before:** record `git status --porcelain -z` and copy every dirty tracked file to `$INPUTS/pre-run/<path>` — those are the Phase 4 fixes and must survive.+- **Run** the chosen command in one Bash call with `timeout: 600000` (the tool's maximum; it covers dependency installation and the tests) with every output under `$INPUTS`. The exit status becomes `run_outcome` (`passed` or `failed`). Run linters and validators per project config as well.+- **After:** for each tracked file whose content differs from before, restore a file that was clean pre-run with `git checkout -- <path>` and copy a file that was dirty pre-run back from `$INPUTS/pre-run/`. Untracked files that appeared outside `$INPUTS` are reported, never deleted. List touched and appeared paths in `tests.run_touched_files`. Never use `git stash` — it would carry away the fixes the run exists to verify.+- **On timeout:** keep whatever JUnit XML was written, set `run_outcome: "timed_out"` and `partial: true`, and add "fix verification incomplete: test run timed out" to `verdict.detail`.++If a test fails, treat it as a regression in the fix — investigate and revert/adjust rather than editing the test to make it pass. If you re-run after adjusting, repeat the before/after steps; the last run is the one the page reports.  ## Phase 6: Implementation explanation and insight material @@ -105,7 +133,27 @@ Render `{repo-root}/pr-review.html` (overwrite if it exists) using the shared re  ### Step 1: Write per-file diff fragments -For each changed file in the PR, dump the unified diff to a separate `.txt` file. Use `gh pr diff <pr> -- <path>` or split the full PR diff. Put the fragments in a working directory next to where the JSON will live, e.g. `{repo-root}/.claude/pr-review-diffs/` or `$CLAUDE_JOB_DIR`. Keep filenames simple (e.g. `diff-services-foo.txt`); the JSON references them by name.+Diffs come from the working tree after the fixes, not from `gh pr diff`, so the coverage marks land on the lines the reader sees. For each changed file (`git diff --name-status -M $MERGE_BASE`), write `git diff $MERGE_BASE -- <path>` to `$INPUTS/<name>.txt`. Files listed by `git ls-files --others --exclude-standard -z` are untracked additions: write `git diff --no-index /dev/null <path>` for them (exit status 1 is normal) and badge them `Added`. Keep filenames simple (e.g. `diff-services-foo.txt`); the JSON references them by name.++### Step 1b: Baseline, blast radius, and classification++**Baseline** — test results for the merge base, used for new/removed tests and the overall coverage delta:++```bash+gh run list -R <owner>/<repo> --branch <baseRefName> --status success --limit 30 --json databaseId,headSha,url+```++The first candidate whose `headSha` equals `$MERGE_BASE` or is its ancestor wins: `git merge-base --is-ancestor <headSha> $MERGE_BASE`, treating exit status 128 (commit not present locally) as "skip this candidate". Never use a run later than the merge base — tests added on the base branch since would show as removed. For the winner, list its artifacts with `gh api -R <owner>/<repo> --paginate repos/<owner>/<repo>/actions/runs/<id>/artifacts`, skip any with `expired: true` or `size_in_bytes` over 100 MB, download the rest with `gh run download <id> -R <owner>/<repo> -n <artifact> -D "$INPUTS/artifacts/<id>/<artifact>"`, and sniff the files by content: JUnit is XML whose root is `testsuites` or `testsuite`; Cobertura is XML rooted at `coverage`; lcov starts with `TN:` or `SF:`; coverprofile starts with `mode: `. Copy recognised files into `$INPUTS` as `<run_id>-<artifact>--<basename>` and reference them as `baseline_junit` and `baseline_coverage`, with `baseline_provenance` naming the run. A winning run with no usable artifacts ends the search: `baseline_provenance: null`, and new/removed tests fall back to `diff-tests.json` below.++**Blast radius** — run after Phase 5 so the working tree holds the fixes:++```bash+python3 ~/.claude/scripts/blast_radius.py --repo . --snapshot working-tree --base "$MERGE_BASE" --tools --out "$INPUTS"+```++This writes `$INPUTS/diagram.json` (the one-hop dependency graph) and `$INPUTS/diff-tests.json` (test declarations added and removed in changed test files). Reference both by file name; never transcribe them into the JSON.++**Classification** — the change is `docs-only` when every changed file is documentation (`.md`, `.rst`, `.adoc`, anything under a `docs/` directory), a `README`, `CHANGELOG`, `LICENSE`, `CONTRIBUTING`, or `CODEOWNERS` file with any extension, an image, a lockfile, or an editor/VCS dotfile such as `.gitignore`. Anything else — CI workflows, build configuration, dependency manifests, `.txt` files elsewhere — makes it `code`.  ### Step 2: Assemble `review.json` @@ -176,6 +224,30 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect      "diff_file": "diff-services-foo.txt"}    // OR "diff": "<inline diff text>"   ], +  "change_classification": "code",            // from Step 1b: code | docs-only+  "diagram_file": "diagram.json",             // written by blast_radius.py, relative to $INPUTS++  "tests": {                                  // from Phase 5 and Step 1b; present for every code change,+    "provenance": {                           // with no_data_reason set when nothing could be collected+      "source":    "local",+      "timestamp": "2026-09-04T10:22:00+10:00",+      "snapshot":  {"sha": "<headRefOid>", "dirty": true}   // dirty once fixes are applied+    },+    "baseline_provenance": {"source": "ci", "run_id": 120,  // or null+                            "run_url": "https://github.com/.../actions/runs/120", "sha": "<headSha>"},+    "coverage_scope": "repository",           // repository (tier 3) | project-configured (tiers 1-2)+    "run_outcome": "passed",                  // passed | failed | timed_out | not_run+    "partial": false,                         // true when a timeout cut the run short+    "junit":    ["junit.xml"],                // file names under $INPUTS+    "coverage": ["coverage.out"],+    "baseline_junit":    ["120-test-results--junit.xml"],+    "baseline_coverage": ["120-test-results--coverage.out"],+    "path_map": {"strip": null, "prepend": null},   // only when suffix matching cannot resolve coverage paths+    "run_touched_files": [],                  // from the Phase 5 restore step+    "diff_tests_file": "diff-tests.json",     // written by blast_radius.py; used when there is no baseline+    "no_data_reason": null                    // no tests found | runner not detected | required tool missing |+  },                                          // local run failed | local run timed out+   "publish_metadata": {                       // always populate (see Phase 8).     "title":    "PR #123 — Add foo",     "repoUrl":  "https://github.com/owner/repo",@@ -186,14 +258,18 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect } ``` +With `change_classification: "docs-only"` the Tests card, Tests section, and diagram are all omitted, whatever else is present.+ **Rendering contract** (implemented by the script — informational, you don't enforce it): - Pass-through HTML fields: `subtitle`, `at_a_glance` items, `verdict.detail`, every `explanation` panel, `decisions[].body`, `double_check[].body`. Write actual HTML. - All other fields are HTML-escaped automatically. Write plain text. - `pr_description.body` is HTML-escaped and rendered in a `pre-wrap` block with monospace styling — markdown markers (`##`, lists, fenced code) and any HTML comments survive on screen as the author wrote them. **Do not** rewrite, trim, or summarise the body; the whole point is verbatim authorial intent.-- Diffs are escaped and dropped into `<pre><code class="language-diff">…</code></pre>` with highlight.js, then restyled to the Prism Dark green/red tokens.+- Diffs are escaped and coloured by the script's own stylesheet — no external assets. Added lines that have coverage data and zero hits carry an uncovered mark; added lines in files with no coverage data carry none. - The three-level explanation renders as CSS-only radio-button tabs in Beginner → Intermediate → Expert order. - Important-change cards show a magenta-bordered **Takeaway** callout and a cyan-bordered **Rationale** callout. `rationale_unknown: true` swaps Rationale for a warning-bordered **Open question**. `rationale_inferred: true` appends `(inferred — not stated by the author)`. - Findings counts (raised / fixed / skipped) derive from the `status` field.+- `tests` renders a Tests card in the overview grid (pass rate, new tests, diff coverage) and a Tests section: provenance, availability of run / JUnit / coverage / baseline as independent states, totals with the flaky count, failed tests with messages redacted for secrets and truncated to 500 characters, new and removed tests (by identity with a baseline, by declaration name from `diff_tests_file` without one), a per-file diff-coverage table, the overall coverage delta when both sides have it, and any warnings. With no readable results it renders a no-data card from `no_data_reason`.+- `diagram_file` renders the Blast radius section as inline SVG before the per-file diffs: dependents, changed files, dependencies, grouped by package or directory, changed nodes linked to their diff. Test files leave the side columns, packages with more than 3 expansion-only files collapse, side columns cap at 15 nodes. An absent or invalid file warns and omits the section. - TOC, overview cards, and section anchors are generated automatically. Empty sections vanish. - `publish_metadata` is emitted as a `<script type="application/json" id="review-meta">` block in `<head>`, JSON-encoded with `</` escaped. Required by `pulsar publish` (see `docs/agent-contract.md` in the pulsar repo); harmless when present, ignored when absent. @@ -201,16 +277,20 @@ Schema (every top-level key is optional except `repo` and `files` — empty sect  ```bash python3 ~/.claude/scripts/build_review_html.py \-  --data    /path/to/review.json \+  --data    "$INPUTS/review.json" \   --output  {repo-root}/pr-review.html \-  --diff-dir /path/to/diff-fragments     # defaults to the JSON file's directory+  --diff-dir "$INPUTS" ``` -The script prints the output path on success. Surface that path to the user so they can open it in a browser. Missing diff fragments degrade gracefully — they show as `(diff fragment 'name.txt' missing)` placeholders, so the rest of the review remains usable.+Always pass `--diff-dir` explicitly; every file the JSON references (fragments, JUnit, coverage, baseline, `diagram.json`, `diff-tests.json`) is resolved against it. The script prints the output path on success. Surface that path to the user so they can open it in a browser.++**Error handling.** Missing diff fragments show as `(diff fragment 'name.txt' missing)` placeholders. A test, coverage, or diagram input that is missing, malformed, not UTF-8, over 50 MB, or XML with a `DOCTYPE` prints a `warning:` line naming the file, is listed in the Tests section, and the rest of the page still renders with exit status 0. Only an unreadable `review.json` exits non-zero.++**Severity floor.** When a `tests` block is present and the change is not docs-only, the script's last two stderr lines are `summary coverage: matched=N unmatched=N` and `summary tests: passed=N failed=N errored=N skipped=N flaky=N` (head JUnit only). Grep stderr for the `summary tests:` prefix. If `failed` or `errored` is non-zero: set `verdict.tone` to `warning` unless it is already `error`, prepend the failure count to `verdict.detail` (e.g. "3 failing tests — "), raise `publish_metadata.severity` to `needs-changes` unless it is already `blocking`, and run the script again to the same output path. When the line is absent there is no test data and no floor applies. Flaky tests and coverage values never change the verdict or severity. -### When to edit the script vs the SKILL.md+### When to edit the renderer vs the SKILL.md -- **Edit the script** (`~/.claude/scripts/build_review_html.py`) when you need a new card, callout colour, layout tweak, or theme adjustment. The Prism Dark palette lives in the `CSS` constant inside the script. Changes there are shared with `pre-push-review`.+- **Edit the renderer** (the `~/.claude/scripts/review_html/` package; `build_review_html.py` is only the command line) when you need a new card, callout colour, layout tweak, or theme adjustment. The Prism Dark palette lives in `review_html/css.py`; section markup in `sections.py`, the Tests section in `tests_section.py`, the diagram in `diagram.py`. Changes there are shared with `pre-push-review` and `pr-overview`; `make test` in the agentic-coding repo covers them. - **Edit this SKILL.md** when you change the JSON contract, the output location, or the upstream phase semantics specific to PR reviews.  ### Populating `publish_metadata`@@ -220,7 +300,7 @@ Always populate this field. Mapping rules: - `title`: human-readable, typically the PR title (e.g. `PR #123 — Add foo`). - `repoUrl`: the PR's repo URL (from `gh pr view --json url` or `git remote get-url origin`); the binary normalises SSH → HTTPS and strips `.git`. - `pr`: the PR number as an integer. **Do not** also set `branch` — exactly one is allowed.-- `severity`: derive from the verdict tone and findings — `success` and no major issues → `lgtm`; nits only → `suggestions`; major findings raised → `needs-changes`; blocking/security/correctness issues → `blocking`.+- `severity`: derive from the verdict tone and findings — `success` and no major issues → `lgtm`; nits only → `suggestions`; major findings raised → `needs-changes`; blocking/security/correctness issues → `blocking`. Failing or errored tests floor it at `needs-changes` (Step 3). - `summary`: 1–3 sentences leading with the headline finding (not "I reviewed PR X"). This is the feed-reader description.  ## Phase 8: Publish

diff --git a/claude/skills/pre-push-review/SKILL.md b/claude/skills/pre-push-review/SKILL.mdindex 6ffc56a..2288ecf 100644--- a/claude/skills/pre-push-review/SKILL.md+++ b/claude/skills/pre-push-review/SKILL.md@@ -9,9 +9,17 @@ Review and fix unpushed commits before they reach the remote repository.  ## Phase 1: Identify Changes -Determine which commits haven't been pushed to the remote repository. Use `git diff origin/<branch>..HEAD` to get the full diff of unpushed changes. Show the user which commits will be reviewed.+Determine which commits haven't been pushed to the remote repository. Record the base as the merge base, `BASE=$(git merge-base origin/<branch> HEAD)`, and use `git diff $BASE..HEAD` to get the full diff of unpushed changes; a two-dot diff straight against `origin/<branch>` shows reverse changes when the branch is behind it. Show the user which commits will be reviewed. -If there is no remote tracking branch yet, diff against `origin/main`.+If there is no remote tracking branch yet, use `origin/main` in place of `origin/<branch>`. Phase 7 compares the working tree against `BASE`.++**Working directory.** Every generated input — diff fragments, JUnit and coverage files, the diagram, the review JSON itself — lives in `$INPUTS`, outside the working tree so nothing lands in `git status`:++```bash+INPUTS="${CLAUDE_JOB_DIR:-$(mktemp -d)}/review-inputs"; mkdir -p "$INPUTS"+```++Both `$CLAUDE_JOB_DIR` and `mktemp -d` yield absolute paths; never use a relative one.  ## Phase 2: Locate Relevant Specifications @@ -72,11 +80,25 @@ Wait for all agents to complete. Aggregate their findings and fix each issue dir  ## Phase 5: Verify -After all fixes are applied:+The verification run is also the source of the page's test results, so choose a command that emits JUnit XML before running anything, and run it once.++### Choose the command -1. Run the project's test suite (use Makefile commands if available). All tests must pass.-2. Run linters and validators as specified in project configuration.-3. If any test fails, investigate whether the fix introduced a regression and revert or adjust the fix — do not modify the test to make it pass.+Read `~/.claude/scripts/ecosystems.json`. The language row is the one whose `extensions` cover the most changed files; the runner within it is the first whose `detect` rule matches (`files` globs at the repo root, or top-level `package_json_keys` in `package.json`). Then, reading text only and executing nothing, take the first tier that applies:++1. **Makefile target.** A target whose literal recipe lines (read from the Makefile — never `make -n`, which still expands `$(shell …)` and runs `+` lines) contain one of the runner's `junit_flags`. Pass over a target whose output path is a `$(VAR)` reference you cannot read. Run the target and copy the outputs the recipe names into `$INPUTS`.+2. **Project instructions.** A command in CLAUDE.md or the README described as the test command, if it contains such a flag.+3. **Ecosystem recipe.** The runner's `recipe` with `{junit}`, `{coverage}`, and `{inputs}` replaced by absolute paths under `$INPUTS`, its `env` exported, and any `config_files` templates written under `$INPUTS` first. Every binary in `requires` must be on PATH; a missing one records `no_data_reason: "required tool missing"`. No row, or no runner whose `detect` rule matches, records `runner not detected`. Read the row's `notes` — they say where the coverage file lands, which extra JUnit files appear, and what the install line assumes.++A Makefile target or project command that emits nothing structured is passed over in favour of the next tier, not run as a second suite. `coverage_scope` is `repository` for tier 3 and `project-configured` for tiers 1 and 2; the page shows it.++### Run once++1. **Before:** record `git status --porcelain -z` and copy every dirty tracked file to `$INPUTS/pre-run/<path>` — those are the Phase 4 fixes and must survive.+2. **Run** the chosen command in one Bash call with `timeout: 600000` (the tool's maximum; it covers dependency installation and the tests) with every output under `$INPUTS`. The exit status becomes `run_outcome` (`passed` or `failed`). All tests must pass. Run linters and validators as specified in project configuration as well.+3. **After:** for each tracked file whose content differs from before, restore a file that was clean pre-run with `git checkout -- <path>` and copy a file that was dirty pre-run back from `$INPUTS/pre-run/`. Untracked files that appeared outside `$INPUTS` are reported, never deleted. List touched and appeared paths in `tests.run_touched_files`. Never use `git stash` — it would carry away the fixes the run exists to verify.+4. **On timeout:** keep whatever JUnit XML was written, set `run_outcome: "timed_out"` and `partial: true`, and add "fix verification incomplete: test run timed out" to `verdict.detail`.+5. If any test fails, investigate whether the fix introduced a regression and revert or adjust the fix — do not modify the test to make it pass. If you re-run after adjusting, repeat the before/after steps; the last run is the one the page reports.  ## Phase 6: Generate Implementation Explanation and Insight Material @@ -115,7 +137,19 @@ Overwrite any existing file.  ### Step 1: Write per-file diff fragments -For each changed file, dump the unified diff (`git diff $BASE -- <path>` or equivalent) to a separate `.txt` file. Pick a working directory next to where the JSON will live, e.g. `{repo-root}/.claude/review-diffs/` or `$CLAUDE_JOB_DIR`. Keep the filenames simple (e.g. `diff-main.go.txt`); the JSON references them by name.+Diffs come from the working tree after the fixes, so the coverage marks land on the lines the reader sees. For each changed file (`git diff --name-status -M $BASE`), write `git diff $BASE -- <path>` to `$INPUTS/<name>.txt`. Files listed by `git ls-files --others --exclude-standard -z` are untracked additions: write `git diff --no-index /dev/null <path>` for them (exit status 1 is normal) and badge them `Added`. Keep the filenames simple (e.g. `diff-main.go.txt`); the JSON references them by name.++### Step 1b: Blast radius and classification++Run after Phase 5 so the working tree holds the fixes:++```bash+python3 ~/.claude/scripts/blast_radius.py --repo . --snapshot working-tree --base "$BASE" --tools --out "$INPUTS"+```++This writes `$INPUTS/diagram.json` (the one-hop dependency graph) and `$INPUTS/diff-tests.json` (test declarations added and removed in changed test files). Reference both by file name; never transcribe them into the JSON. There is no forge lookup in this skill, so there is no baseline: new and removed tests always come from `diff-tests.json`.++**Classification** — the change is `docs-only` when every changed file is documentation (`.md`, `.rst`, `.adoc`, anything under a `docs/` directory), a `README`, `CHANGELOG`, `LICENSE`, `CONTRIBUTING`, or `CODEOWNERS` file with any extension, an image, a lockfile, or an editor/VCS dotfile such as `.gitignore`. Anything else — CI workflows, build configuration, dependency manifests, `.txt` files elsewhere — makes it `code`.  ### Step 2: Assemble `review.json` @@ -177,6 +211,27 @@ Write a JSON file with this shape. Every top-level key is optional except `repo`      "diff_file": "diff-publish.go.txt"}      // OR "diff": "<inline diff text>"   ], +  "change_classification": "code",            // from Step 1b: code | docs-only+  "diagram_file": "diagram.json",             // written by blast_radius.py, relative to $INPUTS++  "tests": {                                  // from Phase 5 and Step 1b; present for every code change,+    "provenance": {                           // with no_data_reason set when nothing could be collected+      "source":    "local",+      "timestamp": "2026-09-04T10:22:00+10:00",+      "snapshot":  {"sha": "<HEAD sha>", "dirty": true}   // dirty once fixes are applied+    },+    "baseline_provenance": null,              // always null: no forge lookup pre-push+    "coverage_scope": "repository",           // repository (tier 3) | project-configured (tiers 1-2)+    "run_outcome": "passed",                  // passed | failed | timed_out | not_run+    "partial": false,                         // true when a timeout cut the run short+    "junit":    ["junit.xml"],                // file names under $INPUTS+    "coverage": ["coverage.out"],+    "path_map": {"strip": null, "prepend": null},   // only when suffix matching cannot resolve coverage paths+    "run_touched_files": [],                  // from the Phase 5 restore step+    "diff_tests_file": "diff-tests.json",     // written by blast_radius.py+    "no_data_reason": null                    // no tests found | runner not detected | required tool missing |+  },                                          // local run failed | local run timed out+   "publish_metadata": {                       // always populate (see Phase 8).     "title":    "Pre-push review: <branch>",     "repoUrl":  "https://github.com/owner/repo",@@ -187,13 +242,17 @@ Write a JSON file with this shape. Every top-level key is optional except `repo` } ``` +With `change_classification: "docs-only"` the Tests card, Tests section, and diagram are all omitted, whatever else is present.+ **Rendering contract** the script implements (you don't have to): - Pass-through HTML fields: `subtitle`, `at_a_glance` items, `verdict.detail`, every `explanation` panel, `decisions[].body`, `double_check[].body`. Write actual HTML here (e.g. `<p>`, `<ul>`, `<code>`). - Every other field is HTML-escaped automatically. Write plain text, no escaping.-- Diffs are escaped and dropped into `<pre><code class="language-diff">…</code></pre>`; highlight.js paints them and the stylesheet overrides additions/deletions to the Prism Dark green/red tokens.+- Diffs are escaped and coloured by the script's own stylesheet — no external assets. Added lines that have coverage data and zero hits carry an uncovered mark; added lines in files with no coverage data carry none. - The three-level explanation renders as CSS-only radio-button tabs in Beginner → Intermediate → Expert order. The first level present is checked by default. - Important-change cards render a magenta-bordered Takeaway callout and a cyan-bordered Rationale callout. `rationale_unknown: true` swaps the Rationale for a warning-bordered "Open question" callout. `rationale_inferred: true` appends a muted `(inferred — not stated by the author)`. - Findings counts (raised / fixed / skipped) are derived from the `status` field.+- `tests` renders a Tests card in the overview grid (pass rate, new tests, diff coverage) and a Tests section: provenance, availability of run / JUnit / coverage / baseline as independent states, totals with the flaky count, failed tests with messages redacted for secrets and truncated to 500 characters, new and removed tests by declaration name from `diff_tests_file` (labelled diff-derived), a per-file diff-coverage table, touched files, and any warnings. With no readable results it renders a no-data card from `no_data_reason`.+- `diagram_file` renders the Blast radius section as inline SVG before the per-file diffs: dependents, changed files, dependencies, grouped by package or directory, changed nodes linked to their diff. Test files leave the side columns, packages with more than 3 expansion-only files collapse, side columns cap at 15 nodes. An absent or invalid file warns and omits the section. - The TOC, overview cards, and per-section anchors are generated automatically; sections with no data are dropped. - `publish_metadata` is emitted as a `<script type="application/json" id="review-meta">` block in `<head>`, JSON-encoded with `</` escaped. Required by `pulsar publish` (see `docs/agent-contract.md` in the pulsar repo); harmless in browsers when present, ignored when absent. @@ -201,16 +260,20 @@ Write a JSON file with this shape. Every top-level key is optional except `repo`  ```bash python3 ~/.claude/scripts/build_review_html.py \-  --data    /path/to/review.json \+  --data    "$INPUTS/review.json" \   --output  /path/to/pre-push-review.html \-  --diff-dir /path/to/diff-fragments     # defaults to the JSON file's directory+  --diff-dir "$INPUTS" ``` -The script prints the output path on success. Surface that path to the user so they can open it in a browser. If the JSON is malformed or a referenced diff fragment is missing, the script still renders the page — missing diffs become a `(diff fragment 'name.txt' missing)` placeholder so the rest of the review remains usable.+Always pass `--diff-dir` explicitly; every file the JSON references (fragments, JUnit, coverage, `diagram.json`, `diff-tests.json`) is resolved against it. The script prints the output path on success. Surface that path to the user so they can open it in a browser.++**Error handling.** Missing diff fragments show as `(diff fragment 'name.txt' missing)` placeholders. A test, coverage, or diagram input that is missing, malformed, not UTF-8, over 50 MB, or XML with a `DOCTYPE` prints a `warning:` line naming the file, is listed in the Tests section, and the rest of the page still renders with exit status 0. A malformed or unreadable `review.json` does not render: the script prints one line naming the problem and exits non-zero, so fix the JSON and run it again.++**Severity floor.** When a `tests` block is present and the change is not docs-only, the script's last two stderr lines are `summary coverage: matched=N unmatched=N` and `summary tests: passed=N failed=N errored=N skipped=N flaky=N`. Grep stderr for the `summary tests:` prefix. If `failed` or `errored` is non-zero: set `verdict.tone` to `warning` unless it is already `error`, prepend the failure count to `verdict.detail` (e.g. "3 failing tests — "), raise `publish_metadata.severity` to `needs-changes` unless it is already `blocking`, and run the script again to the same output path. When the line is absent there is no test data and no floor applies. Flaky tests and coverage values never change the verdict or severity. -### When to edit the script vs the SKILL.md+### When to edit the renderer vs the SKILL.md -- **Edit the script** when you need a new card, callout colour, layout tweak, or theme adjustment. The Prism Dark palette lives in the `CSS` constant inside the script.+- **Edit the renderer** (the `~/.claude/scripts/review_html/` package; `build_review_html.py` is only the command line) when you need a new card, callout colour, layout tweak, or theme adjustment. The Prism Dark palette lives in `review_html/css.py`; section markup in `sections.py`, the Tests section in `tests_section.py`, the diagram in `diagram.py`. Changes there are shared with `pr-review-html` and `pr-overview`; `make test` in the agentic-coding repo covers them. - **Edit the SKILL.md** when you change the JSON contract, the location-priority logic, or the upstream phase semantics.  ### Populating `publish_metadata`@@ -220,7 +283,7 @@ Always populate this field. Mapping rules: - `title`: human-readable, mirror the H1 (e.g. `Pre-push review: <branch>`). - `repoUrl`: from `git remote get-url origin`; the binary normalises SSH → HTTPS and strips `.git`. - `branch`: the current branch name. **Do not** set `pr` for a pre-push review — no PR exists yet.-- `severity`: derive from the verdict tone and findings — `success`/no major findings → `lgtm`; `warning` with only nits → `suggestions`; major findings raised → `needs-changes`; blocking/security/correctness issues → `blocking`.+- `severity`: derive from the verdict tone and findings — `success`/no major findings → `lgtm`; `warning` with only nits → `suggestions`; major findings raised → `needs-changes`; blocking/security/correctness issues → `blocking`. Failing or errored tests floor it at `needs-changes` (Step 3). - `summary`: 1–3 sentences leading with the headline finding (not "I reviewed X"). This is what shows up in the user's feed reader.  ## Phase 8: Publish

diff --git a/scripts/README.md b/scripts/README.mdindex 0f7c17a..1a5d9d7 100644--- a/scripts/README.md+++ b/scripts/README.md@@ -54,14 +54,64 @@ python3 ~/.claude/scripts/build_review_html.py \  **JSON schema**: see the docstring at the top of the script. Top-level keys are `repo`, `title`, `subtitle`, `metrics`, `verdict`, `at_a_glance`, `explanation` (beginner/intermediate/expert), `commits`, `important_changes`, `decisions`, `findings`, `double_check`, `files`. Empty sections are dropped from both the body and the table of contents. +Optional keys: `tests` holds the test-results block (JUnit and coverage file names, provenance, jobs, artifacts; see the spec's design document) rendered as the Tests card and section. `diagram_file` names a `diagram.json` written by `blast_radius.py`, read relative to `--diff-dir`, and rendered as the Blast radius section (inline SVG, before the per-file diffs). `change_classification: "docs-only"` suppresses both the Tests and Blast radius sections without a warning. An absent or invalid diagram file prints a warning to stderr, omits the section, and still exits 0. A review JSON that cannot be read or parsed prints one `error:` line and exits 2.+ **Behavior**:-- Renders the Prism Dark palette as inline CSS — fully self-contained except for the highlight.js CDN load for diff syntax colouring.+- Renders the Prism Dark palette as inline CSS — fully self-contained, with no external assets. - Important-change cards render Takeaway (magenta) and Rationale (cyan) callouts, with an Open Question (warning) variant when `rationale_unknown: true`. - The three-level explanation renders as CSS-only radio-button tabs (no JS required). - Per-file diffs are collapsed `<details>` blocks. Missing diff fragments degrade to a placeholder rather than failing the render.  **Output**: Prints the absolute path of the written HTML on success. +**Layout**: `build_review_html.py` is a thin entry point; the renderer lives in the `review_html/` package next to it (`css.py` holds the stylesheet, `sections.py` the section renderers, `diagram.py` the blast-radius projection and SVG, `render.py` the orchestration). `sync-claude.sh` links the whole directory, so the package syncs with the script.++### blast_radius.py++**Purpose**: Derives the one-hop dependency graph around a change (the changed files, the files that import them, and the files they import) from git trees, and writes it as `diagram.json` for the renderer, plus `diff-tests.json` listing test declarations added and removed in changed test files. Used by the `pre-push-review`, `pr-review-html`, and `pr-overview` skills.++**Usage**:+```bash+python3 ~/.claude/scripts/blast_radius.py \+  --repo DIR \                     # repository directory (default: .)+  --snapshot (SHA|working-tree) \  # the tree the page describes+  --base SHA \                     # the tree it is compared against+  [--remote OWNER/REPO] \          # read both trees through the GitHub API (no clone needed)+  [--ecosystems FILE] \            # defaults to ecosystems.json next to the script+  [--tools] \                      # run each ecosystem row's dependency tool in --repo+  --out DIR                        # writes DIR/diagram.json and DIR/diff-tests.json+```++**Prerequisites**: git, or the GitHub CLI (`gh`) authenticated for `--remote`. `--remote` needs a commit SHA snapshot and cannot be combined with `--tools`.++**Behavior**:+- Changed files come from `git diff --name-status -M -C` (copies count as added, type changes as modified) plus untracked files as added for a working-tree snapshot; with `--remote`, from the compare API.+- Trees come from `git ls-tree`, the working tree, or the trees API. Symlinks, submodules, and blobs over 1 MB are never scanned; skipped blobs are listed in `skipped`. Files whose extension has no row in `ecosystems.json` are not scanned.+- Imports are matched with each row's patterns and resolved to files by the row's resolver: `relative` (path relative to the importer, trying `extension_map`, `extensions`, then `index_files`), `roots` (segments joined under each `source_roots` entry, retrying once with the last segment dropped for symbol imports), or `unit` (a package, module, or target expanded to every file in it, recorded with `granularity: package`). Only edges touching a changed file are kept; each carries `method` (`import`, `expansion`, or `tool:<name>`), `granularity`, and `tree` (`snapshot` or `base`).+- Deleted files and the old paths of renamed files are scanned in the base tree, so their edges carry `tree: base`.+- `column_status` reports `complete`, `partial: remote scan cap reached` (the blob API is capped at 500 calls; dependencies of the changed files are always read), or `failed: <reason>` (`no import patterns for <extensions>`, `tree listing truncated`). A failed column is rendered as its reason, never as an empty column.+- With `--tools`, a row's `tool.deps` command runs in `--repo` and its edges replace the scanned edges for the same file pair; a failing tool leaves the scanned edges in place with a warning.+- `diff-tests.json` scans the diff of each changed test file with the row's `test_decl`; test files whose row has no pattern are listed in `unpatterned_files`.++**Output**: Prints the paths of the two files written. Exit status 1 on git or API errors, 2 on invalid arguments.++### ecosystems.json++One row per language, read by `blast_radius.py` and by the review skills. Keys the script reads:++| Key | Meaning |+|-----|---------|+| `extensions` | file extensions the row covers |+| `test_files` | regexes marking a path as a test file (files with no row fall back to a `test`/`spec` name or directory rule) |+| `test_decl` | regex whose first group (or whole match minus the leading keyword) is a test name; matched over the added and removed lines of a diff |+| `unit` | grouping rule: `{"kind": "directory"}`, `{"kind": "module_file", "module_file": "go.mod", "module_regex": ...}`, or `{"kind": "target_root", "target_root": "Sources"}` |+| `imports` | list of `{"regex", "resolve": "relative" \| "roots" \| "unit", "separator"}`; multiple groups are joined with the separator |+| `source_roots`, `index_files`, `extension_map` | inputs to the `roots` and `relative` resolvers |+| `tool` | `{"name", "deps", "format": "go-list-json" \| "pairs", "granularity"}`; `pairs` output is one `from<TAB>to` line per edge |+| `notes` | known holes in the row, shown to the agent |++Runner recipes (`runners[]`) that tell the skills how to emit JUnit XML and coverage live on the same rows and are read by the agent, not the script. Each runner has `name`, `detect` (`files` globs and/or `package_json_keys`), `recipe`, `requires` (binaries that must be on PATH), `coverage_format` (`lcov`, `cobertura`, or `coverprofile`), `install`, `junit_flags` (the flags a Makefile target must contain to count as emitting JUnit), and optionally `env` and `config_files` (templates written under the inputs directory). Recipes, env values, and templates use only the placeholders `{junit}`, `{coverage}`, and `{inputs}`. `scripts/tests/test_ecosystems.py` checks both key sets.+ ### copilot-pr-comments.sh  **Purpose**: Fetches and displays GitHub Copilot's review comments and inline comments for the current branch's pull request.@@ -139,6 +189,16 @@ go run . <directory>    # Convert all _test.go files in directory From: `tests := []struct { name string; ... }` with `for _, tt := range tests` To: `tests := map[string]struct { ... }` with `for name, tt := range tests` +## Tests++Run the renderer test suite from the repository root with:++```bash+make test+```++This runs `cd scripts && python3 -m unittest discover -s tests -t .`. Tests live in `scripts/tests/` with fixtures under `scripts/tests/fixtures/`. `fixtures/golden.html` is the page the renderer at commit `9da40cf` produced from `fixtures/golden.json`; `test_golden.py` renders the same JSON with the current entry point and compares the two after blanking the `<style>` contents and the `Generated …` footer line. Regenerate the golden page only when the rendering contract intentionally changes.+ ## Agent Usage Notes  - Both scripts include error handling and provide informative output messages

diff --git a/scripts/blast_radius.py b/scripts/blast_radius.pynew file mode 100644index 0000000..5488b65--- /dev/null+++ b/scripts/blast_radius.py@@ -0,0 +1,827 @@+#!/usr/bin/env python3+"""Derive the one-hop dependency graph around a change from git trees.++Reads two trees (the snapshot and the base), scans imports per+``ecosystems.json``, and writes ``diagram.json`` (nodes, edges, column+status, skipped files) plus ``diff-tests.json`` (test declarations added and+removed in changed test files). The renderer applies the projection rules;+this script only reports what the trees say.++Usage:+    blast_radius.py --repo DIR --snapshot (SHA|working-tree) --base SHA+                    [--remote OWNER/REPO] [--ecosystems FILE] [--tools] --out DIR++``--remote`` reads both trees through the GitHub trees and blobs API instead+of git, for use without a clone; it cannot be combined with a working-tree+snapshot or ``--tools``. ``--tools`` runs each ecosystem row's dependency tool+in ``--repo`` and lets its edges replace scanned edges for the same pair.+"""+from __future__ import annotations++import argparse+import base64+import json+import os+import posixpath+import re+import stat+import subprocess+import sys+from dataclasses import dataclass, field+from pathlib import Path++MAX_BLOB = 1024 * 1024          # blobs over this are recorded as skipped, never scanned+REMOTE_BLOB_CAP = 500           # blob API calls before dependents scanning stops+COMPARE_PAGE = 300              # compare API files per page+SKIP_MODES = ("120000", "160000")   # symlinks and submodules+STATUS_CODES = {"A": "added", "M": "modified", "D": "deleted", "R": "renamed",+                "C": "added", "T": "modified"}+REMOTE_STATUSES = {"added": "added", "modified": "modified", "removed": "deleted",+                   "renamed": "renamed", "copied": "added", "changed": "modified"}+# Without an ecosystem row: test-looking file names (test_x, x_test, x.test.ts,+# x.spec.js, XTests.swift, conftest.py) or a parent directory that is itself a+# test directory. Whole tokens only, so ``specs/`` and ``docs/testing.md`` are+# not tests.+_FALLBACK_TEST_NAME = re.compile(+    r"^(test[_-]|conftest\.py$)|[_-]tests?\.\w+$|\.(test|spec)\.\w+$|Tests?\.\w+$")+_FALLBACK_TEST_DIRS = frozenset({"test", "tests", "__tests__", "spec"})+++def warn(message: str) -> None:+    print(f"warning: {message}", file=sys.stderr)+++# --- ecosystems -------------------------------------------------------------++@dataclass+class ImportSpec:+    regex: re.Pattern+    resolve: str+    separator: str+++@dataclass+class Row:+    name: str+    extensions: list+    test_files: list+    test_decl: object            # re.Pattern or None+    unit: dict+    imports: list+    source_roots: list+    index_files: list+    extension_map: dict+    tool: object                 # dict or None+++class Ecosystems:+    def __init__(self, data: dict) -> None:+        self.rows = {}+        self.by_ext = {}+        for name, raw in data.items():+            row = Row(+                name=name,+                extensions=[e.lower() for e in raw.get("extensions", [])],+                test_files=[re.compile(p) for p in raw.get("test_files", [])],+                test_decl=re.compile(raw["test_decl"], re.MULTILINE) if raw.get("test_decl") else None,+                unit=raw.get("unit") or {"kind": "directory"},+                imports=[ImportSpec(re.compile(i["regex"], re.MULTILINE), i.get("resolve", "relative"),+                                    i.get("separator", "."))+                         for i in raw.get("imports", [])],+                source_roots=raw.get("source_roots") or ["."],+                index_files=raw.get("index_files") or [],+                extension_map=raw.get("extension_map") or {},+                tool=raw.get("tool"),+            )+            self.rows[name] = row+            for ext in row.extensions:+                self.by_ext.setdefault(ext, row)++    def row_for(self, path: str):+        return self.by_ext.get(posixpath.splitext(path)[1].lower())+++def load_ecosystems(path: Path) -> Ecosystems:+    return Ecosystems(json.loads(path.read_text(encoding="utf-8")))+++def is_test_file(path: str, row) -> bool:+    """The row's patterns, or the name/nearest-directory rule without a row."""+    if row is not None and row.test_files:+        return any(p.search(path) for p in row.test_files)+    name = posixpath.basename(path)+    parent = posixpath.basename(posixpath.dirname(path))+    return bool(_FALLBACK_TEST_NAME.search(name)) or parent in _FALLBACK_TEST_DIRS+++# --- changed files ----------------------------------------------------------++@dataclass+class Changed:+    path: str+    status: str+    old_path: object = None      # str for renames+++def parse_name_status(raw: str) -> list:+    """Parse ``git diff --name-status -z`` output; C becomes added, T modified."""+    parts = raw.split("\0")+    out = []+    i = 0+    while i < len(parts) and parts[i]:+        code = parts[i][0]+        if code in "RC":+            old, new = parts[i + 1], parts[i + 2]+            i += 3+        else:+            old, new = None, parts[i + 1]+            i += 2+        if code in STATUS_CODES:+            out.append(Changed(new, STATUS_CODES[code], old if code == "R" else None))+    return out+++def git(repo: Path, *args: str, binary: bool = False):+    result = subprocess.run(["git", "-C", str(repo), *args], capture_output=True)+    if result.returncode != 0:+        raise RuntimeError(f"git {' '.join(args[:2])} failed: {result.stderr.decode('utf-8', 'replace').strip()}")+    return result.stdout if binary else result.stdout.decode("utf-8", "replace")+++def changed_files_local(repo: Path, base: str, snapshot: str) -> list:+    args = ["diff", "--name-status", "-M", "-C", "-z", base]+    if snapshot != "working-tree":+        args.append(snapshot)+    changed = parse_name_status(git(repo, *args))+    if snapshot == "working-tree":+        seen = {c.path for c in changed}+        for path in git(repo, "ls-files", "--others", "--exclude-standard", "-z").split("\0"):+            if path and path not in seen:+                changed.append(Changed(path, "added", None))+    return changed+++def gh_api(path: str) -> object:+    """One GitHub API call through ``gh``; tests replace this function."""+    remote = "/".join(path.split("/")[1:3])+    result = subprocess.run(["gh", "api", "-R", remote, path], capture_output=True, text=True)+    if result.returncode != 0:+        raise RuntimeError(f"gh api {path}: {result.stderr.strip()}")+    return json.loads(result.stdout)+++def changed_files_remote(remote: str, base: str, snapshot: str) -> tuple:+    files = []+    page = 1+    while True:+        data = gh_api(f"repos/{remote}/compare/{base}...{snapshot}?per_page={COMPARE_PAGE}&page={page}")+        batch = data.get("files") or []+        files.extend(batch)+        if len(batch) < COMPARE_PAGE:+            break+        page += 1+    changed = []+    patches = {}+    for f in files:+        status = REMOTE_STATUSES.get(f.get("status"))+        if status is None:+            continue+        old = f.get("previous_filename") if f.get("status") == "renamed" else None+        changed.append(Changed(f["filename"], status, old))+        patches[f["filename"]] = f.get("patch") or ""+    return changed, patches+++# --- trees ------------------------------------------------------------------++@dataclass+class Entry:+    path: str+    sha: object                  # str, or None for working-tree files+    size: int+    mode: str+++def parse_ls_tree(raw: str) -> dict:+    """Parse ``git ls-tree -r -l -z``; symlinks and submodules are dropped."""+    entries = {}+    for record in raw.split("\0"):+        if not record:+            continue+        meta, _, path = record.partition("\t")+        fields = meta.split()+        if len(fields) != 4:+            continue+        mode, kind, sha, size = fields+        if mode in SKIP_MODES or kind != "blob":+            continue+        entries[path] = Entry(path, sha, int(size) if size.isdigit() else 0, mode)+    return entries+++class CatFile:+    """One ``git cat-file --batch`` process serving blob reads by SHA."""++    def __init__(self, repo: Path) -> None:+        self.proc = subprocess.Popen(["git", "-C", str(repo), "cat-file", "--batch"],+                                     stdin=subprocess.PIPE, stdout=subprocess.PIPE)++    def read(self, sha: str):+        self.proc.stdin.write((sha + "\n").encode("ascii"))+        self.proc.stdin.flush()+        header = self.proc.stdout.readline().split()+        if len(header) < 3:+            return None+        size = int(header[2])+        data = self.proc.stdout.read(size)+        self.proc.stdout.read(1)+        return data++    def close(self) -> None:+        try:+            self.proc.stdin.close()+            self.proc.wait(timeout=5)+        except Exception:+            self.proc.kill()+++class Tree:+    """A file listing plus a blob reader; ``label`` names it on edges."""++    label = ""+    truncated = False++    def __init__(self) -> None:+        self.entries = {}++    def read(self, path: str, essential: bool = False):+        raise NotImplementedError++    def close(self) -> None:+        pass+++class GitTree(Tree):+    def __init__(self, repo: Path, sha: str, label: str) -> None:+        super().__init__()+        self.label = label+        self.entries = parse_ls_tree(git(repo, "ls-tree", "-r", "-l", "-z", sha))+        self.cat = CatFile(repo)++    def read(self, path: str, essential: bool = False):+        entry = self.entries.get(path)+        if entry is None:+            return None+        data = self.cat.read(entry.sha)+        return None if data is None else data.decode("utf-8", "replace")++    def close(self) -> None:+        self.cat.close()+++class WorkingTree(Tree):+    label = "snapshot"++    def __init__(self, repo: Path) -> None:+        super().__init__()+        self.repo = repo+        tracked = git(repo, "ls-files", "-z")+        self.tracked = set(tracked.split("\0"))+        listing = tracked + git(repo, "ls-files", "--others", "--exclude-standard", "-z")+        for path in listing.split("\0"):+            if not path:+                continue+            try:+                st = os.lstat(repo / path)+            except OSError:+                continue+            if not stat.S_ISREG(st.st_mode):+                continue+            self.entries[path] = Entry(path, None, st.st_size, "100644")++    def read(self, path: str, essential: bool = False):+        try:+            return (self.repo / path).read_bytes().decode("utf-8", "replace")+        except OSError:+            return None+++class RemoteBudget:+    def __init__(self) -> None:+        self.calls = 0+        self.cap_hit = False+++class RemoteTree(Tree):+    def __init__(self, remote: str, sha: str, label: str, budget: RemoteBudget) -> None:+        super().__init__()+        self.remote = remote+        self.label = label+        self.budget = budget+        data = gh_api(f"repos/{remote}/git/trees/{sha}?recursive=1")+        self.truncated = bool(data.get("truncated"))+        for item in data.get("tree") or []:+            if item.get("type") != "blob" or item.get("mode") in SKIP_MODES:+                continue+            self.entries[item["path"]] = Entry(item["path"], item["sha"], int(item.get("size") or 0),+                                               item.get("mode", "100644"))++    def read(self, path: str, essential: bool = False):+        entry = self.entries.get(path)+        if entry is None:+            return None+        if not essential and self.budget.calls >= REMOTE_BLOB_CAP:+            self.budget.cap_hit = True+            return None+        self.budget.calls += 1+        data = gh_api(f"repos/{self.remote}/git/blobs/{entry.sha}")+        content = data.get("content") or ""+        if data.get("encoding") == "base64":+            raw = base64.b64decode(content)+        else:+            raw = content.encode("utf-8")+        return raw.decode("utf-8", "replace")+++# --- groups and resolution --------------------------------------------------++class Grouper:+    """Maps a file to its unit (package, target, or directory) within one tree."""++    def __init__(self, eco: Ecosystems, tree: Tree) -> None:+        self.eco = eco+        self.tree = tree+        self._modules = {}       # module_file name -> {dir: module path}++    def _modules_for(self, row: Row) -> dict:+        name = row.unit.get("module_file")+        if name in self._modules:+            return self._modules[name]+        regex = re.compile(row.unit.get("module_regex", r"^module\s+(\S+)"), re.MULTILINE)+        modules = {}+        for path in sorted(self.tree.entries):+            if posixpath.basename(path) != name:+                continue+            text = self.tree.read(path, essential=True) or ""+            m = regex.search(text)+            if m:+                modules[posixpath.dirname(path)] = m.group(1)+        self._modules[name] = modules+        return modules++    def group(self, path: str, row) -> str:+        directory = posixpath.dirname(path) or "."+        if row is None:+            return directory+        kind = row.unit.get("kind", "directory")+        if kind == "module_file":+            modules = self._modules_for(row)+            d = posixpath.dirname(path)+            while True:+                if d in modules:+                    rel = posixpath.relpath(posixpath.dirname(path) or ".", d or ".")+                    return modules[d] if rel == "." else modules[d] + "/" + rel+                if not d:+                    return directory+                d = posixpath.dirname(d)+        if kind == "target_root":+            root = row.unit.get("target_root", "Sources")+            if path.startswith(root + "/"):+                segments = path[len(root) + 1:].split("/")+                if len(segments) >= 2:+                    return segments[0]+        return directory+++class Resolver:+    """Resolves import strings to files of one tree."""++    def __init__(self, eco: Ecosystems, tree: Tree, grouper: Grouper) -> None:+        self.eco = eco+        self.paths = set(tree.entries)+        self.grouper = grouper+        self._by_group = None++    def _unit_index(self) -> dict:+        if self._by_group is None:+            index = {}+            for path in sorted(self.paths):+                row = self.eco.row_for(path)+                if row is None:+                    continue+                index.setdefault((row.name, self.grouper.group(path, row)), []).append(path)+            self._by_group = index+        return self._by_group++    def resolve(self, importer: str, name: str, spec: ImportSpec, row: Row) -> list:+        """Return ``[(target, granularity), ...]``; an unresolved import yields ``[]``."""+        if not name:+            return []+        if spec.resolve == "unit":+            targets = self._unit_index().get((row.name, name), [])+            return [(t, "package") for t in targets if t != importer]+        if spec.resolve == "roots":+            target = self._roots(importer, name, spec, row)+        else:+            target = self._relative(importer, name, row)+        if target is None or target == importer:+            return []+        return [(target, "file")]++    def _try(self, candidate: str, row: Row, with_extensions: bool = True):+        if with_extensions:+            if candidate in self.paths:+                return candidate+            ext = posixpath.splitext(candidate)[1]+            for alt in row.extension_map.get(ext, []):+                p = candidate[:-len(ext)] + alt+                if p in self.paths:+                    return p+            for e in row.extensions:+                if candidate + e in self.paths:+                    return candidate + e+        for index in row.index_files:+            p = posixpath.join(candidate, index) if candidate else index+            if p in self.paths:+                return p+        return None++    def _relative(self, importer: str, name: str, row: Row):+        base = posixpath.dirname(importer)+        bases = [base]+        if not name.startswith("."):+            # A bare name (Rust ``mod foo;``) may live under the importer's own+            # module directory; crate roots and index files use the sibling rule.+            stem = posixpath.splitext(posixpath.basename(importer))[0]+            if posixpath.basename(importer) not in row.index_files and stem not in ("lib", "main"):+                bases.insert(0, posixpath.join(base, stem) if base else stem)+        for b in bases:+            candidate = posixpath.normpath(posixpath.join(b, name) if b else name)+            if candidate.startswith("../") or candidate == "..":+                continue+            found = self._try(candidate, row)+            if found:+                return found+        return None++    def _roots(self, importer: str, name: str, spec: ImportSpec, row: Row):+        sep = spec.separator or "."+        if name.startswith(sep):+            level = 0+            while name.startswith(sep, level * len(sep)):+                level += 1+            rest = name[level * len(sep):]+            d = posixpath.dirname(importer)+            for _ in range(level - 1):+                d = posixpath.dirname(d)+            segments = [s for s in rest.split(sep) if s]+            bases = [d]+        else:+            segments = [s for s in name.split(sep) if s]+            bases = ["" if r == "." else r for r in row.source_roots]+        attempts = [segments]+        if segments:+            attempts.append(segments[:-1])     # a symbol import: drop the last segment once+        for attempt in attempts:+            for b in bases:+                candidate = posixpath.join(b, *attempt) if attempt else b+                found = self._try(candidate, row, with_extensions=bool(attempt))+                if found:+                    return found+        return None+++def _groups(m: re.Match) -> list:+    """The match's participating capture groups, in order."""+    return [g for g in m.groups() if g is not None]+++def scan_imports(text: str, row: Row) -> list:+    """``[(import string, spec), ...]`` in source order."""+    out = []+    for spec in row.imports:+        for m in spec.regex.finditer(text):+            groups = _groups(m)+            if not groups:+                name = m.group(0)+            elif len(groups) == 1:+                name = groups[0]+            else:+                name = groups[0]+                for g in groups[1:]:+                    name += g if name.endswith(spec.separator) else spec.separator + g+            out.append((name.strip(), spec))+    return out+++# --- tools ------------------------------------------------------------------++def parse_go_list(output: str, repo: Path) -> list:+    """File pairs from ``go list -json`` output (a stream of JSON objects)."""+    decoder = json.JSONDecoder()+    packages = []+    text = output.strip()+    index = 0+    while index < len(text):+        obj, end = decoder.raw_decode(text, index)+        packages.append(obj)+        index = end+        while index < len(text) and text[index].isspace():+            index += 1+    by_import = {p.get("ImportPath"): p for p in packages}+    real_repo = os.path.realpath(str(repo))++    def rel(pkg: dict, name: str) -> str:+        d = pkg.get("Dir") or ""+        if os.path.isabs(d):+            d = os.path.relpath(os.path.realpath(d), real_repo)+        return posixpath.normpath(posixpath.join(d.replace(os.sep, "/"), name))++    def files_of(pkg: dict) -> list:+        return [rel(pkg, f) for f in (pkg.get("GoFiles") or []) + (pkg.get("CgoFiles") or [])]++    pairs = []+    for pkg in packages:+        sets = (+            (files_of(pkg) + [rel(pkg, f) for f in pkg.get("TestGoFiles") or []],+             (pkg.get("Imports") or []) + (pkg.get("TestImports") or [])),+            ([rel(pkg, f) for f in pkg.get("XTestGoFiles") or []], pkg.get("XTestImports") or []),+        )+        for files, imports in sets:+            targets = [t for imp in imports if imp in by_import for t in files_of(by_import[imp])]+            for f in files:+                for t in targets:+                    pairs.append((f, t))+    return pairs+++def parse_pairs(output: str) -> list:+    pairs = []+    for line in output.splitlines():+        a, _, b = line.partition("\t")+        if a and b:+            pairs.append((a.strip(), b.strip()))+    return pairs+++def tool_edges(row: Row, repo: Path) -> list:+    tool = row.tool+    result = subprocess.run(tool["deps"], shell=True, cwd=str(repo), capture_output=True, text=True)+    if result.returncode != 0:+        tail = result.stderr.strip().splitlines()[-1:] or [""]+        raise RuntimeError(f"exit {result.returncode}: {tail[0]}")+    if tool.get("format") == "go-list-json":+        return parse_go_list(result.stdout, repo)+    return parse_pairs(result.stdout)+++# --- diff-derived tests -----------------------------------------------------++def _decl_names(text: str, row: Row) -> set:+    names = set()+    for m in row.test_decl.finditer(text):+        groups = _groups(m)+        if groups:+            names.add(groups[0])+        else:+            names.add(re.sub(r"^\s*\w+\s+", "", m.group(0)).strip())+    return names+++def diff_test_names(diff: str, row: Row) -> tuple:+    """``(added, removed)`` declaration names from a unified diff."""+    added, removed = [], []+    for line in diff.split("\n"):+        if line.startswith("+") and not line.startswith("+++"):+            added.append(line[1:])+        elif line.startswith("-") and not line.startswith("---"):+            removed.append(line[1:])+    return _decl_names("\n".join(added), row), _decl_names("\n".join(removed), row)+++def local_diff(repo: Path, base: str, snapshot: str, changed: Changed, tracked: bool) -> str:+    if not tracked:+        result = subprocess.run(["git", "-C", str(repo), "diff", "--no-index", "--", "/dev/null", changed.path],+                                capture_output=True)+        return result.stdout.decode("utf-8", "replace")+    args = ["diff", "-M", "-C", base]+    if snapshot != "working-tree":+        args.append(snapshot)+    args += ["--"] + [p for p in (changed.old_path, changed.path) if p]+    return git(repo, *args)+++# --- build ------------------------------------------------------------------++@dataclass+class Graph:+    nodes: dict = field(default_factory=dict)+    edges: dict = field(default_factory=dict)+    skipped: dict = field(default_factory=dict)+++def build(args: argparse.Namespace, eco: Ecosystems) -> tuple:+    repo = Path(args.repo).resolve()+    base, snapshot = args.base, args.snapshot+    working = snapshot == "working-tree"+    patches = {}+    if args.remote:+        changed, patches = changed_files_remote(args.remote, base, snapshot)+        budget = RemoteBudget()+        snap_tree = RemoteTree(args.remote, snapshot, "snapshot", budget)+        base_tree = RemoteTree(args.remote, base, "base", budget)+    else:+        changed = changed_files_local(repo, base, snapshot)+        budget = None+        snap_tree = WorkingTree(repo) if working else GitTree(repo, snapshot, "snapshot")+        base_tree = GitTree(repo, base, "base")+    try:+        return _build(args, eco, repo, changed, patches, snap_tree, base_tree, budget)+    finally:+        snap_tree.close()+        base_tree.close()+++def _build(args, eco, repo, changed, patches, snap_tree, base_tree, budget) -> tuple:+    changed_set = {c.path for c in changed}+    deleted = {c.path for c in changed if c.status == "deleted"}+    old_to_new = {c.old_path: c.path for c in changed if c.old_path}+    groupers = {snap_tree.label: Grouper(eco, snap_tree), base_tree.label: Grouper(eco, base_tree)}+    trees = {snap_tree.label: snap_tree, base_tree.label: base_tree}+    resolvers = {label: Resolver(eco, tree, groupers[label]) for label, tree in trees.items()}+    graph = Graph()++    def ensure_node(path: str, tree_label: str, changed_entry=None) -> None:+        if path in graph.nodes:+            return+        row = eco.row_for(path)+        status = changed_entry.status if changed_entry else "unchanged"+        graph.nodes[path] = {+            "path": path, "status": status,+            "group": groupers[tree_label].group(path, row),+            "is_test": is_test_file(path, row),+            "old_path": changed_entry.old_path if changed_entry else None,+        }++    for c in changed:+        ensure_node(c.path, "base" if c.status == "deleted" else "snapshot", c)++    column_status = {"dependents": "complete", "dependencies": "complete"}+    failed = None+    if snap_tree.truncated or base_tree.truncated:+        failed = "tree listing truncated"+    elif not any(eco.row_for(c.path) and eco.row_for(c.path).imports for c in changed):+        exts = sorted({posixpath.splitext(c.path)[1] or "(none)" for c in changed})+        failed = "no import patterns for " + ", ".join(exts)+    if failed:+        column_status = {"dependents": "failed: " + failed, "dependencies": "failed: " + failed}+    else:+        def add_edge(a: str, b: str, method: str, granularity: str, tree_label: str,+                     replace: bool = False) -> None:+            if a == b or (a not in changed_set and b not in changed_set):+                return+            if (a, b) in graph.edges and not replace:+                return+            graph.edges[(a, b)] = {"from": a, "to": b, "method": method,+                                   "granularity": granularity, "tree": tree_label}+            ensure_node(a, tree_label)+            ensure_node(b, tree_label)++        import_cache = {}++        def scan(path: str, tree_label: str, essential: bool, only_targets=None) -> None:+            tree = trees[tree_label]+            row = eco.row_for(path)+            entry = tree.entries.get(path)+            if row is None or not row.imports or entry is None:+                return+            if entry.size > MAX_BLOB:+                graph.skipped.setdefault(path, "blob over 1 MB")+                return+            key = (entry.sha, row.name) if entry.sha else None+            imports = import_cache.get(key) if key else None+            if imports is None:+                text = tree.read(path, essential)+                if text is None:+                    return+                imports = scan_imports(text, row)+                if key:+                    import_cache[key] = imports+            source = old_to_new.get(path, path) if tree_label == "base" else path+            for name, spec in imports:+                for target, granularity in resolvers[tree_label].resolve(path, name, spec, row):+                    if only_targets is not None and target not in only_targets:+                        continue+                    mapped = old_to_new.get(target, target) if tree_label == "base" else target+                    add_edge(source, mapped, "expansion" if granularity == "package" else "import",+                             granularity, tree_label)++        # Dependencies and centre edges: the changed files' own blobs.+        for c in changed:+            if c.status != "deleted":+                scan(c.path, "snapshot", essential=True)+        for path in sorted(deleted):+            scan(path, "base", essential=True)+        # Dependents: every other snapshot file.+        for path in sorted(snap_tree.entries):+            if path not in changed_set:+                scan(path, "snapshot", essential=False)+        # Base-tree importers of deleted files and old renamed paths.+        base_targets = deleted | set(old_to_new)+        if base_targets:+            for path in sorted(base_tree.entries):+                if path not in base_targets:+                    scan(path, "base", essential=False, only_targets=base_targets)+        if budget is not None and budget.cap_hit:+            column_status["dependents"] = "partial: remote scan cap reached"++        if args.tools:+            changed_rows = {eco.row_for(c.path).name for c in changed if eco.row_for(c.path)}+            for name in sorted(changed_rows):+                row = eco.rows[name]+                if not row.tool:+                    continue+                tool_name = row.tool.get("name") or row.tool["deps"].split()[0]+                try:+                    pairs = tool_edges(row, repo)+                except (RuntimeError, OSError, ValueError) as exc:+                    warn(f"tool {tool_name} failed, keeping scanned edges: {exc}")+                    continue+                for a, b in pairs:+                    add_edge(a, b, f"tool:{tool_name}", row.tool.get("granularity", "package"),+                             "snapshot", replace=True)++    # Diff-derived tests.+    added, removed, unpatterned = set(), set(), []+    for c in changed:+        row = eco.row_for(c.path)+        if not is_test_file(c.path, row):+            continue+        if row is None or row.test_decl is None:+            unpatterned.append(c.path)+            continue+        if args.remote:+            diff = patches.get(c.path, "")+        else:+            # A working-tree snapshot is a WorkingTree, which lists the tracked files.+            is_tracked = (args.snapshot != "working-tree" or c.status == "deleted"+                          or c.path in snap_tree.tracked)+            diff = local_diff(repo, args.base, args.snapshot, c, is_tracked)+        a, r = diff_test_names(diff, row)+        added |= a+        removed |= r++    diagram = {+        "snapshot_tree": args.snapshot,+        "base_tree": args.base,+        "nodes": [graph.nodes[p] for p in sorted(graph.nodes)],+        "edges": [graph.edges[k] for k in sorted(graph.edges)],+        "column_status": column_status,+        "skipped": [{"path": p, "reason": r} for p, r in sorted(graph.skipped.items())],+    }+    diff_tests = {+        "added": sorted(added - removed),+        "removed": sorted(removed - added),+        "unpatterned_files": sorted(unpatterned),+    }+    return diagram, diff_tests+++def main(argv=None) -> int:+    parser = argparse.ArgumentParser(description="Derive the one-hop dependency graph around a change.")+    parser.add_argument("--repo", default=".", help="Repository directory (default: current directory).")+    parser.add_argument("--snapshot", required=True, help="Commit SHA, or 'working-tree'.")+    parser.add_argument("--base", required=True, help="Base commit SHA.")+    parser.add_argument("--remote", default=None, metavar="OWNER/REPO",+                        help="Read both trees through the GitHub API instead of git.")+    parser.add_argument("--ecosystems", type=Path,+                        default=Path(__file__).resolve().parent / "ecosystems.json")+    parser.add_argument("--tools", action="store_true",+                        help="Run each ecosystem row's dependency tool in --repo.")+    parser.add_argument("--out", required=True, type=Path, help="Directory for the two output files.")+    args = parser.parse_args(argv)++    if args.remote and args.snapshot == "working-tree":+        parser.error("--remote needs a commit SHA snapshot, not working-tree")+    if args.remote and args.tools:+        parser.error("--tools needs a local checkout and cannot be combined with --remote")+    try:+        eco = load_ecosystems(args.ecosystems)+    except (OSError, ValueError) as exc:+        print(f"error: cannot load ecosystems file {args.ecosystems}: {exc}", file=sys.stderr)+        return 1+    try:+        diagram, diff_tests = build(args, eco)+    except (RuntimeError, OSError, ValueError, KeyError) as exc:+        print(f"error: {exc}", file=sys.stderr)+        return 1+    args.out.mkdir(parents=True, exist_ok=True)+    for name, payload in (("diagram.json", diagram), ("diff-tests.json", diff_tests)):+        path = args.out / name+        path.write_text(json.dumps(payload, indent=1, ensure_ascii=False) + "\n", encoding="utf-8")+        print(str(path))+    return 0+++if __name__ == "__main__":+    raise SystemExit(main())

diff --git a/scripts/build_review_html.py b/scripts/build_review_html.pyindex 89e0b6d..022e26b 100644--- a/scripts/build_review_html.py+++ b/scripts/build_review_html.py@@ -39,6 +39,11 @@ JSON schema (see SKILL.md "Phase 7" for the contract):       "double_check":    [{"title", "body": "<html>"}, ...],       "files":           [{"path", "badge", "stat",                             "diff"?: "<text>", "diff_file"?: "name.txt"}, ...],+      "tests":           {...},              // optional; the Tests card and section, see+                                             // specs/review-html-tests-diagram/design.md+      "diagram_file":    "diagram.json",     // optional; written by blast_radius.py, read+                                             // relative to --diff-dir (Blast radius section)+      "change_classification": "docs-only",  // optional; suppresses Tests and Blast radius       "publish_metadata": {                  // optional; emits a <script id="review-meta">         "title":    "...",                   // block in <head> consumable by `pulsar publish`         "repoUrl":  "https://...",@@ -54,902 +59,22 @@ Rendering contract:     explanation panels, decisions[].body, double_check[].body.   * Everything else is treated as plain text and HTML-escaped.   * Empty sections are omitted from both the body and the table of contents.++The rendering itself lives in the ``review_html`` package next to this file;+this script only owns the command line. """ from __future__ import annotations  import argparse-import hashlib-import html import json import sys-import textwrap-from datetime import datetime, timezone from pathlib import Path-from string import Template---# --- helpers -----------------------------------------------------------------def _escape(s: object) -> str:-    return html.escape("" if s is None else str(s))---def _file_anchor(path: str) -> str:-    return "file-" + hashlib.sha1(path.encode("utf-8")).hexdigest()[:10]---def _severity_pill(sev: str) -> str:-    klass = {-        "blocking": "error",-        "major": "error",-        "minor": "warning",-        "nit": "tertiary",-        "info": "tertiary",-    }.get(sev.lower(), "tertiary")-    return f'<span class="pill pill-{klass}">{_escape(sev)}</span>'---def _render_diff(diff: str) -> str:-    """Render a unified diff as one <span class="diff-line"> per line.--    Each line is classified by its leading marker so consecutive additions or-    deletions paint a continuous full-width background bar. Rendering this-    ourselves (instead of letting highlight.js do it) avoids hljs's display:block-    + trailing-newline double-spacing and the per-line "row pill" look.-    """-    if not diff:-        return ""-    lines = diff.split("\n")-    if lines and lines[-1] == "":-        lines.pop()-    spans = []-    for line in lines:-        if line.startswith(("+++", "---")):-            cls = "diff-file-header"-        elif line.startswith("@@"):-            cls = "diff-hunk"-        elif line.startswith("+"):-            cls = "diff-add"-        elif line.startswith("-"):-            cls = "diff-del"-        elif line.startswith("\\"):-            cls = "diff-meta"-        else:-            cls = "diff-context"-        spans.append(f'<span class="diff-line {cls}">{_escape(line)}</span>')-    return "".join(spans)---# --- section renderers -------------------------------------------------------def render_metrics(metrics: list[dict]) -> str:-    return "\n".join(-        f'<span class="chip">{_escape(m.get("label"))} '-        f'<strong>{_escape(m.get("value"))}</strong></span>'-        for m in metrics-    )---def render_at_a_glance(items: list[str]) -> str:-    if not items:-        return ""-    bullets = "\n".join(f"<li>{item}</li>" for item in items)-    return f"""<div class="card">-      <h3>At a glance</h3>-      <ul>{bullets}</ul>-    </div>"""---def render_important_links(changes: list[dict]) -> str:-    if not changes:-        return ""-    bullets = "".join(-        f'<li><span class="tag">key</span>'-        f'<a href="#change-{i}">{_escape(c.get("title"))}</a></li>'-        for i, c in enumerate(changes)-    )-    return f"""<div class="card">-      <h3>Important changes</h3>-      <ul>{bullets}</ul>-    </div>"""---def render_verdict_card(verdict: dict) -> str:-    if not verdict:-        return ""-    tone = verdict.get("tone", "success")-    if tone not in ("success", "warning", "error"):-        tone = "success"-    return f"""<div class="card">-      <h3>Verdict</h3>-      <p><span class="verdict-pill verdict-{tone}">{_escape(verdict.get("label"))}</span></p>-      <p class="muted">{verdict.get("detail", "")}</p>-    </div>"""---def render_findings_summary_card(findings: list[dict]) -> str:-    if not findings:-        return ""-    raised = len(findings)-    fixed = sum(1 for f in findings if f.get("status", "fixed") == "fixed")-    skipped = raised - fixed-    return f"""<div class="card">-      <h3>Review findings</h3>-      <p>{raised} raised · {fixed} fixed · {skipped} skipped</p>-      <p><a href="#findings">Jump to findings →</a></p>-    </div>"""---def render_pr_description(pr: dict) -> str:-    """Render the PR author's body verbatim.--    The body is HTML-escaped and dropped into a <pre> with pre-wrap so the-    author's original text and line breaks survive unchanged. Markdown stays-    visible as markdown — no parser is applied because the point is to show-    motivation as the author wrote it, not the reviewer's interpretation.-    """-    if not pr or not pr.get("body"):-        return ""-    meta_parts = []-    if pr.get("author"):-        if pr.get("url"):-            meta_parts.append(-                f'<a href="{_escape(pr["url"])}">{_escape(pr["author"])}</a>'-            )-        else:-            meta_parts.append(_escape(pr["author"]))-    if pr.get("created_at"):-        meta_parts.append(_escape(pr["created_at"]))-    meta_line = " · ".join(meta_parts)-    meta_html = (-        f'<div class="meta">{meta_line}</div>' if meta_line else ""-    )-    return f"""<section id="pr-description">-    <h2>Author's PR description</h2>-    <p class="muted">Shown verbatim — the markdown the author wrote, unmodified.</p>-    <div class="pr-description">-      {meta_html}-      <pre>{_escape(pr["body"])}</pre>-    </div>-    </section>"""---def render_commits(items: list[dict]) -> str:-    if not items:-        return ""-    rows = []-    for c in items:-        sha = _escape(c.get("sha"))-        subj = _escape(c.get("subject"))-        meta = c.get("meta")-        if meta is not None:-            meta_html = _escape(meta)-        else:-            meta_html = f'{_escape(c.get("author"))} · {_escape(c.get("date"))}'-        rows.append(-            f'<li><code class="commit-sha">{sha}</code> '-            f'<span class="commit-subj">{subj}</span> '-            f'<span class="commit-meta">— {meta_html}</span></li>'-        )-    return f"""<section id="commits">-    <h2>Commits</h2>-    <ul class="commit-list">{"".join(rows)}</ul>-    </section>"""---def render_explanation(panels: dict) -> str:-    if not panels:-        return ""-    order = [("beginner", "Beginner"),-             ("intermediate", "Intermediate"),-             ("expert", "Expert")]-    levels = [(key, label, panels[key]) for key, label in order if panels.get(key)]-    if not levels:-        return ""-    radios = "\n".join(-        f'<input type="radio" name="tabs" id="tab-{key}"'-        f'{" checked" if i == 0 else ""}>'-        for i, (key, _, _) in enumerate(levels)-    )-    labels = "\n".join(-        f'<label for="tab-{key}">{_escape(label)}</label>'-        for key, label, _ in levels-    )-    panels_html = "\n".join(-        f'<div id="panel-{key}" class="tab-panel">{content}</div>'-        for key, _, content in levels-    )-    return f"""<section id="explanation">-    <h2>Three-level explanation</h2>-    <div class="tabs">-      {radios}-      <div class="tab-labels">{labels}</div>-      <div class="tab-panels">{panels_html}</div>-    </div>-    </section>"""---def render_important_changes(changes: list[dict]) -> str:-    if not changes:-        return ""-    cards = []-    for i, c in enumerate(changes):-        file_path = c.get("file", "")-        file_anchor = _file_anchor(file_path) if file_path else ""-        what_text = _escape(c.get("what"))-        what_block = (-            f'<p><strong>What to look at.</strong> '-            f'<a href="#{file_anchor}">{what_text}</a></p>'-            if file_anchor and what_text-            else (f'<p><strong>What to look at.</strong> {what_text}</p>' if what_text else "")-        )-        takeaway = c.get("takeaway")-        takeaway_block = (-            f'<div class="callout callout-takeaway">'-            f'<strong>Takeaway.</strong> {_escape(takeaway)}</div>'-            if takeaway else ""-        )-        if c.get("rationale_unknown"):-            rationale_block = (-                '<div class="callout callout-warning">'-                '<strong>Open question.</strong> Rationale not stated by the author '-                'and not inferable from the diff.</div>'-            )-        elif c.get("rationale"):-            rationale_html = _escape(c["rationale"])-            if c.get("rationale_inferred"):-                rationale_html += (-                    ' <span class="muted">(inferred — not stated by the author)</span>'-                )-            rationale_block = (-                '<div class="callout callout-rationale">'-                f'<strong>Rationale.</strong> {rationale_html}</div>'-            )-        else:-            rationale_block = ""-        cards.append(textwrap.dedent(f"""\-            <div class="change-card" id="change-{i}">-              <h3>{_escape(c.get("title"))}</h3>-              <p class="muted">{_escape(file_path)}</p>-              <p><strong>Why it matters.</strong> {_escape(c.get("why"))}</p>-              {what_block}-              {takeaway_block}-              {rationale_block}-            </div>"""))-    return f"""<section id="important-changes">-    <h2>Important changes — detailed</h2>-    {"".join(cards)}-    </section>"""---def render_decisions(items: list[dict]) -> str:-    if not items:-        return ""-    callouts = []-    for d in items:-        body = d.get("body", "")-        if d.get("inferred"):-            body = body + ' <span class="muted">(inferred — not stated by the author.)</span>'-        callouts.append(-            '<div class="callout callout-rationale">'-            f'<strong>{_escape(d.get("title"))}</strong> {body}</div>'-        )-    return f"""<section id="decisions">-    <h2>Key decisions</h2>-    {"".join(callouts)}-    </section>"""---def render_findings_table(findings: list[dict]) -> str:-    if not findings:-        return ""-    rows = []-    for f in findings:-        rows.append(-            "<tr>"-            f'<td>{_severity_pill(f.get("severity", "nit"))}</td>'-            f'<td>{_escape(f.get("area"))}</td>'-            f'<td>{_escape(f.get("finding"))}</td>'-            f'<td>{_escape(f.get("resolution"))}</td>'-            "</tr>"-        )-    return f"""<section id="findings">-    <h2>Review findings</h2>-    <table class="findings">-      <thead><tr><th>Severity</th><th>Area</th><th>Finding</th><th>Resolution</th></tr></thead>-      <tbody>{"".join(rows)}</tbody>-    </table>-    </section>"""---def render_unresolved_comments(items: list[dict]) -> str:-    if not items:-        return ""--    type_labels = {"code": "code", "review": "review", "discussion": "discussion"}--    cards = []-    for c in items:-        ctype = (c.get("type") or "discussion").lower()-        label = type_labels.get(ctype, ctype)-        author = c.get("author") or "(unknown)"-        url = c.get("url")-        created = c.get("created_at")-        path = c.get("path")-        line = c.get("line")--        location_bits = []-        if path:-            loc = _escape(path)-            if line:-                loc += f":{_escape(line)}"-            location_bits.append(f'<code>{loc}</code>')-        if created:-            location_bits.append(f'<span class="muted">{_escape(created)}</span>')-        if url:-            location_bits.append(-                f'<a href="{_escape(url)}" target="_blank" rel="noopener">view on GitHub</a>'-            )-        location_line = " · ".join(location_bits)--        body = _escape(c.get("body") or "").replace("\n", "<br>")--        replies_html = ""-        replies = c.get("replies") or []-        if replies:-            reply_blocks = []-            for r in replies:-                r_author = _escape(r.get("author") or "(unknown)")-                r_created = r.get("created_at")-                header_bits = [f'<strong>{r_author}</strong>']-                if r_created:-                    header_bits.append(f'<span class="muted">{_escape(r_created)}</span>')-                r_body = _escape(r.get("body") or "").replace("\n", "<br>")-                reply_blocks.append(-                    '<div class="reply">'-                    f'<div class="reply-header">{" · ".join(header_bits)}</div>'-                    f'<div class="reply-body">{r_body}</div>'-                    '</div>'-                )-            replies_html = (-                '<details class="replies">'-                f'<summary>{len(replies)} earlier repl'-                f'{"y" if len(replies) == 1 else "ies"}</summary>'-                f'{"".join(reply_blocks)}'-                '</details>'-            )--        cards.append(-            '<div class="unresolved-comment">'-            '<div class="unresolved-header">'-            f'<span class="pill pill-warning">{_escape(label)}</span> '-            f'<strong>{_escape(author)}</strong>'-            f'{" · " + location_line if location_line else ""}'-            '</div>'-            f'<div class="unresolved-body">{body}</div>'-            f'{replies_html}'-            '</div>'-        )--    return f"""<section id="unresolved-comments">-    <h2>Unresolved comments</h2>-    <p class="muted">Open review threads and PR-level comments still awaiting a response.</p>-    {"".join(cards)}-    </section>"""---def render_double_check(items: list[dict]) -> str:-    if not items:-        return ""-    callouts = "".join(-        '<div class="callout callout-warning">'-        f'<strong>{_escape(d.get("title"))}</strong> {d.get("body", "")}</div>'-        for d in items-    )-    return f"""<section id="double-check">-    <h2>Things to double-check</h2>-    {callouts}-    </section>"""---def render_files(files: list[dict], diff_dir: Path | None) -> str:-    if not files:-        return ""-    blocks = []-    for f in files:-        path = f.get("path", "")-        badge = f.get("badge", "Modified")-        stat = f.get("stat", "")-        diff = f.get("diff")-        if diff is None and f.get("diff_file") and diff_dir is not None:-            fragment = diff_dir / f["diff_file"]-            try:-                diff = fragment.read_text(encoding="utf-8")-            except FileNotFoundError:-                diff = f"(diff fragment {f['diff_file']!r} missing)"-        if diff is None:-            diff = "(no diff provided)"-        anchor = _file_anchor(path)-        badge_class = "badge-" + "".join(ch for ch in badge.lower() if ch.isalnum())-        blocks.append(textwrap.dedent(f"""\-            <details id="{anchor}" class="file-diff">-              <summary><span class="file-path">{_escape(path)}</span> <span class="badge {badge_class}">{_escape(badge)}</span> <span class="line-stat">{_escape(stat)}</span></summary>-              <pre><code class="diff-block">{_render_diff(diff)}</code></pre>-            </details>"""))-    return f"""<section id="diffs">-    <h2>Per-file diffs</h2>-    <p class="muted">Click to expand.</p>-    {"".join(blocks)}-    </section>"""---def render_publish_metadata(meta: dict) -> str:-    """Emit a <script id="review-meta"> block consumable by `pulsar publish`.--    See pulsar's docs/agent-contract.md. Fields are passed through verbatim,-    minus a `</` escape inside the JSON to prevent premature </script> closure.-    """-    if not meta:-        return ""-    payload = json.dumps(meta, indent=2, ensure_ascii=False).replace("</", "<\\/")-    return (-        f'<script type="application/json" id="review-meta">\n{payload}\n</script>'-    )---def build_toc(entries: list[tuple[str, str]]) -> str:-    if not entries:-        return ""-    items = "\n".join(-        f'<li><a href="#{sid}">{_escape(label)}</a></li>'-        for sid, label in entries-    )-    return f'<nav class="toc"><ul>{items}</ul></nav>'---# --- CSS (Prism Dark palette) -----------------------------------------------CSS = """-:root {-  --bg: #0B1020;-  --bg-deep: #050C1B;-  --surface-1: #101A33;-  --surface-2: #142042;-  --border: #26324F;-  --border-subtle: #1F2A45;-  --text-primary: #EAF1FF;-  --text-secondary: #B7C3E3;-  --text-tertiary: #7F8BB0;-  --accent: #44C4DC;-  --accent-2: #E474E4;-  --accent-3: #4C6CBC;-  --code-bg: #0A1226;-  --code-border: #1F2A45;-  --success: #22C55E;-  --warning: #FBBF24;-  --error: #EF476F;-  --diff-add-bg: rgba(34, 197, 94, 0.12);-  --diff-add-fg: #86EFAC;-  --diff-del-bg: rgba(239, 71, 111, 0.12);-  --diff-del-fg: #FCA5A5;-}--* { box-sizing: border-box; }-html { background: var(--bg); }-body {-  background: var(--bg);-  color: var(--text-primary);-  font-family: -apple-system, "SF Pro Text", system-ui, sans-serif;-  line-height: 1.6;-  margin: 0;-  padding: 0;-}--.page { max-width: 1100px; margin: 0 auto; padding: 32px; }--header.top-bar {-  position: sticky; top: 0; z-index: 10;-  background: var(--bg-deep);-  border-bottom: 1px solid var(--border-subtle);-}-.top-stripe { height: 4px; background: linear-gradient(135deg, var(--accent-3), var(--accent-2)); }-.top-content {-  display: flex; gap: 16px; flex-wrap: wrap; align-items: center;-  padding: 14px 32px; max-width: 1100px; margin: 0 auto;-}-.top-content .repo-title { font-weight: 600; font-size: 15px; color: var(--text-primary); }--.chip {-  display: inline-flex; align-items: center; gap: 6px;-  background: var(--surface-1); border: 1px solid var(--border-subtle);-  border-radius: 999px; padding: 4px 12px; font-size: 12px; color: var(--text-secondary);-}-.chip strong { color: var(--text-primary); }--h1, h2, h3 { color: var(--text-primary); line-height: 1.3; }-h1 { font-size: 30px; margin: 8px 0 4px; }-h2 { font-size: 22px; margin: 32px 0 12px; padding-top: 12px; border-top: 1px solid var(--border-subtle); }-h3 { font-size: 17px; margin: 16px 0 8px; }--p { color: var(--text-secondary); }-strong { color: var(--text-primary); }-a { color: var(--accent); text-decoration: none; }-a:hover { text-decoration: underline; }-.muted { color: var(--text-tertiary); }-code { font-family: ui-monospace, "SF Mono", Menlo, monospace; }--.card-grid {-  display: grid; grid-template-columns: repeat(2, 1fr); gap: 16px;-  margin: 24px 0 32px;-}--.card {-  background: var(--surface-1); border: 1px solid var(--border);-  border-radius: 16px; padding: 20px;-  transition: background-color 120ms ease;-}-.card:hover { background: var(--surface-2); }-.card h3 {-  margin-top: 0; font-size: 14px;-  text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-tertiary);-}-.card ul { margin: 8px 0 0; padding-left: 20px; }-.card li { margin: 4px 0; color: var(--text-secondary); }--.tag {-  display: inline-block;-  background: rgba(228, 116, 228, 0.15);-  color: var(--accent-2);-  border-radius: 4px;-  padding: 0 6px;-  font-size: 11px;-  font-weight: 600;-  text-transform: uppercase;-  margin-right: 6px;-}--.verdict-pill {-  display: inline-flex; align-items: center; gap: 8px;-  padding: 10px 18px; border-radius: 999px;-  font-weight: 600; font-size: 14px;-  text-transform: uppercase; letter-spacing: 0.05em;-}-.verdict-success { background: rgba(34, 197, 94, 0.18); color: var(--success); border: 1px solid rgba(34,197,94,0.35); }-.verdict-warning { background: rgba(251, 191, 36, 0.15); color: var(--warning); border: 1px solid rgba(251,191,36,0.35); }-.verdict-error   { background: rgba(239, 71, 111, 0.15); color: var(--error);   border: 1px solid rgba(239,71,111,0.35); }--.toc {-  background: var(--surface-1); border: 1px solid var(--border);-  border-radius: 16px; padding: 16px 20px; margin: 0 0 24px;-}-.toc ul { list-style: none; padding-left: 0; margin: 0; column-count: 2; column-gap: 24px; }-.toc li { margin: 4px 0; }-.toc a { color: var(--text-secondary); }-.toc a:hover { color: var(--accent); }--.tabs {-  margin: 16px 0; border: 1px solid var(--border);-  border-radius: 16px; background: var(--surface-1);-}-.tabs input[type="radio"] { display: none; }-.tab-labels { display: flex; border-bottom: 1px solid var(--border-subtle); }-.tab-labels label {-  padding: 12px 20px; cursor: pointer; color: var(--text-tertiary);-  font-weight: 600; font-size: 13px;-  text-transform: uppercase; letter-spacing: 0.06em;-  border-bottom: 2px solid transparent; margin-bottom: -1px;-}-.tab-labels label:hover { color: var(--text-secondary); }--#tab-beginner:checked ~ .tab-labels label[for="tab-beginner"],-#tab-intermediate:checked ~ .tab-labels label[for="tab-intermediate"],-#tab-expert:checked ~ .tab-labels label[for="tab-expert"] {-  color: var(--accent);-  border-bottom-color: var(--accent);-}--.tab-panels { padding: 20px; }-.tab-panel { display: none; }-#tab-beginner:checked ~ .tab-panels #panel-beginner,-#tab-intermediate:checked ~ .tab-panels #panel-intermediate,-#tab-expert:checked ~ .tab-panels #panel-expert {-  display: block;-}--.change-card {-  background: var(--surface-1); border: 1px solid var(--border);-  border-radius: 16px; padding: 20px; margin: 16px 0;-  transition: background-color 120ms ease;-}-.change-card:hover { background: var(--surface-2); }--.callout {-  margin: 12px 0; padding: 10px 14px;-  background: var(--bg-deep);-  border-radius: 6px; font-size: 14px; color: var(--text-secondary);-}-.callout-takeaway  { border-left: 3px solid var(--accent-2); }-.callout-rationale { border-left: 3px solid var(--accent); }-.callout-warning   { border-left: 3px solid var(--warning); }--table.findings {-  width: 100%; border-collapse: collapse;-  margin: 16px 0; background: var(--surface-1);-  border: 1px solid var(--border); border-radius: 12px; overflow: hidden;-}-table.findings th, table.findings td {-  padding: 10px 14px; text-align: left;-  border-bottom: 1px solid var(--border-subtle);-  font-size: 14px; vertical-align: top;-}-table.findings th {-  background: var(--surface-2); color: var(--text-secondary);-  text-transform: uppercase; font-size: 11px; letter-spacing: 0.08em;-}-table.findings tr:last-child td { border-bottom: none; }--.pill {-  display: inline-block; padding: 2px 10px; border-radius: 999px;-  font-size: 11px; font-weight: 600;-  text-transform: uppercase; letter-spacing: 0.06em;-}-.pill-error    { background: rgba(239,71,111,0.18); color: var(--error); }-.pill-warning  { background: rgba(251,191,36,0.18); color: var(--warning); }-.pill-success  { background: rgba(34,197,94,0.18); color: var(--success); }-.pill-tertiary { background: rgba(127,139,176,0.18); color: var(--text-tertiary); }--.unresolved-comment {-  background: var(--surface-1); border: 1px solid var(--border);-  border-left: 3px solid var(--warning);-  border-radius: 10px; padding: 14px 16px; margin: 12px 0;-}-.unresolved-header {-  display: flex; flex-wrap: wrap; gap: 8px; align-items: center;-  font-size: 13px; color: var(--text-secondary); margin-bottom: 8px;-}-.unresolved-header code {-  background: var(--code-bg); color: var(--accent);-  padding: 1px 6px; border-radius: 4px; font-size: 12px;-}-.unresolved-body {-  color: var(--text-primary); font-size: 14px; line-height: 1.55;-  white-space: pre-wrap; word-break: break-word;-  font-family: ui-monospace, "SF Mono", Menlo, monospace;-}-.replies {-  margin-top: 10px; padding-top: 8px; border-top: 1px solid var(--border-subtle);-}-.replies > summary {-  cursor: pointer; color: var(--text-tertiary); font-size: 12px;-}-.reply { margin: 8px 0 0 12px; padding-left: 10px; border-left: 2px solid var(--border-subtle); }-.reply-header { font-size: 12px; color: var(--text-secondary); margin-bottom: 4px; }-.reply-body {-  color: var(--text-primary); font-size: 13px;-  white-space: pre-wrap; word-break: break-word;-  font-family: ui-monospace, "SF Mono", Menlo, monospace;-}--.commit-list { list-style: none; padding-left: 0; }-.commit-list li { padding: 6px 0; border-bottom: 1px solid var(--border-subtle); }-.commit-list li:last-child { border-bottom: none; }-.commit-sha {-  color: var(--accent); background: var(--code-bg);-  padding: 2px 6px; border-radius: 4px;-  font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 12px;-}-.commit-subj { color: var(--text-primary); }-.commit-meta { color: var(--text-tertiary); font-size: 13px; }--.file-diff {-  background: var(--surface-1); border: 1px solid var(--border);-  border-radius: 12px; margin: 8px 0; overflow: hidden;-}-.file-diff > summary {-  cursor: pointer; padding: 12px 16px; font-weight: 500;-  list-style: none; display: flex; gap: 12px; align-items: center;-}-.file-diff > summary::-webkit-details-marker { display: none; }-.file-diff > summary::before {-  content: "▸"; color: var(--text-tertiary); font-size: 12px; margin-right: 4px;-}-.file-diff[open] > summary::before { content: "▾"; }-.file-path { font-family: ui-monospace, "SF Mono", Menlo, monospace; color: var(--text-primary); }-.line-stat {-  color: var(--text-tertiary);-  font-family: ui-monospace, "SF Mono", Menlo, monospace;-  font-size: 12px; margin-left: auto;-}--.badge {-  display: inline-block; font-size: 10px;-  text-transform: uppercase; letter-spacing: 0.06em; font-weight: 700;-  padding: 2px 8px; border-radius: 4px;-}-.badge-added    { background: rgba(34,197,94,0.18);  color: var(--success); }-.badge-modified { background: rgba(68,196,220,0.18); color: var(--accent); }-.badge-deleted  { background: rgba(239,71,111,0.18); color: var(--error); }-.badge-renamed  { background: rgba(76,108,188,0.18); color: var(--accent-3); }--.file-diff pre {-  margin: 0; background: var(--code-bg);-  border-top: 1px solid var(--code-border);-  padding: 12px 0; overflow-x: auto; line-height: 1.45;-}-.file-diff code {-  font-family: ui-monospace, "SF Mono", Menlo, monospace;-  font-size: 13px; color: var(--text-secondary);-  display: inline-block; min-width: 100%;-}-.diff-line {-  display: block;-  padding: 0 16px;-  min-height: 1.45em;-}-.diff-add         { background: var(--diff-add-bg); color: var(--diff-add-fg); }-.diff-del         { background: var(--diff-del-bg); color: var(--diff-del-fg); }-.diff-hunk        { color: var(--accent); }-.diff-file-header { color: var(--text-tertiary); }-.diff-meta        { color: var(--text-tertiary); }-.diff-context     { color: var(--text-secondary); }--.pr-description {-  background: var(--surface-1);-  border: 1px solid var(--border);-  border-left: 3px solid var(--accent-2);-  border-radius: 12px;-  padding: 16px 20px;-  margin: 8px 0 16px;-}-.pr-description .meta {-  color: var(--text-tertiary);-  font-size: 12px;-  margin-bottom: 12px;-}-.pr-description pre {-  margin: 0;-  background: transparent;-  font-family: ui-monospace, "SF Mono", Menlo, monospace;-  font-size: 13px;-  line-height: 1.55;-  color: var(--text-secondary);-  white-space: pre-wrap;-  word-wrap: break-word;-}-.pr-description pre code,-.pr-description pre a { color: var(--text-primary); }--footer {-  margin-top: 64px; padding-top: 24px;-  border-top: 1px solid var(--border-subtle);-  color: var(--text-tertiary); font-size: 13px;-}--@media (max-width: 720px) {-  .card-grid { grid-template-columns: 1fr; }-  .toc ul { column-count: 1; }-  .page { padding: 16px; }-}-@media (prefers-reduced-motion: reduce) {-  * { transition: none !important; }-}-"""---# --- top-level template ------------------------------------------------------PAGE_TEMPLATE = Template("""<!doctype html>-<html lang="en">-<head>-<meta charset="utf-8">-<title>$title_plain</title>-<meta name="viewport" content="width=device-width, initial-scale=1">-$publish_metadata-<style>$css</style>-</head>-<body>-<header class="top-bar">-  <div class="top-stripe"></div>-  <div class="top-content">-    <span class="repo-title">$repo_name</span>-    $metrics_chips-  </div>-</header>--<div class="page">-  <h1>$title_html</h1>-  <p class="muted">$subtitle</p>--  <section class="card-grid">-    $at_a_glance-    $important_links-    $verdict_card-    $findings_summary-  </section>--  $toc--  $pr_description_section-  $commits_section-  $explanation_section-  $important_changes_section-  $decisions_section-  $findings_section-  $unresolved_comments_section-  $files_section-  $double_check_section--  <footer>-    Generated $timestamp · repo <code>$repo_path</code> · regenerate with <code>/pre-push-review</code>.-  </footer>-</div>-</body>-</html>-""")---def render(data: dict, diff_dir: Path | None) -> str:-    repo = data.get("repo", {})-    repo_name = _escape(repo.get("name", "(repo)"))-    repo_path = _escape(repo.get("path", ""))--    title = data.get("title") or f"Pre-push review: {repo.get('name', '')}"--    important_changes = data.get("important_changes", [])-    findings = data.get("findings", [])--    sections = {-        "pr-description": render_pr_description(data.get("pr_description", {})),-        "commits": render_commits(data.get("commits", [])),-        "explanation": render_explanation(data.get("explanation", {})),-        "important-changes": render_important_changes(important_changes),-        "decisions": render_decisions(data.get("decisions", [])),-        "findings": render_findings_table(findings),-        "unresolved-comments": render_unresolved_comments(data.get("unresolved_comments", [])),-        "diffs": render_files(data.get("files", []), diff_dir),-        "double-check": render_double_check(data.get("double_check", [])),-    }--    toc_labels = {-        "pr-description": "Author's description",-        "commits": "Commits",-        "explanation": "Three-level explanation",-        "important-changes": "Important changes (detailed)",-        "decisions": "Key decisions",-        "findings": "Review findings",-        "unresolved-comments": "Unresolved comments",-        "diffs": "Per-file diffs",-        "double-check": "Things to double-check",-    }-    toc_entries = [(sid, toc_labels[sid]) for sid in sections if sections[sid]] -    timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")+# ~/.claude/scripts is a symlink into the repository; resolve the real+# location so the package is found under -P or when invoked via the link.+sys.path.insert(0, str(Path(__file__).resolve().parent)) -    return PAGE_TEMPLATE.substitute(-        title_plain=_escape(title),-        title_html=_escape(title),-        css=CSS,-        publish_metadata=render_publish_metadata(data.get("publish_metadata", {})),-        repo_name=repo_name,-        repo_path=repo_path,-        subtitle=data.get("subtitle", ""),-        metrics_chips=render_metrics(data.get("metrics", [])),-        at_a_glance=render_at_a_glance(data.get("at_a_glance", [])),-        important_links=render_important_links(important_changes),-        verdict_card=render_verdict_card(data.get("verdict", {})),-        findings_summary=render_findings_summary_card(findings),-        toc=build_toc(toc_entries),-        pr_description_section=sections["pr-description"],-        commits_section=sections["commits"],-        explanation_section=sections["explanation"],-        important_changes_section=sections["important-changes"],-        decisions_section=sections["decisions"],-        findings_section=sections["findings"],-        unresolved_comments_section=sections["unresolved-comments"],-        files_section=sections["diffs"],-        double_check_section=sections["double-check"],-        timestamp=timestamp,-    )+import review_html  # noqa: E402   def main() -> int:@@ -969,10 +94,14 @@ def main() -> int:         return 1      diff_dir = args.diff_dir if args.diff_dir is not None else args.data.parent-    data = json.loads(args.data.read_text(encoding="utf-8"))+    try:+        data = json.loads(args.data.read_text(encoding="utf-8"))+    except (ValueError, OSError) as exc:+        print(f"error: {args.data}: {exc}", file=sys.stderr)+        return 2      args.output.parent.mkdir(parents=True, exist_ok=True)-    args.output.write_text(render(data, diff_dir), encoding="utf-8")+    args.output.write_text(review_html.render(data, diff_dir), encoding="utf-8")     print(str(args.output))     return 0 

diff --git a/scripts/ecosystems.json b/scripts/ecosystems.jsonnew file mode 100644index 0000000..ee3fa78--- /dev/null+++ b/scripts/ecosystems.json@@ -0,0 +1,150 @@+{+  "go": {+    "extensions": [".go"],+    "test_files": ["_test\\.go$"],+    "test_decl": "^func ((?:Test|Fuzz|Benchmark)\\w+)\\s*\\(",+    "unit": {"kind": "module_file", "module_file": "go.mod", "module_regex": "^module\\s+(\\S+)"},+    "imports": [+      {"regex": "^\\s*(?:import\\s+)?(?:[\\w.]+\\s+)?\"([^\"]+)\"", "resolve": "unit"}+    ],+    "tool": {"name": "go list", "deps": "go list -json ./...", "format": "go-list-json", "granularity": "package"},+    "runners": [+      {+        "name": "gotestsum",+        "detect": {"files": ["go.mod"]},+        "recipe": "gotestsum --junitfile {junit} -- -coverprofile={coverage} -coverpkg=./... ./...",+        "requires": ["go", "gotestsum"],+        "coverage_format": "coverprofile",+        "install": "go mod download",+        "junit_flags": ["--junitfile"]+      }+    ],+    "notes": [+      "Imports name packages, so scanned edges expand to every file in the package.",+      "go list needs a resolvable module graph; when it fails the scanned edges stay in place with a warning.",+      "gotestsum writes the JUnit file and go test writes the coverprofile even when tests fail."+    ]+  },+  "python": {+    "extensions": [".py"],+    "test_files": ["(^|/)test_[^/]*\\.py$", "_test\\.py$", "(^|/)tests?/", "(^|/)conftest\\.py$"],+    "test_decl": "^\\s*(?:async\\s+)?def (test\\w*)\\s*\\(",+    "unit": {"kind": "directory"},+    "imports": [+      {"regex": "^\\s*from\\s+([\\w.]+)\\s+import\\s+\\(?\\s*(\\w+)", "resolve": "roots", "separator": "."},+      {"regex": "^\\s*import\\s+([\\w.]+)", "resolve": "roots", "separator": "."}+    ],+    "source_roots": [".", "src"],+    "index_files": ["__init__.py"],+    "runners": [+      {+        "name": "pytest",+        "detect": {"files": ["pytest.ini", "conftest.py", "pyproject.toml", "setup.cfg", "tox.ini"]},+        "recipe": "python3 -m pytest --junitxml={junit} --cov --cov-report=xml:{coverage}",+        "requires": ["python3", "pytest"],+        "coverage_format": "cobertura",+        "install": "python3 -m pip install -e . pytest pytest-cov",+        "junit_flags": ["--junitxml", "--junit-xml"]+      }+    ],+    "notes": [+      "Absolute imports resolve under the repository root and src/; namespace packages elsewhere yield no edge.",+      "The recipe needs pytest-cov; when it is not installed drop the two --cov flags, run without coverage, and leave the coverage list empty.",+      "The install line assumes a pyproject.toml or setup.py; a project that installs from requirements files needs its own install command."+    ]+  },+  "typescript": {+    "extensions": [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],+    "test_files": ["\\.(test|spec)\\.[tj]sx?$", "(^|/)__tests__/"],+    "test_decl": "^\\s*(?:it|test)\\(\\s*['\"`]([^'\"`]+)",+    "unit": {"kind": "directory"},+    "imports": [+      {"regex": "(?:from|import|require\\()\\s*['\"]([^'\"]+)['\"]", "resolve": "relative"}+    ],+    "index_files": ["index.ts", "index.tsx", "index.js"],+    "extension_map": {".js": [".ts", ".tsx", ".js"], ".jsx": [".tsx", ".jsx"]},+    "runners": [+      {+        "name": "vitest",+        "detect": {"files": ["vitest.config.*", "vitest.workspace.*"]},+        "recipe": "npx --no-install vitest run --reporter=junit --outputFile={junit} --coverage --coverage.reporter=lcov --coverage.reportsDirectory={inputs}/cov",+        "requires": ["npx"],+        "coverage_format": "lcov",+        "install": "npm ci",+        "junit_flags": ["--reporter=junit", "--reporter junit"]+      },+      {+        "name": "jest",+        "detect": {"files": ["jest.config.*"], "package_json_keys": ["jest"]},+        "recipe": "npx --no-install jest --ci --reporters=default --reporters=jest-junit --coverage --coverageReporters=lcov --coverageDirectory={inputs}/cov",+        "requires": ["npx"],+        "coverage_format": "lcov",+        "install": "npm ci",+        "junit_flags": ["--reporters=jest-junit", "--reporters jest-junit"],+        "env": {"JEST_JUNIT_OUTPUT_FILE": "{junit}"}+      }+    ],+    "notes": [+      "Only relative imports resolve; path aliases from tsconfig paths yield no edge.",+      "Both runners write lcov to {inputs}/cov/lcov.info; reference that file as the coverage input.",+      "npx --no-install fails rather than downloading a runner the project does not declare; vitest coverage needs @vitest/coverage-v8 or @vitest/coverage-istanbul, and jest needs jest-junit, both as project dependencies.",+      "A repository using pnpm or yarn needs the matching install command in place of npm ci."+    ]+  },+  "swift": {+    "extensions": [".swift"],+    "test_files": ["(^|/)Tests/", "Tests\\.swift$"],+    "test_decl": "(?:@Test\\b[^{]*?func\\s+|^\\s*func\\s+(?=test))(\\w+)",+    "unit": {"kind": "target_root", "target_root": "Sources"},+    "imports": [+      {"regex": "^\\s*(?:@testable\\s+)?import\\s+(\\w+)", "resolve": "unit"}+    ],+    "runners": [+      {+        "name": "swift test",+        "detect": {"files": ["Package.swift"]},+        "recipe": "swift test --enable-code-coverage --xunit-output {junit} && xcrun llvm-cov export -format=lcov -instr-profile .build/debug/codecov/default.profdata .build/debug/*.xctest/Contents/MacOS/*PackageTests > {coverage}",+        "requires": ["swift", "xcrun"],+        "coverage_format": "lcov",+        "install": "swift package resolve",+        "junit_flags": ["--xunit-output"]+      }+    ],+    "notes": [+      "Swift files inside one target never import each other, so only cross-target edges appear.",+      "Xcode projects without Sources/<Target> yield no unit and fall to directory grouping.",+      "The xctest bundle path in the recipe is the macOS layout; on Linux the test binary is .build/debug/*PackageTests.xctest itself. Coverage is exported only when the tests pass, the JUnit file is written either way.",+      "Swift 6 writes Swift Testing (@Test) results to a second file beside {junit} with a -swift-testing suffix; reference both files as JUnit inputs."+    ]+  },+  "rust": {+    "extensions": [".rs"],+    "test_files": ["(^|/)tests/", "_test\\.rs$"],+    "test_decl": "#\\[(?:\\w+::)?test\\]\\s*\\n\\s*(?:pub\\s+)?(?:async\\s+)?fn\\s+(\\w+)",+    "unit": {"kind": "directory"},+    "imports": [+      {"regex": "^\\s*(?:pub(?:\\([^)]*\\))?\\s+)?mod\\s+(\\w+)\\s*;", "resolve": "relative"},+      {"regex": "^\\s*(?:pub(?:\\([^)]*\\))?\\s+)?use\\s+crate::([\\w:]+)", "resolve": "roots", "separator": "::"}+    ],+    "source_roots": ["src"],+    "index_files": ["mod.rs"],+    "runners": [+      {+        "name": "cargo nextest",+        "detect": {"files": ["Cargo.toml"]},+        "recipe": "cargo llvm-cov nextest --workspace --lcov --output-path {coverage} --config-file {inputs}/nextest.toml",+        "requires": ["cargo", "cargo-nextest", "cargo-llvm-cov"],+        "coverage_format": "lcov",+        "install": "cargo fetch",+        "junit_flags": ["--config-file"],+        "config_files": {"nextest.toml": "[profile.default.junit]\npath = \"{junit}\"\n"}+      }+    ],+    "notes": [+      "use crate:: resolves under src/ at the repository root; workspace crates elsewhere yield no edge.",+      "#[cfg(test)] modules inside a source file are not flagged as test files.",+      "nextest emits JUnit only through its config file, so a Makefile target passing --config-file counts as a JUnit recipe only when the named file sets profile.<name>.junit.path.",+      "cargo llvm-cov needs the llvm-tools-preview rustup component; cargo-nextest and cargo-llvm-cov are separate installs."+    ]+  }+}

diff --git a/scripts/review_html/__init__.py b/scripts/review_html/__init__.pynew file mode 100644index 0000000..5814b33--- /dev/null+++ b/scripts/review_html/__init__.py@@ -0,0 +1,10 @@+"""Renderer for the review HTML page used by the review skills.++The package is imported by ``scripts/build_review_html.py``, which owns the+command line; ``render`` is the only public entry point.+"""+from __future__ import annotations++from .render import render++__all__ = ["render"]

diff --git a/scripts/review_html/common.py b/scripts/review_html/common.pynew file mode 100644index 0000000..38a902e--- /dev/null+++ b/scripts/review_html/common.py@@ -0,0 +1,34 @@+"""Helpers shared by every renderer module.++``sections.py`` and ``diagram.py`` both import from here; nothing here imports+from them.+"""+from __future__ import annotations++import hashlib+import html+++def escape(s: object) -> str:+    """HTML-escape a value for text or attribute context; ``None`` becomes ``""``."""+    return html.escape("" if s is None else str(s), quote=True)+++def digest(s: str) -> str:+    """First 10 hex characters of the SHA-1 of ``s``; shared by anchors and node ids."""+    return hashlib.sha1(s.encode("utf-8")).hexdigest()[:10]+++def file_anchor(path: str) -> str:+    return "file-" + digest(path)+++def severity_pill(sev: str) -> str:+    klass = {+        "blocking": "error",+        "major": "error",+        "minor": "warning",+        "nit": "tertiary",+        "info": "tertiary",+    }.get(sev.lower(), "tertiary")+    return f'<span class="pill pill-{klass}">{escape(sev)}</span>'

diff --git a/scripts/review_html/coverage.py b/scripts/review_html/coverage.pynew file mode 100644index 0000000..2537c8c--- /dev/null+++ b/scripts/review_html/coverage.py@@ -0,0 +1,291 @@+"""Coverage parsing, path mapping, matching against changed files, arithmetic.++The order is mapping → matching → merging: ``apply_path_map`` rewrites+paths, ``match`` decides which entries belong to which changed file in five+global passes, and only its last pass (and ``overall``) sums hits.+"""+from __future__ import annotations++import posixpath+from dataclasses import dataclass+from pathlib import Path++from .inputs import read_guarded, xml_root+from .warnings import Warnings+++@dataclass+class Entry:+    paths: list[str]         # primary path first, then aliases+    hits: dict[int, int]+++Coverage = list[Entry]++NO_CANDIDATE = "no candidate"+AMBIGUOUS = "ambiguous"+++# --- parsing ---------------------------------------------------------------++def _sniff(path: Path) -> str | None:+    """``"xml"``, ``"lcov"``, ``"coverprofile"``, or ``None`` from the file head."""+    try:+        with path.open("rb") as fh:+            head = fh.read(4096)+    except OSError:+        return None+    text = head.decode("utf-8", errors="replace").lstrip("\N{ZERO WIDTH NO-BREAK SPACE} \t\r\n")+    if text.startswith("<"):+        return "xml"+    if text.startswith(("TN:", "SF:")):+        return "lcov"+    if text.startswith("mode: "):+        return "coverprofile"+    return None+++def parse_coverage(path: Path, warnings: Warnings) -> Coverage:+    kind = _sniff(path)+    text = read_guarded(path, warnings, xml=(kind == "xml"))+    if text is None:+        return []+    if kind == "lcov":+        return _parse_lcov(text)+    if kind == "coverprofile":+        return _parse_coverprofile(text, path.name, warnings)+    if kind == "xml":+        return _parse_cobertura(text, path.name, warnings)+    warnings.add(f"{path.name}: skipped, not lcov, Cobertura XML, or Go coverprofile")+    return []+++def _parse_lcov(text: str) -> Coverage:+    cov: Coverage = []+    current: Entry | None = None+    for line in text.splitlines():+        if line.startswith("SF:"):+            current = Entry([line[3:].strip()], {})+            cov.append(current)+        elif line.startswith("DA:") and current is not None:+            number, _, rest = line[3:].partition(",")+            count = rest.partition(",")[0]+            try:+                n = int(number)+                h = int(count)+            except ValueError:+                continue+            current.hits[n] = current.hits.get(n, 0) + h+        elif line.startswith("end_of_record"):+            current = None+    return [e for e in cov if e.paths[0]]+++def _parse_coverprofile(text: str, name: str, warnings: Warnings) -> Coverage:+    lines = text.splitlines()+    if not lines or not lines[0].startswith("mode: "):+        warnings.add(f"{name}: skipped, coverprofile has no mode line")+        return []+    entries: dict[str, Entry] = {}+    for line in lines[1:]:+        line = line.strip()+        if not line:+            continue+        file, sep, rest = line.rpartition(":")+        if not sep:+            continue+        parts = rest.split()+        if len(parts) != 3:+            continue+        try:+            start, end = parts[0].split(",")+            sl = int(start.split(".")[0])+            el = int(end.split(".")[0])+            count = int(parts[2])+        except ValueError:+            continue+        entry = entries.get(file)+        if entry is None:+            entry = entries[file] = Entry([file], {})+        for n in range(sl, el + 1):+            if count > entry.hits.get(n, -1):+                entry.hits[n] = count+    return list(entries.values())+++def _parse_cobertura(text: str, name: str, warnings: Warnings) -> Coverage:+    root = xml_root(text, name, warnings, ("coverage",), "coverage XML", "Cobertura <coverage>")+    if root is None:+        return []+    sources = [s.text.strip() for s in root.iter("source") if s.text and s.text.strip()]+    cov: Coverage = []+    for cls in root.iter("class"):+        filename = cls.get("filename")+        if not filename:+            continue+        hits: dict[int, int] = {}+        for line in cls.findall("lines/line"):+            try:+                n = int(line.get("number", ""))+                h = int(float(line.get("hits", "0")))+            except ValueError:+                continue+            if h > hits.get(n, -1):+                hits[n] = h+        paths = [filename] + [f"{s}/{filename}" for s in sources]+        cov.append(Entry(paths, hits))+    return cov+++# --- normalisation and mapping --------------------------------------------++def normalise(path: str) -> str:+    return posixpath.normpath(path.replace("\\", "/"))+++def apply_path_map(cov: Coverage, strip: str | None, prepend: str | None) -> Coverage:+    """Normalise every path, then strip and prepend whole leading segments."""+    strip = normalise(strip) if strip else None+    prepend = normalise(prepend) if prepend else None+    out: Coverage = []+    for e in cov:+        paths = []+        for p in e.paths:+            p = normalise(p)+            if strip:+                p = p.removeprefix(strip + "/")+            if prepend:+                p = normalise(f"{prepend}/{p}")+            paths.append(p)+        out.append(Entry(paths, e.hits))+    return out+++# --- matching ---------------------------------------------------------------++def _segments(path: str) -> tuple[str, ...]:+    return tuple(path.split("/"))+++def _residual(e: tuple[str, ...], c: tuple[str, ...]) -> tuple[str, tuple[str, ...]] | None:+    """Direction and uncovered segments when one segment tuple is a whole-segment suffix of the other."""+    if len(e) > len(c) and e[-len(c):] == c:+        return ("entry", e[:-len(c)])+    if len(c) > len(e) and c[-len(e):] == e:+        return ("file", c[:-len(e)])+    return None+++def _merge(entries: list[Entry]) -> dict[int, int]:+    merged: dict[int, int] = {}+    for e in entries:+        for n, h in e.hits.items():+            merged[n] = merged.get(n, 0) + h+    return merged+++def match(cov: Coverage, changed: list[str]) -> tuple[dict[str, dict[int, int]], dict[str, str]]:+    """Five global passes: exact, pools, shared removal, residuals, merge.++    Returns merged hits per matched changed file and the reason+    (``"no candidate"`` or ``"ambiguous"``) per unmatched file.+    """+    matched: dict[str, dict[int, int]] = {}+    unmatched: dict[str, str] = {}+    norm = {c: normalise(c) for c in changed}+    epaths = [[normalise(p) for p in e.paths] for e in cov]+    esegs = [[_segments(p) for p in paths] for paths in epaths]+    pool = set(range(len(cov)))+    # Entry indexes by path (pass 1) and by last segment (pass 2): a+    # whole-segment suffix relation needs equal last segments, so only+    # those entries can hold a residual for a changed file.+    by_path: dict[str, list[int]] = {}+    by_base: dict[str, list[int]] = {}+    for i, paths in enumerate(epaths):+        for p in set(paths):+            by_path.setdefault(p, []).append(i)+        for base in {segs[-1] for segs in esegs[i]}:+            by_base.setdefault(base, []).append(i)++    # 1. Exact.+    exact_files: dict[int, list[str]] = {}+    for c in changed:+        for i in by_path.get(norm[c], ()):+            exact_files.setdefault(i, []).append(c)+    for i, files in exact_files.items():+        if len(files) > 1:+            for c in files:+                unmatched[c] = AMBIGUOUS+            pool.discard(i)+    for c in changed:+        if c in unmatched:+            continue+        hits = [i for i in by_path.get(norm[c], ()) if i in pool]+        if hits:+            matched[c] = _merge([cov[i] for i in hits])+            pool.difference_update(hits)+    remaining = [c for c in changed if c not in matched and c not in unmatched]++    # 2. Pools with residuals.+    pools: dict[str, dict[int, tuple[str, tuple[str, ...]]]] = {}+    for c in remaining:+        pools[c] = {}+        csegs = _segments(norm[c])+        for i in by_base.get(csegs[-1], ()):+            if i not in pool:+                continue+            for segs in esegs[i]:+                residual = _residual(segs, csegs)+                if residual is not None:+                    pools[c][i] = residual+                    break++    # 3. Shared entries leave every pool, once, without cascading.+    seen_in: dict[int, int] = {}+    for c in remaining:+        for i in pools[c]:+            seen_in[i] = seen_in.get(i, 0) + 1+    shared = {i for i, n in seen_in.items() if n > 1}+    for c in remaining:+        had = bool(pools[c])+        pools[c] = {i: r for i, r in pools[c].items() if i not in shared}+        if had and not pools[c]:+            unmatched[c] = AMBIGUOUS++    # 4. Residuals.+    for c in remaining:+        if c in unmatched:+            continue+        if not pools[c]:+            unmatched[c] = NO_CANDIDATE+        elif len(set(pools[c].values())) > 1:+            unmatched[c] = AMBIGUOUS++    # 5. Merge.+    for c in remaining:+        if c not in unmatched:+            matched[c] = _merge([cov[i] for i in sorted(pools[c])])+    return matched, unmatched+++# --- arithmetic -------------------------------------------------------------++def diff_coverage(added: set[int], hits: dict[int, int]) -> tuple[int, int] | None:+    """``(covered, measurable)`` over added lines present in ``hits``, or ``None``."""+    measurable = [n for n in added if n in hits]+    if not measurable:+        return None+    covered = sum(1 for n in measurable if hits[n] > 0)+    return covered, len(measurable)+++def overall(cov: Coverage) -> tuple[int, int]:+    """``(covered, instrumented)`` after merging entries by normalised primary path."""+    by_path: dict[str, list[Entry]] = {}+    for e in cov:+        if e.paths:+            by_path.setdefault(normalise(e.paths[0]), []).append(e)+    merged = [_merge(entries) for entries in by_path.values()]+    covered = sum(1 for hits in merged for h in hits.values() if h > 0)+    instrumented = sum(len(hits) for hits in merged)+    return covered, instrumented

diff --git a/scripts/review_html/css.py b/scripts/review_html/css.pynew file mode 100644index 0000000..557b369--- /dev/null+++ b/scripts/review_html/css.py@@ -0,0 +1,373 @@+"""Stylesheet for the review page (Prism Dark palette).++``CSS`` is substituted into the page template as a value, never pasted+into the template literal, so ``$`` inside it needs no escaping."""+from __future__ import annotations++CSS = """+:root {+  --bg: #0B1020;+  --bg-deep: #050C1B;+  --surface-1: #101A33;+  --surface-2: #142042;+  --border: #26324F;+  --border-subtle: #1F2A45;+  --text-primary: #EAF1FF;+  --text-secondary: #B7C3E3;+  --text-tertiary: #7F8BB0;+  --accent: #44C4DC;+  --accent-2: #E474E4;+  --accent-3: #4C6CBC;+  --code-bg: #0A1226;+  --code-border: #1F2A45;+  --success: #22C55E;+  --warning: #FBBF24;+  --error: #EF476F;+  --diff-add-bg: rgba(34, 197, 94, 0.12);+  --diff-add-fg: #86EFAC;+  --diff-del-bg: rgba(239, 71, 111, 0.12);+  --diff-del-fg: #FCA5A5;+}++* { box-sizing: border-box; }+html { background: var(--bg); }+body {+  background: var(--bg);+  color: var(--text-primary);+  font-family: -apple-system, "SF Pro Text", system-ui, sans-serif;+  line-height: 1.6;+  margin: 0;+  padding: 0;+}++.page { max-width: 1100px; margin: 0 auto; padding: 32px; }++header.top-bar {+  position: sticky; top: 0; z-index: 10;+  background: var(--bg-deep);+  border-bottom: 1px solid var(--border-subtle);+}+.top-stripe { height: 4px; background: linear-gradient(135deg, var(--accent-3), var(--accent-2)); }+.top-content {+  display: flex; gap: 16px; flex-wrap: wrap; align-items: center;+  padding: 14px 32px; max-width: 1100px; margin: 0 auto;+}+.top-content .repo-title { font-weight: 600; font-size: 15px; color: var(--text-primary); }++.chip {+  display: inline-flex; align-items: center; gap: 6px;+  background: var(--surface-1); border: 1px solid var(--border-subtle);+  border-radius: 999px; padding: 4px 12px; font-size: 12px; color: var(--text-secondary);+}+.chip strong { color: var(--text-primary); }++h1, h2, h3 { color: var(--text-primary); line-height: 1.3; }+h1 { font-size: 30px; margin: 8px 0 4px; }+h2 { font-size: 22px; margin: 32px 0 12px; padding-top: 12px; border-top: 1px solid var(--border-subtle); }+h3 { font-size: 17px; margin: 16px 0 8px; }++p { color: var(--text-secondary); }+strong { color: var(--text-primary); }+a { color: var(--accent); text-decoration: none; }+a:hover { text-decoration: underline; }+.muted { color: var(--text-tertiary); }+code { font-family: ui-monospace, "SF Mono", Menlo, monospace; }++.card-grid {+  display: grid; grid-template-columns: repeat(2, 1fr); gap: 16px;+  margin: 24px 0 32px;+}++.card {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 20px;+  transition: background-color 120ms ease;+}+.card:hover { background: var(--surface-2); }+.card h3 {+  margin-top: 0; font-size: 14px;+  text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-tertiary);+}+.card ul { margin: 8px 0 0; padding-left: 20px; }+.card li { margin: 4px 0; color: var(--text-secondary); }++.tag {+  display: inline-block;+  background: rgba(228, 116, 228, 0.15);+  color: var(--accent-2);+  border-radius: 4px;+  padding: 0 6px;+  font-size: 11px;+  font-weight: 600;+  text-transform: uppercase;+  margin-right: 6px;+}++.verdict-pill {+  display: inline-flex; align-items: center; gap: 8px;+  padding: 10px 18px; border-radius: 999px;+  font-weight: 600; font-size: 14px;+  text-transform: uppercase; letter-spacing: 0.05em;+}+.verdict-success { background: rgba(34, 197, 94, 0.18); color: var(--success); border: 1px solid rgba(34,197,94,0.35); }+.verdict-warning { background: rgba(251, 191, 36, 0.15); color: var(--warning); border: 1px solid rgba(251,191,36,0.35); }+.verdict-error   { background: rgba(239, 71, 111, 0.15); color: var(--error);   border: 1px solid rgba(239,71,111,0.35); }++.toc {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 16px 20px; margin: 0 0 24px;+}+.toc ul { list-style: none; padding-left: 0; margin: 0; column-count: 2; column-gap: 24px; }+.toc li { margin: 4px 0; }+.toc a { color: var(--text-secondary); }+.toc a:hover { color: var(--accent); }++.tabs {+  margin: 16px 0; border: 1px solid var(--border);+  border-radius: 16px; background: var(--surface-1);+}+.tabs input[type="radio"] { display: none; }+.tab-labels { display: flex; border-bottom: 1px solid var(--border-subtle); }+.tab-labels label {+  padding: 12px 20px; cursor: pointer; color: var(--text-tertiary);+  font-weight: 600; font-size: 13px;+  text-transform: uppercase; letter-spacing: 0.06em;+  border-bottom: 2px solid transparent; margin-bottom: -1px;+}+.tab-labels label:hover { color: var(--text-secondary); }++#tab-beginner:checked ~ .tab-labels label[for="tab-beginner"],+#tab-intermediate:checked ~ .tab-labels label[for="tab-intermediate"],+#tab-expert:checked ~ .tab-labels label[for="tab-expert"] {+  color: var(--accent);+  border-bottom-color: var(--accent);+}++.tab-panels { padding: 20px; }+.tab-panel { display: none; }+#tab-beginner:checked ~ .tab-panels #panel-beginner,+#tab-intermediate:checked ~ .tab-panels #panel-intermediate,+#tab-expert:checked ~ .tab-panels #panel-expert {+  display: block;+}++.change-card {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 20px; margin: 16px 0;+  transition: background-color 120ms ease;+}+.change-card:hover { background: var(--surface-2); }++.callout {+  margin: 12px 0; padding: 10px 14px;+  background: var(--bg-deep);+  border-radius: 6px; font-size: 14px; color: var(--text-secondary);+}+.callout-takeaway  { border-left: 3px solid var(--accent-2); }+.callout-rationale { border-left: 3px solid var(--accent); }+.callout-warning   { border-left: 3px solid var(--warning); }++table.findings, table.tests {+  width: 100%; border-collapse: collapse;+  margin: 16px 0; background: var(--surface-1);+  border: 1px solid var(--border); border-radius: 12px; overflow: hidden;+}+table.findings th, table.findings td,+table.tests th, table.tests td {+  padding: 10px 14px; text-align: left;+  border-bottom: 1px solid var(--border-subtle);+  font-size: 14px; vertical-align: top;+}+table.findings th, table.tests th {+  background: var(--surface-2); color: var(--text-secondary);+  text-transform: uppercase; font-size: 11px; letter-spacing: 0.08em;+}+table.findings tr:last-child td, table.tests tr:last-child td { border-bottom: none; }+table.tests td:last-child { white-space: pre-wrap; word-break: break-word; }+table.tests a { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 13px; }++.tests-provenance, .tests-availability, .tests-totals, .tests-matching {+  font-size: 14px; color: var(--text-secondary);+}+.tests-nodata {+  border-left: 3px solid var(--warning);+  margin: 16px 0;+}+.tests-nodata:hover { background: var(--surface-1); }++.pill {+  display: inline-block; padding: 2px 10px; border-radius: 999px;+  font-size: 11px; font-weight: 600;+  text-transform: uppercase; letter-spacing: 0.06em;+}+.pill-error    { background: rgba(239,71,111,0.18); color: var(--error); }+.pill-warning  { background: rgba(251,191,36,0.18); color: var(--warning); }+.pill-success  { background: rgba(34,197,94,0.18); color: var(--success); }+.pill-tertiary { background: rgba(127,139,176,0.18); color: var(--text-tertiary); }++.unresolved-comment {+  background: var(--surface-1); border: 1px solid var(--border);+  border-left: 3px solid var(--warning);+  border-radius: 10px; padding: 14px 16px; margin: 12px 0;+}+.unresolved-header {+  display: flex; flex-wrap: wrap; gap: 8px; align-items: center;+  font-size: 13px; color: var(--text-secondary); margin-bottom: 8px;+}+.unresolved-header code {+  background: var(--code-bg); color: var(--accent);+  padding: 1px 6px; border-radius: 4px; font-size: 12px;+}+.unresolved-body {+  color: var(--text-primary); font-size: 14px; line-height: 1.55;+  white-space: pre-wrap; word-break: break-word;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+}+.replies {+  margin-top: 10px; padding-top: 8px; border-top: 1px solid var(--border-subtle);+}+.replies > summary {+  cursor: pointer; color: var(--text-tertiary); font-size: 12px;+}+.reply { margin: 8px 0 0 12px; padding-left: 10px; border-left: 2px solid var(--border-subtle); }+.reply-header { font-size: 12px; color: var(--text-secondary); margin-bottom: 4px; }+.reply-body {+  color: var(--text-primary); font-size: 13px;+  white-space: pre-wrap; word-break: break-word;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+}++.commit-list { list-style: none; padding-left: 0; }+.commit-list li { padding: 6px 0; border-bottom: 1px solid var(--border-subtle); }+.commit-list li:last-child { border-bottom: none; }+.commit-sha {+  color: var(--accent); background: var(--code-bg);+  padding: 2px 6px; border-radius: 4px;+  font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 12px;+}+.commit-subj { color: var(--text-primary); }+.commit-meta { color: var(--text-tertiary); font-size: 13px; }++.file-diff {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 12px; margin: 8px 0; overflow: hidden;+}+.file-diff > summary {+  cursor: pointer; padding: 12px 16px; font-weight: 500;+  list-style: none; display: flex; gap: 12px; align-items: center;+}+.file-diff > summary::-webkit-details-marker { display: none; }+.file-diff > summary::before {+  content: "▸"; color: var(--text-tertiary); font-size: 12px; margin-right: 4px;+}+.file-diff[open] > summary::before { content: "▾"; }+.file-path { font-family: ui-monospace, "SF Mono", Menlo, monospace; color: var(--text-primary); }+.line-stat {+  color: var(--text-tertiary);+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 12px; margin-left: auto;+}++.badge {+  display: inline-block; font-size: 10px;+  text-transform: uppercase; letter-spacing: 0.06em; font-weight: 700;+  padding: 2px 8px; border-radius: 4px;+}+.badge-added    { background: rgba(34,197,94,0.18);  color: var(--success); }+.badge-modified { background: rgba(68,196,220,0.18); color: var(--accent); }+.badge-deleted  { background: rgba(239,71,111,0.18); color: var(--error); }+.badge-renamed  { background: rgba(76,108,188,0.18); color: var(--accent-3); }++.file-diff pre {+  margin: 0; background: var(--code-bg);+  border-top: 1px solid var(--code-border);+  padding: 12px 0; overflow-x: auto; line-height: 1.45;+}+.file-diff code {+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 13px; color: var(--text-secondary);+  display: inline-block; min-width: 100%;+}+.diff-line {+  display: block;+  padding: 0 16px;+  min-height: 1.45em;+}+.diff-add         { background: var(--diff-add-bg); color: var(--diff-add-fg); }+.diff-del         { background: var(--diff-del-bg); color: var(--diff-del-fg); }+.diff-hunk        { color: var(--accent); }+.diff-file-header { color: var(--text-tertiary); }+.diff-meta        { color: var(--text-tertiary); }+.diff-context     { color: var(--text-secondary); }+.diff-uncovered {+  border-left: 3px solid var(--error);+  padding-left: 13px;+}+.diff-uncovered::before {+  content: "▌"; color: var(--error); margin-right: 6px;+}++.blast-scroll {+  overflow-x: auto;+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 12px; padding: 12px; margin: 12px 0;+}+.blast-scroll svg { display: block; }+.blast-legend {+  display: flex; flex-wrap: wrap; gap: 8px 18px;+  margin: 12px 0; font-size: 13px; color: var(--text-secondary);+}+.blast-key { display: inline-flex; align-items: center; gap: 6px; }+.blast-swatch {+  display: inline-block; width: 14px; height: 14px; border-radius: 3px;+  background: var(--surface-2); border: 1px solid var(--border);+}+.blast-swatch-added    { background: rgba(34,197,94,0.18);   border-color: var(--success); }+.blast-swatch-modified { background: rgba(228,116,228,0.18); border-color: var(--accent-2); }+.blast-swatch-deleted  { background: rgba(239,71,111,0.18);  border-color: var(--error); }+.blast-swatch-renamed  { background: rgba(76,108,188,0.18);  border-color: var(--accent-3); }+.blast-swatch-collapsed { border-style: dashed; }+.blast-members, .blast-skipped { font-size: 13px; color: var(--text-secondary); }+.blast-members code, .blast-skipped code { color: var(--text-primary); font-size: 12px; }++.pr-description {+  background: var(--surface-1);+  border: 1px solid var(--border);+  border-left: 3px solid var(--accent-2);+  border-radius: 12px;+  padding: 16px 20px;+  margin: 8px 0 16px;+}+.pr-description .meta {+  color: var(--text-tertiary);+  font-size: 12px;+  margin-bottom: 12px;+}+.pr-description pre {+  margin: 0;+  background: transparent;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 13px;+  line-height: 1.55;+  color: var(--text-secondary);+  white-space: pre-wrap;+  word-wrap: break-word;+}+.pr-description pre code,+.pr-description pre a { color: var(--text-primary); }++footer {+  margin-top: 64px; padding-top: 24px;+  border-top: 1px solid var(--border-subtle);+  color: var(--text-tertiary); font-size: 13px;+}++@media (max-width: 720px) {+  .card-grid { grid-template-columns: 1fr; }+  .toc ul { column-count: 1; }+  .page { padding: 16px; }+}+@media (prefers-reduced-motion: reduce) {+  * { transition: none !important; }+}+"""

diff --git a/scripts/review_html/diagram.py b/scripts/review_html/diagram.pynew file mode 100644index 0000000..e04f11f--- /dev/null+++ b/scripts/review_html/diagram.py@@ -0,0 +1,565 @@+"""Blast-radius diagram: projection of the one-hop graph, layout, and SVG.++``project`` applies the rendering rules the skill never applies (test+exclusion, expansion collapse, the column cap) and knows nothing about SVG;+``layout`` turns a ``Projected`` into boxes, frames, and edge paths using+the fixed constants below; ``render_diagram`` emits the section HTML.+"""+from __future__ import annotations++import math+import textwrap+from dataclasses import dataclass, field++from .common import digest, escape, file_anchor+from .warnings import Warnings++CAP = 15                 # side-column node cap (requirement 4.8)+COLLAPSE_ABOVE = 3       # expansion groups larger than this collapse (4.6)++COLUMNS = ("dependents", "changed", "dependencies")+SIDE_COLUMNS = ("dependents", "dependencies")+CHANGED_STATUSES = ("added", "modified", "deleted", "renamed")++# Layout constants (design, Q36 and Q56). Every text element declares a+# textLength of len(text) * ADV so the fit holds whatever font renders it.+ADV = 7.2+PAD = 10+BOX_H = 26+ROW_GAP = 8+GROUP_PAD = 8+GROUP_HEADER = 18+GROUP_GAP = 14+GUTTER = 56+LANE = 24+CONTENT_W = 1036+COL_W = (CONTENT_W - 2 * GUTTER) // 3          # 308+SIDE_BOX_W = COL_W - 2 * GROUP_PAD             # 292+CENTRE_BOX_W = SIDE_BOX_W - LANE               # 268+BADGE_RESERVE = 4                              # characters kept for the ⚑N badge+TRACK_GAP = 6                                  # centre lane tracks, three of them+LINE_H = 16                                    # header note and reason lines+TITLE_Y = 12+NOTES_Y = 30+BOTTOM_PAD = 16++COL_X = {"dependents": 0, "changed": COL_W + GUTTER, "dependencies": 2 * (COL_W + GUTTER)}+COL_TITLE = {"dependents": "Dependents", "changed": "Changed", "dependencies": "Dependencies"}++FILL = {+    "added": "var(--success, #22C55E)",+    "modified": "var(--accent-2, #E474E4)",+    "deleted": "var(--error, #EF476F)",+    "renamed": "var(--accent-3, #4C6CBC)",+}+NEUTRAL_FILL = "var(--surface-2, #142042)"+BORDER = "var(--border, #26324F)"+TEXT = "var(--text-primary, #EAF1FF)"+MUTED = "var(--text-tertiary, #7F8BB0)"+EDGE = "var(--text-tertiary, #7F8BB0)"+FONT = 'ui-monospace, "SF Mono", Menlo, monospace'+++def budget(box_w: int, reserve: int = 0) -> int:+    """Largest label length L with (L + reserve) * ADV + 2 * PAD <= box_w."""+    return math.floor((box_w - 2 * PAD) / ADV) - reserve+++SIDE_BUDGET = budget(SIDE_BOX_W)                       # 37+CENTRE_BUDGET = budget(CENTRE_BOX_W, BADGE_RESERVE)    # 30+BUDGET = {"dependents": SIDE_BUDGET, "changed": CENTRE_BUDGET, "dependencies": SIDE_BUDGET}+++def shorten(text: str, limit: int) -> str:+    if len(text) <= limit:+        return text+    return "…" + text[-(limit - 1):]+++def text_len(s: str) -> float:+    return len(s) * ADV+++# --- projection -------------------------------------------------------------++@dataclass+class PNode:+    id: str+    path: str                 # full path; first member path for collapsed nodes+    label: str                # path, "<group> (N files)", or "+N more"+    group: object             # str, or None for the overflow node+    status: str               # added|modified|deleted|renamed|unchanged|collapsed|more+    members: list = field(default_factory=list)   # sorted member paths, else []+    test_count: int = 0+    edges_to_changed: int = 0+++@dataclass+class PGroup:+    name: object              # str, or None for the overflow group+    nodes: list+++@dataclass+class PEdge:+    src: str                  # node id+    dst: str                  # node id+    column: str               # side column of the non-centre end; "changed" for centre-to-centre+    granularity: str+++@dataclass+class Projected:+    columns: dict             # column -> list[PGroup]+    edges: list               # list[PEdge]+    column_status: dict       # dependents/dependencies -> status string+    package_granularity: dict # column -> bool+    skipped: list+    snapshot_tree: str+    base_tree: str++    def nodes(self, column: str) -> list:+        return [n for g in self.columns[column] for n in g.nodes]+++def node_id(path: str) -> str:+    return "n-" + digest(path)+++def _validate(desc: object) -> None:+    if not isinstance(desc, dict):+        raise ValueError("diagram description is not a JSON object")+    for key in ("nodes", "edges"):+        if not isinstance(desc.get(key), list):+            raise ValueError(f"diagram description has no {key!r} list")+    for n in desc["nodes"]:+        if not isinstance(n, dict) or not isinstance(n.get("path"), str):+            raise ValueError("diagram node without a path")+    for e in desc["edges"]:+        if not isinstance(e, dict) or not isinstance(e.get("from"), str) \+                or not isinstance(e.get("to"), str):+            raise ValueError("diagram edge without from and to")+    status = desc.get("column_status")+    if status is not None and not isinstance(status, dict):+        raise ValueError("column_status is not an object")+++def _group_nodes(nodes: list) -> list:+    """Order nodes into groups by name, nodes by path; ``None`` group last."""+    named: dict = {}+    for n in nodes:+        named.setdefault(n.group, []).append(n)+    groups = []+    for name in sorted(k for k in named if k is not None):+        groups.append(PGroup(name, sorted(named[name], key=lambda n: n.path)))+    if None in named:+        groups.append(PGroup(None, sorted(named[None], key=lambda n: n.path)))+    return groups+++def project(desc: dict) -> Projected:+    _validate(desc)+    raw_nodes = {}+    for n in desc["nodes"]:+        raw_nodes.setdefault(n["path"], n)+    status_of = {p: (n.get("status") or "unchanged") for p, n in raw_nodes.items()}+    changed = {p for p, s in status_of.items() if s in CHANGED_STATUSES}+    is_test = {p: bool(n.get("is_test")) for p, n in raw_nodes.items()}+    group_of = {p: str(n.get("group") or "") for p, n in raw_nodes.items()}++    # Edges between known nodes, deduplicated by (from, to), first wins.+    edges = {}+    for e in desc["edges"]:+        key = (e["from"], e["to"])+        if key in edges or key[0] not in raw_nodes or key[1] not in raw_nodes:+            continue+        if key[0] not in changed and key[1] not in changed:+            continue+        if key[0] == key[1]:+            continue+        edges[key] = str(e.get("granularity") or "file")++    # Column assignment.+    # A node with edges in both directions is a dependent.+    column_of = {p: "changed" for p in changed}+    for (a, b) in edges:+        if a not in changed:+            column_of[a] = "dependents"+        if b not in changed and column_of.get(b) != "dependents":+            column_of[b] = "dependencies"++    # 1. Test exclusion; counts include changed test files.+    test_count = {p: 0 for p in changed}+    for (a, b) in edges:+        if b in changed and is_test.get(a):+            test_count[b] += 1+    side_members = {+        col: [p for p, c in column_of.items() if c == col and not is_test[p]]+        for col in SIDE_COLUMNS+    }+    column_status = {}+    raw_status = desc.get("column_status") or {}+    for col in SIDE_COLUMNS:+        column_status[col] = str(raw_status.get(col) or "complete")+        if column_status[col].startswith("failed"):+            side_members[col] = []+    kept_paths = set(changed)+    for col in SIDE_COLUMNS:+        kept_paths.update(side_members[col])+    edges = {k: g for k, g in edges.items() if k[0] in kept_paths and k[1] in kept_paths}++    # Per path: the number of edges to a changed node, and whether every+    # such edge is package-granular (vacuously true with none).+    edge_count: dict = {}+    all_package: dict = {}+    for (a, b), g in edges.items():+        for p, other in ((a, b), (b, a)):+            if other in changed:+                edge_count[p] = edge_count.get(p, 0) + 1+                all_package[p] = all_package.get(p, True) and g == "package"++    # Node objects; ``owner`` maps a path to the node that represents it.+    owner = {}+    columns = {}+    for p in sorted(changed):+        node = PNode(node_id(p), p, p, group_of[p], status_of[p], [],+                     test_count[p], edge_count.get(p, 0))+        owner[p] = node+    columns["changed"] = _group_nodes([owner[p] for p in changed])++    for col in SIDE_COLUMNS:+        nodes = []+        # 2. Expansion collapse per group.+        by_group: dict = {}+        for p in side_members[col]:+            by_group.setdefault(group_of[p], []).append(p)+        for group, members in by_group.items():+            collapsible = sorted(p for p in members if all_package.get(p, True))+            collapsed = set(collapsible)+            singles = [p for p in members if p not in collapsed]+            if len(collapsible) > COLLAPSE_ABOVE:+                node = PNode(node_id("\n".join(collapsible)), collapsible[0],+                             f"{group} ({len(collapsible)} files)", group, "collapsed",+                             collapsible, 0, sum(edge_count.get(p, 0) for p in collapsible))+                for p in collapsible:+                    owner[p] = node+                nodes.append(node)+            else:+                singles += collapsible+            for p in singles:+                node = PNode(node_id(p), p, p, group, "unchanged", [], 0, edge_count.get(p, 0))+                owner[p] = node+                nodes.append(node)+        # 3. Cap.+        if len(nodes) > CAP:+            nodes.sort(key=lambda n: (-n.edges_to_changed, n.path))+            overflow = nodes[CAP:]+            nodes = nodes[:CAP]+            members = sorted(p for n in overflow for p in (n.members or [n.path]))+            more = PNode(node_id("\n".join(members)), members[0], f"+{len(members)} more",+                         None, "more", members, 0, sum(n.edges_to_changed for n in overflow))+            for p in members:+                owner[p] = more+            nodes.append(more)+        columns[col] = _group_nodes(nodes)++    # Projected edges between owning nodes, deduplicated.+    p_edges = []+    seen = set()+    for (a, b), gran in sorted(edges.items()):+        src, dst = owner[a], owner[b]+        if a in changed and b in changed:+            col = "changed"+        elif a in changed:+            col = column_of[b]+        else:+            col = column_of[a]+        key = (src.id, dst.id)+        if key in seen:+            continue+        seen.add(key)+        p_edges.append(PEdge(src.id, dst.id, col, gran))++    package_granularity = {+        col: any(e.column == col and e.granularity == "package" for e in p_edges)+        for col in COLUMNS+    }+    skipped = desc.get("skipped") if isinstance(desc.get("skipped"), list) else []+    return Projected(+        columns=columns,+        edges=p_edges,+        column_status=column_status,+        package_granularity=package_granularity,+        skipped=skipped,+        snapshot_tree=str(desc.get("snapshot_tree") or ""),+        base_tree=str(desc.get("base_tree") or ""),+    )+++# --- layout -----------------------------------------------------------------++@dataclass+class Box:+    id: str+    column: str+    x: float+    y: float+    w: float+    h: float+    label: str+    text_len: float+    badge: object            # "⚑N" or None+    badge_len: float+    node: PNode+++@dataclass+class Frame:+    column: str+    x: float+    y: float+    w: float+    h: float+    label: str+    text_len: float+++@dataclass+class EdgePath:+    src: str+    dst: str+    column: str+    d: str+++@dataclass+class Header:+    column: str+    title: str+    notes: list             # lines under the title+    reason: list            # lines drawn where nodes would be (failed or empty column)+++@dataclass+class Layout:+    boxes: dict             # node id -> Box+    frames: list            # list[Frame]+    edges: list             # list[EdgePath]+    headers: list           # list[Header]+    width: int+    height: int+    content_top: int        # y where the column contents start, below the header notes+++def _wrap(text: str, limit: int) -> list:+    return textwrap.wrap(text, limit, break_long_words=True) or [""]+++def layout(p: Projected) -> Layout:+    headers = []+    for col in COLUMNS:+        notes = []+        status = p.column_status.get(col, "complete")+        if col != "changed" and status.startswith("partial"):+            notes += _wrap(status, SIDE_BUDGET)+        if p.package_granularity.get(col):+            notes.append("edges at package granularity")+        reason = []+        if col != "changed" and status.startswith("failed"):+            reason = _wrap(status, SIDE_BUDGET)+        elif not p.columns[col]:+            reason = ["none found"]+        headers.append(Header(col, COL_TITLE[col], notes, reason))+    content_top = NOTES_Y + LINE_H * max(len(h.notes) for h in headers)++    boxes = {}+    frames = []+    bottom = content_top+    for col in COLUMNS:+        x = COL_X[col]+        y = content_top+        box_w = CENTRE_BOX_W if col == "changed" else SIDE_BOX_W+        limit = BUDGET[col]+        header = next(h for h in headers if h.column == col)+        if header.reason:+            y += LINE_H * len(header.reason)+        for gi, group in enumerate(p.columns[col]):+            if gi:+                y += GROUP_GAP+            n = len(group.nodes)+            if group.name is not None:+                label = shorten(group.name, limit)+                h = GROUP_PAD + GROUP_HEADER + n * BOX_H + (n - 1) * ROW_GAP + GROUP_PAD+                frames.append(Frame(col, x, y, COL_W, h, label, text_len(label)))+                node_y = y + GROUP_PAD + GROUP_HEADER+            else:+                h = n * BOX_H + (n - 1) * ROW_GAP+                node_y = y+            for node in group.nodes:+                label = shorten(node.label, limit)+                badge = f"⚑{node.test_count}" if node.test_count > 0 else None+                boxes[node.id] = Box(node.id, col, x + GROUP_PAD, node_y, box_w, BOX_H, label,+                                     text_len(label), badge, text_len(badge) if badge else 0.0,+                                     node)+                node_y += BOX_H + ROW_GAP+            y += h+        bottom = max(bottom, y)+    height = int(bottom + BOTTOM_PAD)++    edges = []+    lane_x0 = COL_X["changed"] + GROUP_PAD + CENTRE_BOX_W+    centre_index = 0+    for e in p.edges:+        src, dst = boxes.get(e.src), boxes.get(e.dst)+        if src is None or dst is None:+            continue+        sy, dy = src.y + src.h / 2, dst.y + dst.h / 2+        if e.column == "changed":+            track = lane_x0 + TRACK_GAP * (centre_index % 3 + 1)+            centre_index += 1+            x = src.x + src.w+            d = f"M {_n(x)} {_n(sy)} L {_n(track)} {_n(sy)} L {_n(track)} {_n(dy)} L {_n(x)} {_n(dy)}"+        else:+            left = min(COL_X[src.column], COL_X[dst.column])+            mid = left + COL_W + GUTTER / 2+            if dst.x > src.x:+                x1, x2 = src.x + src.w, dst.x+            else:+                x1, x2 = src.x, dst.x + dst.w+            d = f"M {_n(x1)} {_n(sy)} C {_n(mid)} {_n(sy)} {_n(mid)} {_n(dy)} {_n(x2)} {_n(dy)}"+        edges.append(EdgePath(e.src, e.dst, e.column, d))+    return Layout(boxes, frames, edges, headers, CONTENT_W, height, content_top)+++def _n(v: float) -> str:+    s = f"{v:.1f}"+    return s[:-2] if s.endswith(".0") else s+++# --- SVG and section --------------------------------------------------------++def _text(x: float, y: float, s: str, fill: str, anchor: str = "start", cls: str = "") -> str:+    klass = f' class="{cls}"' if cls else ""+    return (f'<text{klass} x="{_n(x)}" y="{_n(y)}" textLength="{_n(text_len(s))}" '+            f'lengthAdjust="spacingAndGlyphs" dominant-baseline="middle" '+            f'text-anchor="{anchor}" fill="{fill}">{escape(s)}</text>')+++def render_svg(p: Projected, lay: Layout) -> str:+    out = [+        f'<svg class="blast" xmlns="http://www.w3.org/2000/svg" width="{lay.width}" '+        f'height="{lay.height}" viewBox="0 0 {lay.width} {lay.height}" '+        f"font-family='{FONT}' font-size=\"12\">",+        '<defs><marker id="blast-arrow" viewBox="0 0 10 10" refX="9" refY="5" '+        'markerWidth="7" markerHeight="7" orient="auto">'+        f'<path d="M 0 0 L 10 5 L 0 10 z" fill="{EDGE}"/></marker></defs>',+    ]+    out.append('<g class="headers">')+    for h in lay.headers:+        x = COL_X[h.column] + PAD+        out.append(_text(x, TITLE_Y, h.title, TEXT, cls="col-title"))+        for i, note in enumerate(h.notes):+            out.append(_text(x, NOTES_Y + LINE_H * i, note, MUTED, cls="col-note"))+        for i, line in enumerate(h.reason):+            out.append(_text(x, lay.content_top + LINE_H * i + LINE_H / 2, line, MUTED, cls="col-reason"))+    out.append("</g>")++    out.append('<g class="frames">')+    for f in lay.frames:+        out.append(+            f'<g class="group"><rect x="{_n(f.x)}" y="{_n(f.y)}" width="{_n(f.w)}" '+            f'height="{_n(f.h)}" rx="8" fill="none" stroke="{BORDER}"/>'+            + _text(f.x + PAD, f.y + GROUP_PAD + GROUP_HEADER / 2, f.label, MUTED, cls="group-label")+            + "</g>"+        )+    out.append("</g>")++    out.append('<g class="edges">')+    for e in lay.edges:+        out.append(+            f'<path class="edge e-{e.src} e-{e.dst}" data-from="{e.src}" data-to="{e.dst}" '+            f'd="{e.d}" fill="none" stroke="{EDGE}" stroke-width="1.2" '+            'marker-end="url(#blast-arrow)"/>'+        )+    out.append("</g>")++    out.append('<g class="nodes">')+    for box in lay.boxes.values():+        node = box.node+        changed = node.status in CHANGED_STATUSES+        if changed:+            colour = FILL[node.status]+            rect = (f'<rect x="{_n(box.x)}" y="{_n(box.y)}" width="{_n(box.w)}" height="{_n(box.h)}" '+                    f'rx="6" fill="{colour}" fill-opacity="0.18" stroke="{colour}"/>')+        else:+            dashed = ' stroke-dasharray="5 3"' if node.status in ("collapsed", "more") else ""+            rect = (f'<rect x="{_n(box.x)}" y="{_n(box.y)}" width="{_n(box.w)}" height="{_n(box.h)}" '+                    f'rx="6" fill="{NEUTRAL_FILL}" stroke="{BORDER}"{dashed}/>')+        title = node.path if not node.members else "\n".join(node.members)+        parts = [f'<g id="{box.id}"><title>{escape(title)}</title>', rect,+                 _text(box.x + PAD, box.y + box.h / 2, box.label, TEXT, cls="label")]+        if box.badge:+            parts.append(_text(box.x + box.w - PAD, box.y + box.h / 2, box.badge, TEXT,+                               anchor="end", cls="badge"))+        parts.append("</g>")+        g = "".join(parts)+        if changed:+            g = f'<a href="#{file_anchor(node.path)}">{g}</a>'+        out.append(g)+    out.append("</g>")+    out.append("</svg>")+    return "\n".join(out)+++def _hover_style(lay: Layout) -> str:+    rules = []+    for nid in lay.boxes:+        rules.append(f".blast:has(#{nid}:hover) .edge:not(.e-{nid}){{opacity:.15}}")+        rules.append(f".blast:has(#{nid}:hover) .edge.e-{nid}{{stroke-width:2}}")+    return "<style>\n" + "\n".join(rules) + "\n</style>"+++def _legend() -> str:+    keys = [("added", "added"), ("modified", "modified"), ("deleted", "deleted"),+            ("renamed", "renamed"), ("unchanged", "unchanged"),+            ("collapsed", "collapsed package group or +N more")]+    spans = "".join(+        f'<span class="blast-key"><span class="blast-swatch blast-swatch-{k}"></span>{label}</span>'+        for k, label in keys+    )+    spans += '<span class="blast-key">⚑N test files with an edge to the node</span>'+    return f'<div class="blast-legend">{spans}</div>'+++def render_diagram(desc: dict, warnings: Warnings) -> str:+    try:+        p = project(desc)+    except ValueError as exc:+        warnings.add(f"diagram description invalid: {exc}")+        return ""+    lay = layout(p)+    collapsed = [n for col in COLUMNS for n in p.nodes(col) if n.members]+    members_html = ""+    if collapsed:+        items = "".join(+            f"<li><code>{escape(n.label)}</code>: "+            + ", ".join(f"<code>{escape(m)}</code>" for m in n.members) + "</li>"+            for n in collapsed+        )+        members_html = f'<h3>Collapsed nodes</h3>\n<ul class="blast-members">{items}</ul>'+    skipped_html = ""+    if p.skipped:+        items = "".join(+            f'<li><code>{escape(s.get("path"))}</code> — {escape(s.get("reason"))}</li>'+            for s in p.skipped if isinstance(s, dict)+        )+        skipped_html = f'<h3>Skipped files</h3>\n<ul class="blast-skipped">{items}</ul>'+    return f"""<section id="diagram">+    <h2>Blast radius</h2>+    <p class="muted">Files that import a changed file on the left, changed files in the centre, files a changed file imports on the right. Snapshot <code>{escape(p.snapshot_tree)}</code> against base <code>{escape(p.base_tree)}</code>.</p>+    {_hover_style(lay)}+    <div class="blast-scroll">{render_svg(p, lay)}</div>+    {_legend()}+    {members_html}+    {skipped_html}+    </section>"""

diff --git a/scripts/review_html/diffs.py b/scripts/review_html/diffs.pynew file mode 100644index 0000000..219ec18--- /dev/null+++ b/scripts/review_html/diffs.py@@ -0,0 +1,118 @@+"""Diff fragments: loading, hunk arithmetic, and rendering.++``load_fragments`` resolves every file's diff text once so the Tests section+and the per-file diff blocks read the same bytes. ``added_lines`` and+``render_diff`` share one walk over the hunks so the line numbers used for+coverage lookups are the ones the rendered marks land on.+"""+from __future__ import annotations++import re+from pathlib import Path+from typing import Iterator++from .common import escape+from .inputs import read_guarded+from .warnings import Warnings++_HUNK = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@")+++def load_fragments(files: list[dict], diff_dir: Path | None, warnings: Warnings) -> dict[str, str]:+    """Map each file's path to its diff text or a placeholder.++    An inline ``diff`` wins over ``diff_file``. A ``diff_file`` is read from+    ``diff_dir`` through ``read_guarded``; a missing file keeps the historic+    placeholder, an undecodable one gets its own, and both leave the rest of+    the page intact.+    """+    fragments: dict[str, str] = {}+    for f in files:+        path = f.get("path", "")+        diff = f.get("diff")+        name = f.get("diff_file")+        if diff is None and name and diff_dir is not None:+            fragment = diff_dir / name+            if not fragment.exists():+                diff = f"(diff fragment {name!r} missing)"+            else:+                diff = read_guarded(fragment, warnings)+                if diff is None:+                    diff = f"(diff fragment {name!r} is not UTF-8)"+        if diff is None:+            diff = "(no diff provided)"+        fragments[path] = diff+    return fragments+++def _walk(diff: str) -> Iterator[tuple[str, str, int | None]]:+    """Yield ``(line, css_class, new_file_number)`` for each line of a diff.++    ``new_file_number`` is set only on ``+`` lines and is the line's number in+    the new file, tracked from the ``@@`` headers. Context and ``+`` lines+    advance the counter; ``-`` lines, headers, and ``\\`` markers do not.+    Line classes match the renderer's historic prefix rules, except that+    ``+++`` and ``---`` are file headers only before a file section's first+    ``@@``; inside a hunk they are added or removed lines whose content+    happens to start with ``++`` or ``--``. A ``diff --git`` line starts a+    new file section.+    """+    if not diff:+        return+    lines = diff.split("\n")+    if lines and lines[-1] == "":+        lines.pop()+    next_new: int | None = None+    for line in lines:+        number = None+        if line.startswith("diff --git "):+            cls = "diff-context"+            next_new = None+        elif next_new is None and line.startswith(("+++", "---")):+            cls = "diff-file-header"+        elif line.startswith("@@"):+            cls = "diff-hunk"+            m = _HUNK.match(line)+            next_new = int(m.group(1)) if m else None+        elif line.startswith("+"):+            cls = "diff-add"+            if next_new is not None:+                number = next_new+                next_new += 1+        elif line.startswith("-"):+            cls = "diff-del"+        elif line.startswith("\\"):+            cls = "diff-meta"+        else:+            cls = "diff-context"+            if next_new is not None:+                next_new += 1+        yield line, cls, number+++def added_lines(diff: str) -> set[int]:+    """New-file line numbers of every ``+`` line, from the ``@@`` headers."""+    return {number for _, _, number in _walk(diff) if number is not None}+++def is_binary(diff: str) -> bool:+    return any(+        line.startswith(("Binary files ", "GIT binary patch"))+        for line in diff.split("\n")+    )+++def render_diff(diff: str, uncovered: set[int] | None = None) -> str:+    """Render a unified diff as one <span class="diff-line"> per line.++    Each line is classified by its leading marker so consecutive additions or+    deletions paint a continuous full-width background bar. A ``+`` line whose+    new-file number is in ``uncovered`` also carries ``diff-uncovered``; with+    ``None`` the output is the historic rendering.+    """+    spans = []+    for line, cls, number in _walk(diff):+        if uncovered and number is not None and number in uncovered:+            cls += " diff-uncovered"+        spans.append(f'<span class="diff-line {cls}">{escape(line)}</span>')+    return "".join(spans)

diff --git a/scripts/review_html/inputs.py b/scripts/review_html/inputs.pynew file mode 100644index 0000000..02ee437--- /dev/null+++ b/scripts/review_html/inputs.py@@ -0,0 +1,68 @@+"""Guarded file reads.++``read_guarded`` is the only way the package reads an input file (diff+fragments, JUnit, coverage, diagram descriptions). It refuses inputs over+50 MB, inputs that are not UTF-8, and, for XML, inputs carrying a DOCTYPE+declaration; each refusal is recorded as a warning naming the file.+``read_json`` and ``xml_root`` build on it for the two structured formats.+"""+from __future__ import annotations++import json+import xml.etree.ElementTree as ET+from pathlib import Path++from .warnings import Warnings++MAX_INPUT_BYTES = 50 * 1024 * 1024+DOCTYPE_SCAN_BYTES = 64 * 1024+++def read_guarded(path: Path, warnings: Warnings, xml: bool = False) -> str | None:+    try:+        size = path.stat().st_size+        if size > MAX_INPUT_BYTES:+            warnings.add(f"{path.name}: skipped, larger than 50 MB ({size} bytes)")+            return None+        raw = path.read_bytes()+    except OSError as exc:+        warnings.add(f"{path.name}: cannot read ({exc.strerror or exc})")+        return None+    if xml and b"<!DOCTYPE" in raw[:DOCTYPE_SCAN_BYTES]:+        warnings.add(f"{path.name}: skipped, XML contains a DOCTYPE declaration")+        return None+    try:+        return raw.decode("utf-8")+    except UnicodeDecodeError:+        warnings.add(f"{path.name}: skipped, not valid UTF-8")+        return None+++def read_json(path: Path, warnings: Warnings, what: str) -> object:+    """Parsed JSON of a guarded read, or ``None`` with a warning naming ``what``."""+    text = read_guarded(path, warnings)+    if text is None:+        return None+    try:+        return json.loads(text)+    except ValueError as exc:+        warnings.add(f"{path.name}: {what} is not valid JSON ({exc})")+        return None+++def xml_root(text: str, name: str, warnings: Warnings, expected_tags: tuple,+             kind: str, expected: str) -> ET.Element | None:+    """Root element of ``text`` when it parses and its tag is expected, else ``None``.++    ``kind`` names the format in the malformed warning ("JUnit XML");+    ``expected`` describes the accepted root in the wrong-root warning.+    """+    try:+        root = ET.fromstring(text)+    except ET.ParseError as exc:+        warnings.add(f"{name}: skipped, {kind} is malformed ({exc})")+        return None+    if root.tag not in expected_tags:+        warnings.add(f"{name}: skipped, root element is <{root.tag}>, not {expected}")+        return None+    return root

diff --git a/scripts/review_html/junit.py b/scripts/review_html/junit.pynew file mode 100644index 0000000..f97c107--- /dev/null+++ b/scripts/review_html/junit.py@@ -0,0 +1,102 @@+"""JUnit XML parsing.++``parse_junit`` reads one or more JUnit files through ``read_guarded`` and+returns one ``Case`` per test identity per source file. Rerun and flaky+elements (Surefire and pytest-rerunfailures dialects) never make a case+that ultimately passed count as failed; they mark it flaky instead.+"""+from __future__ import annotations++import xml.etree.ElementTree as ET+from dataclasses import dataclass+from pathlib import Path++from .inputs import read_guarded, xml_root+from .warnings import Warnings++FLAKY_ELEMENTS = ("flakyFailure", "flakyError", "rerunFailure", "rerunError", "rerun")+SUITE_TAGS = ("testsuites", "testsuite")+OUTCOMES = ("passed", "failed", "errored", "skipped")+++@dataclass+class Case:+    suite: str+    name: str+    outcome: str        # one of OUTCOMES+    flaky: bool+    message: str+    source: str         # input file name, for job attribution+++def _message(el: ET.Element) -> str:+    """Message of the first failure or error child: its attribute, else its text."""+    for child in el:+        if child.tag in ("failure", "error"):+            attr = child.get("message")+            if attr is not None and attr != "":+                return attr+            return (child.text or "").strip()+    return ""+++def _classify(el: ET.Element) -> tuple[str, bool]:+    """Outcome and flaky flag of one ``testcase`` element, first rule wins."""+    tags = {child.tag for child in el}+    if "failure" in tags:+        return "failed", False+    if "error" in tags:+        return "errored", False+    if any(tag in tags for tag in FLAKY_ELEMENTS):+        return "passed", True+    if "skipped" in tags:+        return "skipped", False+    return "passed", False+++def _elements(root: ET.Element) -> list[tuple[str, ET.Element]]:+    """Every ``testcase`` with its enclosing suite name, in document order."""+    out: list[tuple[str, ET.Element]] = []+    for suite in root.iter():+        if suite.tag not in SUITE_TAGS:+            continue+        suite_name = suite.get("name") or ""+        for tc in suite:+            if tc.tag == "testcase":+                out.append((suite_name, tc))+    return out+++def _parse_one(path: Path, warnings: Warnings) -> list[Case]:+    text = read_guarded(path, warnings, xml=True)+    if text is None:+        return []+    root = xml_root(text, path.name, warnings, SUITE_TAGS, "JUnit XML", "a JUnit suite")+    if root is None:+        return []++    source = path.name+    cases: dict[tuple[str, str], Case] = {}+    for suite_name, tc in _elements(root):+        suite = tc.get("classname") or suite_name+        name = tc.get("name") or ""+        outcome, flaky = _classify(tc)+        message = _message(tc)+        key = (suite, name)+        earlier = cases.get(key)+        if earlier is None:+            cases[key] = Case(suite, name, outcome, flaky, message, source)+            continue+        # Same identity within one source: the last element's outcome wins,+        # and a pass after an earlier failure, error, or rerun is flaky.+        if outcome == "passed":+            flaky = flaky or earlier.flaky or earlier.outcome in ("failed", "errored")+        cases[key] = Case(suite, name, outcome, flaky, message, source)+    return list(cases.values())+++def parse_junit(paths: list[Path], warnings: Warnings) -> list[Case]:+    cases: list[Case] = []+    for path in paths:+        cases.extend(_parse_one(path, warnings))+    return cases

diff --git a/scripts/review_html/redact.py b/scripts/review_html/redact.pynew file mode 100644index 0000000..f76f2f4--- /dev/null+++ b/scripts/review_html/redact.py@@ -0,0 +1,37 @@+"""Secret redaction for failure messages.++The page is archived and served to feed readers, and test output routinely+carries tokens and connection strings. ``PATTERNS`` are applied in order and+every match becomes ``[redacted]``; ``clean_message`` redacts before it+truncates so a secret straddling the cut can never survive.+"""+from __future__ import annotations++import re++PATTERNS: list[re.Pattern] = [+    re.compile(r"Bearer\s+[A-Za-z0-9\-._~+/]+=*"),+    re.compile(r"AKIA[0-9A-Z]{16}"),+    re.compile(r"gh[pousr]_[A-Za-z0-9]{36,}"),+    re.compile(r"xox[abprs]-[A-Za-z0-9-]+"),+    re.compile(r"""(?i)[A-Za-z0-9_]*(key|token|secret|password|passwd|pwd)["']?\s*[=:]\s*\S+"""),+    re.compile(r"[a-z][a-z0-9+.-]*://[^/\s:@]+:[^@\s]+@"),+    re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----"),+]++REDACTED = "[redacted]"+MESSAGE_LIMIT = 500+++def redact(text: str) -> str:+    for pattern in PATTERNS:+        text = pattern.sub(REDACTED, text)+    return text+++def clean_message(text: str, limit: int = MESSAGE_LIMIT) -> str:+    """Redact, then cap at ``limit`` characters with a trailing ellipsis."""+    text = redact(text)+    if len(text) > limit:+        return text[:limit - 1] + "…"+    return text

diff --git a/scripts/review_html/render.py b/scripts/review_html/render.pynew file mode 100644index 0000000..b7a2dd6--- /dev/null+++ b/scripts/review_html/render.py@@ -0,0 +1,145 @@+"""Page orchestration: turn a review JSON document into the final HTML."""+from __future__ import annotations++import sys+from datetime import datetime, timezone+from pathlib import Path++from .common import escape+from .css import CSS+from .diagram import render_diagram+from .diffs import load_fragments+from .inputs import read_json+from .junit import OUTCOMES+from .sections import (+    build_toc,+    render_at_a_glance,+    render_commits,+    render_decisions,+    render_double_check,+    render_explanation,+    render_files,+    render_findings_summary_card,+    render_findings_table,+    render_important_changes,+    render_important_links,+    render_metrics,+    render_pr_description,+    render_publish_metadata,+    render_unresolved_comments,+    render_verdict_card,+)+from .template import PAGE_TEMPLATE+from .tests_section import TestsResult, build_tests+from .warnings import Warnings+++def build_diagram(data: dict, diff_dir: Path | None, warnings: Warnings) -> str:+    """Section HTML for ``diagram_file``, or ``""``.++    A docs-only change suppresses the section silently; an absent, unreadable,+    or invalid description warns (naming the file) and omits it.+    """+    if data.get("change_classification") == "docs-only":+        return ""+    name = data.get("diagram_file")+    if not name:+        return ""+    if diff_dir is None:+        warnings.add(f"{name}: diagram_file given but no diff directory to read it from")+        return ""+    desc = read_json(diff_dir / name, warnings, "diagram description")+    if desc is None:+        return ""+    return render_diagram(desc, warnings)+++def render(data: dict, diff_dir: Path | None) -> str:+    warnings = Warnings()+    repo = data.get("repo", {})+    repo_name = escape(repo.get("name", "(repo)"))+    repo_path = escape(repo.get("path", ""))++    title = data.get("title") or f"Pre-push review: {repo.get('name', '')}"++    important_changes = data.get("important_changes", [])+    findings = data.get("findings", [])+    files = data.get("files", [])++    # Fragments are read once; the Tests section and the per-file diff blocks+    # both consume this dict. The Tests section supplies the uncovered line+    # marks the diff blocks draw, so it is built first.+    fragments = load_fragments(files, diff_dir, warnings)+    tests: TestsResult | None = None+    if data.get("tests") is not None and data.get("change_classification") != "docs-only":+        tests = build_tests(data["tests"], files, fragments, diff_dir, warnings)+    uncovered = tests.uncovered if tests else {}++    sections = {+        "pr-description": render_pr_description(data.get("pr_description", {})),+        "commits": render_commits(data.get("commits", [])),+        "explanation": render_explanation(data.get("explanation", {})),+        "important-changes": render_important_changes(important_changes),+        "decisions": render_decisions(data.get("decisions", [])),+        "findings": render_findings_table(findings),+        "tests": tests.section_html if tests else "",+        "unresolved-comments": render_unresolved_comments(data.get("unresolved_comments", [])),+        "diagram": build_diagram(data, diff_dir, warnings),+        "diffs": render_files(files, fragments, uncovered),+        "double-check": render_double_check(data.get("double_check", [])),+    }++    toc_labels = {+        "pr-description": "Author's description",+        "commits": "Commits",+        "explanation": "Three-level explanation",+        "important-changes": "Important changes (detailed)",+        "decisions": "Key decisions",+        "findings": "Review findings",+        "tests": "Tests",+        "unresolved-comments": "Unresolved comments",+        "diagram": "Blast radius",+        "diffs": "Per-file diffs",+        "double-check": "Things to double-check",+    }+    toc_entries = [(sid, toc_labels[sid]) for sid in sections if sections[sid]]++    timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")++    page = PAGE_TEMPLATE.substitute(+        title_plain=escape(title),+        title_html=escape(title),+        css=CSS,+        publish_metadata=render_publish_metadata(data.get("publish_metadata", {})),+        repo_name=repo_name,+        repo_path=repo_path,+        subtitle=data.get("subtitle", ""),+        metrics_chips=render_metrics(data.get("metrics", [])),+        at_a_glance=render_at_a_glance(data.get("at_a_glance", [])),+        important_links=render_important_links(important_changes),+        verdict_card=render_verdict_card(data.get("verdict", {})),+        findings_summary=render_findings_summary_card(findings),+        tests_card=tests.card_html if tests else "",+        toc=build_toc(toc_entries),+        pr_description_section=sections["pr-description"],+        commits_section=sections["commits"],+        explanation_section=sections["explanation"],+        important_changes_section=sections["important-changes"],+        decisions_section=sections["decisions"],+        findings_section=sections["findings"],+        tests_section=sections["tests"],+        unresolved_comments_section=sections["unresolved-comments"],+        diagram_section=sections["diagram"],+        files_section=sections["diffs"],+        double_check_section=sections["double-check"],+        timestamp=timestamp,+    )++    # The skill greps these two lines to apply the severity floor; they must+    # be the last thing on stderr, after every warning.+    if tests:+        c = tests.counts+        print(f"summary coverage: matched={c['matched']} unmatched={c['unmatched']}", file=sys.stderr)+        tallies = " ".join(f"{o}={c[o]}" for o in OUTCOMES + ("flaky",))+        print(f"summary tests: {tallies}", file=sys.stderr)+    return page

diff --git a/scripts/review_html/sections.py b/scripts/review_html/sections.pynew file mode 100644index 0000000..6408013--- /dev/null+++ b/scripts/review_html/sections.py@@ -0,0 +1,396 @@+"""Section renderers for the review page.++Each function takes the relevant slice of the review JSON and returns+HTML, or an empty string when the section has nothing to show."""+from __future__ import annotations++import json+import textwrap++from .common import escape, file_anchor, severity_pill+from .diffs import render_diff+++# --- section renderers -----------------------------------------------------++def render_metrics(metrics: list[dict]) -> str:+    return "\n".join(+        f'<span class="chip">{escape(m.get("label"))} '+        f'<strong>{escape(m.get("value"))}</strong></span>'+        for m in metrics+    )+++def render_at_a_glance(items: list[str]) -> str:+    if not items:+        return ""+    bullets = "\n".join(f"<li>{item}</li>" for item in items)+    return f"""<div class="card">+      <h3>At a glance</h3>+      <ul>{bullets}</ul>+    </div>"""+++def render_important_links(changes: list[dict]) -> str:+    if not changes:+        return ""+    bullets = "".join(+        f'<li><span class="tag">key</span>'+        f'<a href="#change-{i}">{escape(c.get("title"))}</a></li>'+        for i, c in enumerate(changes)+    )+    return f"""<div class="card">+      <h3>Important changes</h3>+      <ul>{bullets}</ul>+    </div>"""+++def render_verdict_card(verdict: dict) -> str:+    if not verdict:+        return ""+    tone = verdict.get("tone", "success")+    if tone not in ("success", "warning", "error"):+        tone = "success"+    return f"""<div class="card">+      <h3>Verdict</h3>+      <p><span class="verdict-pill verdict-{tone}">{escape(verdict.get("label"))}</span></p>+      <p class="muted">{verdict.get("detail", "")}</p>+    </div>"""+++def render_findings_summary_card(findings: list[dict]) -> str:+    if not findings:+        return ""+    raised = len(findings)+    fixed = sum(1 for f in findings if f.get("status", "fixed") == "fixed")+    skipped = raised - fixed+    return f"""<div class="card">+      <h3>Review findings</h3>+      <p>{raised} raised · {fixed} fixed · {skipped} skipped</p>+      <p><a href="#findings">Jump to findings →</a></p>+    </div>"""+++def render_pr_description(pr: dict) -> str:+    """Render the PR author's body verbatim.++    The body is HTML-escaped and dropped into a <pre> with pre-wrap so the+    author's original text and line breaks survive unchanged. Markdown stays+    visible as markdown — no parser is applied because the point is to show+    motivation as the author wrote it, not the reviewer's interpretation.+    """+    if not pr or not pr.get("body"):+        return ""+    meta_parts = []+    if pr.get("author"):+        if pr.get("url"):+            meta_parts.append(+                f'<a href="{escape(pr["url"])}">{escape(pr["author"])}</a>'+            )+        else:+            meta_parts.append(escape(pr["author"]))+    if pr.get("created_at"):+        meta_parts.append(escape(pr["created_at"]))+    meta_line = " · ".join(meta_parts)+    meta_html = (+        f'<div class="meta">{meta_line}</div>' if meta_line else ""+    )+    return f"""<section id="pr-description">+    <h2>Author's PR description</h2>+    <p class="muted">Shown verbatim — the markdown the author wrote, unmodified.</p>+    <div class="pr-description">+      {meta_html}+      <pre>{escape(pr["body"])}</pre>+    </div>+    </section>"""+++def render_commits(items: list[dict]) -> str:+    if not items:+        return ""+    rows = []+    for c in items:+        sha = escape(c.get("sha"))+        subj = escape(c.get("subject"))+        meta = c.get("meta")+        if meta is not None:+            meta_html = escape(meta)+        else:+            meta_html = f'{escape(c.get("author"))} · {escape(c.get("date"))}'+        rows.append(+            f'<li><code class="commit-sha">{sha}</code> '+            f'<span class="commit-subj">{subj}</span> '+            f'<span class="commit-meta">— {meta_html}</span></li>'+        )+    return f"""<section id="commits">+    <h2>Commits</h2>+    <ul class="commit-list">{"".join(rows)}</ul>+    </section>"""+++def render_explanation(panels: dict) -> str:+    if not panels:+        return ""+    order = [("beginner", "Beginner"),+             ("intermediate", "Intermediate"),+             ("expert", "Expert")]+    levels = [(key, label, panels[key]) for key, label in order if panels.get(key)]+    if not levels:+        return ""+    radios = "\n".join(+        f'<input type="radio" name="tabs" id="tab-{key}"'+        f'{" checked" if i == 0 else ""}>'+        for i, (key, _, _) in enumerate(levels)+    )+    labels = "\n".join(+        f'<label for="tab-{key}">{escape(label)}</label>'+        for key, label, _ in levels+    )+    panels_html = "\n".join(+        f'<div id="panel-{key}" class="tab-panel">{content}</div>'+        for key, _, content in levels+    )+    return f"""<section id="explanation">+    <h2>Three-level explanation</h2>+    <div class="tabs">+      {radios}+      <div class="tab-labels">{labels}</div>+      <div class="tab-panels">{panels_html}</div>+    </div>+    </section>"""+++def render_important_changes(changes: list[dict]) -> str:+    if not changes:+        return ""+    cards = []+    for i, c in enumerate(changes):+        file_path = c.get("file", "")+        anchor = file_anchor(file_path) if file_path else ""+        what_text = escape(c.get("what"))+        what_block = (+            f'<p><strong>What to look at.</strong> '+            f'<a href="#{anchor}">{what_text}</a></p>'+            if anchor and what_text+            else (f'<p><strong>What to look at.</strong> {what_text}</p>' if what_text else "")+        )+        takeaway = c.get("takeaway")+        takeaway_block = (+            f'<div class="callout callout-takeaway">'+            f'<strong>Takeaway.</strong> {escape(takeaway)}</div>'+            if takeaway else ""+        )+        if c.get("rationale_unknown"):+            rationale_block = (+                '<div class="callout callout-warning">'+                '<strong>Open question.</strong> Rationale not stated by the author '+                'and not inferable from the diff.</div>'+            )+        elif c.get("rationale"):+            rationale_html = escape(c["rationale"])+            if c.get("rationale_inferred"):+                rationale_html += (+                    ' <span class="muted">(inferred — not stated by the author)</span>'+                )+            rationale_block = (+                '<div class="callout callout-rationale">'+                f'<strong>Rationale.</strong> {rationale_html}</div>'+            )+        else:+            rationale_block = ""+        cards.append(textwrap.dedent(f"""\+            <div class="change-card" id="change-{i}">+              <h3>{escape(c.get("title"))}</h3>+              <p class="muted">{escape(file_path)}</p>+              <p><strong>Why it matters.</strong> {escape(c.get("why"))}</p>+              {what_block}+              {takeaway_block}+              {rationale_block}+            </div>"""))+    return f"""<section id="important-changes">+    <h2>Important changes — detailed</h2>+    {"".join(cards)}+    </section>"""+++def render_decisions(items: list[dict]) -> str:+    if not items:+        return ""+    callouts = []+    for d in items:+        body = d.get("body", "")+        if d.get("inferred"):+            body = body + ' <span class="muted">(inferred — not stated by the author.)</span>'+        callouts.append(+            '<div class="callout callout-rationale">'+            f'<strong>{escape(d.get("title"))}</strong> {body}</div>'+        )+    return f"""<section id="decisions">+    <h2>Key decisions</h2>+    {"".join(callouts)}+    </section>"""+++def render_findings_table(findings: list[dict]) -> str:+    if not findings:+        return ""+    rows = []+    for f in findings:+        rows.append(+            "<tr>"+            f'<td>{severity_pill(f.get("severity", "nit"))}</td>'+            f'<td>{escape(f.get("area"))}</td>'+            f'<td>{escape(f.get("finding"))}</td>'+            f'<td>{escape(f.get("resolution"))}</td>'+            "</tr>"+        )+    return f"""<section id="findings">+    <h2>Review findings</h2>+    <table class="findings">+      <thead><tr><th>Severity</th><th>Area</th><th>Finding</th><th>Resolution</th></tr></thead>+      <tbody>{"".join(rows)}</tbody>+    </table>+    </section>"""+++def render_unresolved_comments(items: list[dict]) -> str:+    if not items:+        return ""++    type_labels = {"code": "code", "review": "review", "discussion": "discussion"}++    cards = []+    for c in items:+        ctype = (c.get("type") or "discussion").lower()+        label = type_labels.get(ctype, ctype)+        author = c.get("author") or "(unknown)"+        url = c.get("url")+        created = c.get("created_at")+        path = c.get("path")+        line = c.get("line")++        location_bits = []+        if path:+            loc = escape(path)+            if line:+                loc += f":{escape(line)}"+            location_bits.append(f'<code>{loc}</code>')+        if created:+            location_bits.append(f'<span class="muted">{escape(created)}</span>')+        if url:+            location_bits.append(+                f'<a href="{escape(url)}" target="_blank" rel="noopener">view on GitHub</a>'+            )+        location_line = " · ".join(location_bits)++        body = escape(c.get("body") or "").replace("\n", "<br>")++        replies_html = ""+        replies = c.get("replies") or []+        if replies:+            reply_blocks = []+            for r in replies:+                r_author = escape(r.get("author") or "(unknown)")+                r_created = r.get("created_at")+                header_bits = [f'<strong>{r_author}</strong>']+                if r_created:+                    header_bits.append(f'<span class="muted">{escape(r_created)}</span>')+                r_body = escape(r.get("body") or "").replace("\n", "<br>")+                reply_blocks.append(+                    '<div class="reply">'+                    f'<div class="reply-header">{" · ".join(header_bits)}</div>'+                    f'<div class="reply-body">{r_body}</div>'+                    '</div>'+                )+            replies_html = (+                '<details class="replies">'+                f'<summary>{len(replies)} earlier repl'+                f'{"y" if len(replies) == 1 else "ies"}</summary>'+                f'{"".join(reply_blocks)}'+                '</details>'+            )++        cards.append(+            '<div class="unresolved-comment">'+            '<div class="unresolved-header">'+            f'<span class="pill pill-warning">{escape(label)}</span> '+            f'<strong>{escape(author)}</strong>'+            f'{" · " + location_line if location_line else ""}'+            '</div>'+            f'<div class="unresolved-body">{body}</div>'+            f'{replies_html}'+            '</div>'+        )++    return f"""<section id="unresolved-comments">+    <h2>Unresolved comments</h2>+    <p class="muted">Open review threads and PR-level comments still awaiting a response.</p>+    {"".join(cards)}+    </section>"""+++def render_double_check(items: list[dict]) -> str:+    if not items:+        return ""+    callouts = "".join(+        '<div class="callout callout-warning">'+        f'<strong>{escape(d.get("title"))}</strong> {d.get("body", "")}</div>'+        for d in items+    )+    return f"""<section id="double-check">+    <h2>Things to double-check</h2>+    {callouts}+    </section>"""+++def render_files(files: list[dict], fragments: dict[str, str],+                 uncovered: dict[str, set[int]]) -> str:+    """Per-file diff blocks.++    ``fragments`` comes from ``diffs.load_fragments``; ``uncovered`` maps a+    path to the new-file line numbers that have coverage data and zero hits.+    """+    if not files:+        return ""+    blocks = []+    for f in files:+        path = f.get("path", "")+        badge = f.get("badge", "Modified")+        stat = f.get("stat", "")+        diff = fragments.get(path, "(no diff provided)")+        anchor = file_anchor(path)+        badge_class = "badge-" + "".join(ch for ch in badge.lower() if ch.isalnum())+        blocks.append(textwrap.dedent(f"""\+            <details id="{anchor}" class="file-diff">+              <summary><span class="file-path">{escape(path)}</span> <span class="badge {badge_class}">{escape(badge)}</span> <span class="line-stat">{escape(stat)}</span></summary>+              <pre><code class="diff-block">{render_diff(diff, uncovered.get(path))}</code></pre>+            </details>"""))+    return f"""<section id="diffs">+    <h2>Per-file diffs</h2>+    <p class="muted">Click to expand.</p>+    {"".join(blocks)}+    </section>"""+++def render_publish_metadata(meta: dict) -> str:+    """Emit a <script id="review-meta"> block consumable by `pulsar publish`.++    See pulsar's docs/agent-contract.md. Fields are passed through verbatim,+    minus a `</` escape inside the JSON to prevent premature </script> closure.+    """+    if not meta:+        return ""+    payload = json.dumps(meta, indent=2, ensure_ascii=False).replace("</", "<\\/")+    return (+        f'<script type="application/json" id="review-meta">\n{payload}\n</script>'+    )+++def build_toc(entries: list[tuple[str, str]]) -> str:+    if not entries:+        return ""+    items = "\n".join(+        f'<li><a href="#{sid}">{escape(label)}</a></li>'+        for sid, label in entries+    )+    return f'<nav class="toc"><ul>{items}</ul></nav>'

diff --git a/scripts/review_html/template.py b/scripts/review_html/template.pynew file mode 100644index 0000000..c27e551--- /dev/null+++ b/scripts/review_html/template.py@@ -0,0 +1,56 @@+"""Top-level page template.++Every placeholder is a substituted value; the stylesheet comes from+``css.CSS`` through the ``$css`` placeholder."""+from __future__ import annotations++from string import Template++PAGE_TEMPLATE = Template("""<!doctype html>+<html lang="en">+<head>+<meta charset="utf-8">+<title>$title_plain</title>+<meta name="viewport" content="width=device-width, initial-scale=1">+$publish_metadata+<style>$css</style>+</head>+<body>+<header class="top-bar">+  <div class="top-stripe"></div>+  <div class="top-content">+    <span class="repo-title">$repo_name</span>+    $metrics_chips+  </div>+</header>++<div class="page">+  <h1>$title_html</h1>+  <p class="muted">$subtitle</p>++  <section class="card-grid">+    $at_a_glance+    $important_links+    $verdict_card+    $findings_summary$tests_card+  </section>++  $toc++  $pr_description_section+  $commits_section+  $explanation_section+  $important_changes_section+  $decisions_section+  $findings_section$tests_section+  $unresolved_comments_section$diagram_section+  $files_section+  $double_check_section++  <footer>+    Generated $timestamp · repo <code>$repo_path</code> · regenerate with <code>/pre-push-review</code>.+  </footer>+</div>+</body>+</html>+""")

diff --git a/scripts/review_html/tests_section.py b/scripts/review_html/tests_section.pynew file mode 100644index 0000000..b61d787--- /dev/null+++ b/scripts/review_html/tests_section.py@@ -0,0 +1,414 @@+"""Tests card and Tests section built from the review JSON ``tests`` block.++``build_tests`` parses the JUnit and coverage inputs, matches coverage to+the changed files, and returns the card, the section, the uncovered line+sets for the per-file diffs, and the counts behind the ``summary`` lines.+"""+from __future__ import annotations++from dataclasses import dataclass, field+from pathlib import Path++from .common import escape, file_anchor+from .coverage import Coverage, apply_path_map, diff_coverage, match, overall, parse_coverage+from .diffs import added_lines, is_binary+from .inputs import read_json+from .junit import OUTCOMES, Case, parse_junit+from .redact import clean_message+from .warnings import Warnings++UPLOAD_STATES = ("no run", "artifacts absent", "artifacts expired")+UPLOAD_SENTENCE = (+    "To enable this section, the workflow must upload a JUnit XML file as an artifact, "+    "and a coverage file in a supported format (lcov, Cobertura XML, or Go coverprofile) "+    "to enable coverage."+)+REASON_TEXT = {+    "no tests found": "No tests were found.",+    "runner not detected": "The test runner could not be detected.",+    "required tool missing": "A required tool is missing.",+    "local run failed": "The local test run failed before writing results.",+    "local run timed out": "The local test run timed out before writing results.",+}+OUTCOME_TEXT = {"passed": "passed", "failed": "failed", "timed_out": "timed out", "not_run": "not run"}+SCOPE_TEXT = {"repository": "every test in the repository",+              "project-configured": "as the project configures it"}+DASH = "—"+++@dataclass+class TestsResult:+    card_html: str+    section_html: str+    uncovered: dict[str, set[int]] = field(default_factory=dict)+    counts: dict[str, int] = field(default_factory=dict)+++# --- small formatting helpers ---------------------------------------------++def _pct(num: int, den: int) -> str:+    return f"{round(100 * num / den)}%"+++def _pct1(num: int, den: int) -> str:+    return f"{100 * num / den:.1f}%"+++def _plural(n: int, word: str) -> str:+    return f"{n} {word}{'' if n == 1 else 's'}"+++def _source_label(source: str | None) -> str:+    return "CI" if source == "ci" else "a local run"+++def _link(url: object, text: str) -> str:+    return f'<a href="{escape(url)}">{text}</a>' if url else text+++def _tally(cases: list[Case]) -> dict[str, int]:+    counts = dict.fromkeys(OUTCOMES + ("flaky",), 0)+    for c in cases:+        counts[c.outcome] = counts.get(c.outcome, 0) + 1+        if c.flaky:+            counts["flaky"] += 1+    return counts+++def _list(items: list[str]) -> str:+    return "<ul>" + "".join(f"<li>{item}</li>" for item in items) + "</ul>"+++def _table(headers: list[str], rows: list[str]) -> str:+    head = "".join(f"<th>{h}</th>" for h in headers)+    return (f'<table class="tests"><thead><tr>{head}</tr></thead>'+            f'<tbody>{"".join(rows)}</tbody></table>')+++# --- section parts ------------------------------------------------------------++def _provenance(block: dict) -> str:+    prov = block.get("provenance") or {}+    source = prov.get("source")+    bits = []+    if source == "ci":+        bits.append("Source: <strong>CI</strong>")+        ids = prov.get("run_ids") or []+        urls = prov.get("run_urls") or []+        runs = [_link(urls[i] if i < len(urls) else None, f"run {escape(rid)}")+                for i, rid in enumerate(ids)]+        if runs:+            bits.append(", ".join(runs))+    else:+        text = "Source: <strong>local run</strong>"+        if prov.get("timestamp"):+            text += f" at {escape(prov['timestamp'])}"+        bits.append(text)+    snapshot = prov.get("snapshot") or {}+    if snapshot.get("sha"):+        text = f"snapshot <code>{escape(snapshot['sha'])}</code>"+        if snapshot.get("dirty"):+            text += " (dirty working tree)"+        bits.append(text)+    if prov.get("ci_state"):+        bits.append(f"CI state: <strong>{escape(prov['ci_state'])}</strong>")+    if prov.get("fallback_state"):+        bits.append(f"Fallback: <strong>{escape(prov['fallback_state'])}</strong>")+    lines = [f'<p class="tests-provenance">{" · ".join(bits)}</p>']++    base = block.get("baseline_provenance")+    if base:+        if base.get("source") == "ci":+            text = "Baseline: CI"+            if base.get("run_id") is not None:+                text += " " + _link(base.get("run_url"), f"run {escape(base['run_id'])}")+        else:+            text = "Baseline: local run"+            if base.get("timestamp"):+                text += f" at {escape(base['timestamp'])}"+        if base.get("sha"):+            text += f" at <code>{escape(base['sha'])}</code>"+    else:+        text = "Baseline: none"+    lines.append(f'<p class="tests-provenance">{text}</p>')+    return "\n".join(lines)+++def _files_read(label: str, read: int, listed: int) -> str:+    if not listed:+        return f"{label}: none"+    if read == listed:+        return f"{label}: {_plural(listed, 'file')}"+    return f"{label}: {read} of {listed} files read"+++def _availability(block: dict, junit_read: int, coverage_read: int, baseline: bool) -> str:+    outcome = OUTCOME_TEXT.get(block.get("run_outcome"), escape(block.get("run_outcome") or "unknown"))+    execution = f"Execution: <strong>{outcome}</strong>"+    if block.get("partial"):+        execution += " (partial results)"+    junit = _files_read("JUnit", junit_read, len(block.get("junit") or []))+    cov = _files_read("Coverage", coverage_read, len(block.get("coverage") or []))+    base = "Baseline: present" if baseline else "Baseline: absent"+    return f'<p class="tests-availability">{execution} · {junit} · {cov} · {base}</p>'+++def _no_data_card(block: dict) -> str:+    reason = block.get("no_data_reason")+    prov = block.get("provenance") or {}+    ci_state = prov.get("ci_state")+    if reason == "ci" or (reason is None and prov.get("source") == "ci" and ci_state):+        text = f"No results from CI. CI state: <strong>{escape(ci_state)}</strong>."+        if prov.get("fallback_state"):+            text += f" Local fallback: <strong>{escape(prov['fallback_state'])}</strong>."+        if ci_state in UPLOAD_STATES:+            text += " " + UPLOAD_SENTENCE+    elif reason:+        text = REASON_TEXT.get(reason, escape(reason))+    else:+        text = "No test results were read from the inputs."+    return f'<div class="card tests-nodata"><h3>No test results</h3><p>{text}</p></div>'+++def _jobs_table(block: dict, cases: list[Case]) -> str:+    jobs = block.get("jobs") or []+    artifacts = block.get("artifacts") or []+    if not jobs and not artifacts:+        return ""+    by_source: dict[str, list[Case]] = {}+    for c in cases:+        by_source.setdefault(c.source, []).append(c)++    def artifact_cases(a: dict) -> list[Case]:+        return [c for name in a.get("junit") or [] for c in by_source.get(name, [])]++    def cells(tally: dict[str, int] | None) -> str:+        if tally is None:+            return "".join(f"<td>{DASH}</td>" for _ in range(4))+        return "".join(f"<td>{tally[k]}</td>" for k in ("passed", "failed", "skipped", "errored"))++    rows = []+    for job in jobs:+        attributed = [a for a in artifacts if a.get("job") == job.get("name")]+        tally = _tally([c for a in attributed for c in artifact_cases(a)]) if attributed else None+        rows.append(f"<tr><td>{_link(job.get('url'), escape(job.get('name')))}</td>"+                    f"<td>{escape(job.get('outcome') or DASH)}</td>{cells(tally)}</tr>")+    for a in artifacts:+        if a.get("job"):+            continue+        rows.append(f"<tr><td>artifact <code>{escape(a.get('name'))}</code></td><td>{DASH}</td>"+                    f"{cells(_tally(artifact_cases(a)))}</tr>")+    return "<h3>Jobs</h3>\n" + _table(["Job", "Outcome", "Passed", "Failed", "Skipped", "Errored"], rows)+++def _failed_table(block: dict, cases: list[Case]) -> str:+    failed = [c for c in cases if c.outcome in ("failed", "errored")]+    if not failed:+        return ""+    where: dict[str, str] = {}+    for a in block.get("artifacts") or []:+        label = escape(a.get("job")) if a.get("job") else f"artifact {escape(a.get('name'))}"+        for name in a.get("junit") or []:+            where.setdefault(name, label)+    rows = [f"<tr><td>{escape(c.suite)}</td><td>{escape(c.name)}</td>"+            f"<td>{where.get(c.source, DASH)}</td><td>{escape(clean_message(c.message))}</td></tr>"+            for c in failed]+    return "<h3>Failed tests</h3>\n" + _table(["Suite", "Test", "Job or artifact", "Message"], rows)+++def _new_removed(block: dict, head: list[Case], base: list[Case],+                 diff_dir: Path | None, warnings: Warnings) -> tuple[str, int | None]:+    """Section HTML and the new-test count for the card (``None`` when unknown)."""+    prov = block.get("provenance") or {}+    base_prov = block.get("baseline_provenance") or {}+    if base:+        head_ids = {(c.suite, c.name) for c in head}+        base_ids = {(c.suite, c.name) for c in base}+        new = sorted(head_ids - base_ids)+        removed = sorted(base_ids - head_ids)+        parts = ['<p class="muted">Derived by identity, from the baseline run.</p>']+        if prov.get("source") != base_prov.get("source"):+            parts.append('<p class="callout callout-warning">This comparison crosses sources: '+                         f"head from {_source_label(prov.get('source'))}, baseline from "+                         f"{_source_label(base_prov.get('source'))}. Tests that only run in one "+                         "source appear as new or removed.</p>")+        items = [f"+ <code>{escape(s)}</code> {escape(n)}" for s, n in new]+        items += [f"− <code>{escape(s)}</code> {escape(n)}" for s, n in removed]+        parts.append(_list(items) if items else '<p class="muted">No new or removed tests.</p>')+        return "<h3>New and removed tests</h3>\n" + "\n".join(parts), len(new)++    name = block.get("diff_tests_file")+    if name and diff_dir is not None:+        data = read_json(diff_dir / name, warnings, "diff-derived test list")+        if isinstance(data, dict):+            added = [str(x) for x in data.get("added") or []]+            removed = [str(x) for x in data.get("removed") or []]+            unpatterned = [str(x) for x in data.get("unpatterned_files") or []]+            parts = ['<p class="muted">Derived by declaration name, from the diff (no baseline run).</p>']+            items = [f"+ {escape(n)}" for n in added]+            items += [f"− {escape(n)}" for n in removed]+            parts.append(_list(items) if items else '<p class="muted">No new or removed test declarations.</p>')+            if unpatterned:+                files = ", ".join(f"<code>{escape(f)}</code>" for f in unpatterned)+                parts.append(f'<p class="muted">No declaration pattern applies to {files}; '+                             "those files yield nothing.</p>")+            return "<h3>New and removed tests</h3>\n" + "\n".join(parts), len(added)++    return ("<h3>New and removed tests</h3>\n"+            '<p class="muted">Not available: no baseline run and no diff-derived list.</p>'), None+++def _coverage_parts(block: dict, files: list[dict], fragments: dict[str, str],+                    cov: Coverage, base_cov: Coverage) -> tuple[str, dict[str, set[int]], dict[str, int], str]:+    """Diff-coverage table, overall coverage, and unmatched report.++    Returns the HTML, the uncovered sets, the matched/unmatched counts, and+    the card's diff-coverage value. With no coverage entries there is+    nothing to match: every part is omitted and both counts are zero.+    """+    if not cov:+        return "", {}, {"matched": 0, "unmatched": 0}, "n/a"+    eligible = [f.get("path", "") for f in files+                if f.get("badge") != "Deleted" and not is_binary(fragments.get(f.get("path", ""), ""))]+    hits, unmatched = match(cov, eligible)+    counts = {"matched": len(hits), "unmatched": len(unmatched)}+    uncovered: dict[str, set[int]] = {}+    rows = []+    total_covered = total_measurable = 0+    for path in eligible:+        added = added_lines(fragments.get(path, ""))+        result = diff_coverage(added, hits[path]) if path in hits else None+        cell = f"<td>{DASH}</td><td>no coverage data</td>"+        if result is not None:+            covered, measurable = result+            total_covered += covered+            total_measurable += measurable+            cell = f"<td>{covered}</td><td>{_pct(covered, measurable)}</td>"+            zero = {n for n in added if hits[path].get(n) == 0}+            if zero:+                uncovered[path] = zero+        rows.append(f'<tr><td><a href="#{file_anchor(path)}">{escape(path)}</a></td>'+                    f"<td>{len(added)}</td>{cell}</tr>")++    parts = ["<h3>Diff coverage</h3>"]+    if rows:+        parts.append(_table(["File", "Added lines", "Covered", "Diff coverage"], rows))+    if total_measurable:+        aggregate = _pct(total_covered, total_measurable)+        card_value = f"{aggregate} ({total_covered} of {total_measurable} added lines)"+        parts.append(f"<p>Aggregate diff coverage: <strong>{aggregate}</strong> "+                     f"({total_covered} of {total_measurable} measurable added lines).</p>")+    else:+        card_value = "n/a"+        parts.append('<p class="muted">No changed file has measurable added lines.</p>')++    covered, instrumented = overall(cov)+    if instrumented:+        text = f"Head <strong>{_pct1(covered, instrumented)}</strong> ({covered} of {instrumented} lines)"+        base_covered, base_instrumented = overall(base_cov)+        if base_instrumented:+            delta = 100 * covered / instrumented - 100 * base_covered / base_instrumented+            text += (f" · baseline <strong>{_pct1(base_covered, base_instrumented)}</strong> "+                     f"({base_covered} of {base_instrumented} lines) · delta <strong>{delta:+.1f} pp</strong>")+        parts.append(f"<h3>Overall coverage</h3>\n<p>{text}</p>")+        prov = block.get("provenance") or {}+        base_prov = block.get("baseline_provenance") or {}+        if base_instrumented and prov.get("source") != base_prov.get("source"):+            parts.append('<p class="callout callout-warning">The baseline coverage comes from a different '+                         f"source: head from {_source_label(prov.get('source'))}, baseline from "+                         f"{_source_label(base_prov.get('source'))}.</p>")++    parts.append(f'<p class="tests-matching">{len(hits)} of {len(eligible)} changed files matched coverage data.</p>')+    if unmatched:+        parts.append(_list([f"<code>{escape(p)}</code> — {escape(reason)}"+                            for p, reason in unmatched.items()]))+    return "\n".join(parts), uncovered, counts, card_value+++def _card(pass_rate: str, new_tests: str, diff_cov: str) -> str:+    return f"""<div class="card">+      <h3>Tests</h3>+      <p>Pass rate: {pass_rate}</p>+      <p>New tests: {new_tests}</p>+      <p>Diff coverage: {diff_cov}</p>+      <p><a href="#tests">Jump to tests →</a></p>+    </div>"""+++# --- entry point --------------------------------------------------------------++def build_tests(block: dict, files: list[dict], fragments: dict[str, str],+                diff_dir: Path | None, warnings: Warnings) -> TestsResult:+    def inputs(key: str) -> list[Path]:+        names = block.get(key) or []+        return [diff_dir / n for n in names] if diff_dir is not None else []++    def coverage(key: str) -> tuple[Coverage, int]:+        """Mapped entries and the number of listed files that yielded any."""+        cov: Coverage = []+        read = 0+        for path in inputs(key):+            entries = parse_coverage(path, warnings)+            read += bool(entries)+            cov.extend(entries)+        path_map = block.get("path_map") or {}+        return apply_path_map(cov, path_map.get("strip"), path_map.get("prepend")), read++    head = parse_junit(inputs("junit"), warnings)+    base = parse_junit(inputs("baseline_junit"), warnings)+    cov, coverage_read = coverage("coverage")+    base_cov, _ = coverage("baseline_coverage")++    tally = _tally(head)+    denominator = tally["passed"] + tally["failed"] + tally["errored"]+    pass_rate = f"{_pct(tally['passed'], denominator)} ({tally['passed']} of {denominator})" if denominator else "n/a"++    parts = ['<section id="tests">', "<h2>Tests</h2>", _provenance(block),+             _availability(block, len({c.source for c in head}), coverage_read,+                           bool(base) or bool(base_cov))]+    scope = block.get("coverage_scope")+    if scope:+        parts.append(f'<p class="muted">Coverage scope: {SCOPE_TEXT.get(scope, escape(scope))}</p>')+    if not head:+        parts.append(_no_data_card(block))+    else:+        parts.append(f'<p class="tests-totals">Totals: <strong>{tally["passed"]} passed</strong> · '+                     f'{tally["failed"]} failed · {tally["skipped"]} skipped · '+                     f'{tally["errored"]} errored · {tally["flaky"]} flaky</p>')+    pending = block.get("pending_runs") or []+    if pending:+        parts.append("<h3>Pending runs</h3>\n" + _list([+            f"{_link(r.get('url'), escape(r.get('name')))} (run {escape(r.get('run_id'))}, {escape(r.get('status'))})"+            for r in pending]))+    parts.append(_jobs_table(block, head))+    parts.append(_failed_table(block, head))++    new_removed_html, new_count = _new_removed(block, head, base, diff_dir, warnings)+    parts.append(new_removed_html)++    coverage_html, uncovered, match_counts, diff_cov_value = _coverage_parts(+        block, files, fragments, cov, base_cov)+    parts.append(coverage_html)++    touched = block.get("run_touched_files") or []+    if touched:+        parts.append("<h3>Files touched by the run</h3>\n"+                     '<p class="callout callout-warning">The test run changed these tracked files; '+                     "they were restored afterwards.</p>\n"+                     + _list([f"<code>{escape(p)}</code>" for p in touched]))+    skipped = block.get("skipped_artifacts") or []+    if skipped:+        parts.append("<h3>Skipped artifacts</h3>\n" + _list([+            f"<code>{escape(a.get('name'))}</code> ({escape(a.get('size_in_bytes'))} bytes)" for a in skipped]))+    if warnings.items:+        parts.append("<h3>Warnings</h3>\n" + _list([escape(w) for w in warnings.items]))+    parts.append("</section>")++    counts = dict(tally)+    counts.update(match_counts)+    return TestsResult(+        card_html=_card(pass_rate, "n/a" if new_count is None else str(new_count), diff_cov_value),+        section_html="\n".join(p for p in parts if p),+        uncovered=uncovered,+        counts=counts,+    )

diff --git a/scripts/review_html/warnings.py b/scripts/review_html/warnings.pynew file mode 100644index 0000000..f74ac76--- /dev/null+++ b/scripts/review_html/warnings.py@@ -0,0 +1,18 @@+"""Warning collector threaded through parsing and rendering.++Each warning is printed to stderr the moment it is added, so a crash later+in the run still leaves the earlier warnings visible, and the full list is+available afterwards for the page.+"""+from __future__ import annotations++import sys+++class Warnings:+    def __init__(self) -> None:+        self.items: list[str] = []++    def add(self, message: str) -> None:+        self.items.append(message)+        print(f"warning: {message}", file=sys.stderr)

diff --git a/scripts/tests/__init__.py b/scripts/tests/__init__.pynew file mode 100644index 0000000..e69de29

diff --git a/scripts/tests/fixtures/golden-settings.diff b/scripts/tests/fixtures/golden-settings.diffnew file mode 100644index 0000000..7a9e2b3--- /dev/null+++ b/scripts/tests/fixtures/golden-settings.diff@@ -0,0 +1,8 @@+diff --git a/config/$settings.toml b/config/$settings.toml+--- a/config/$settings.toml++++ b/config/$settings.toml+@@ -1,3 +1,3 @@+ [widgets]+-widget_dir = "widgets"++dir = "widgets"+ context <tail> & more

diff --git a/scripts/tests/fixtures/golden.html b/scripts/tests/fixtures/golden.htmlnew file mode 100644index 0000000..508014c--- /dev/null+++ b/scripts/tests/fixtures/golden.html@@ -0,0 +1,503 @@+<!doctype html>+<html lang="en">+<head>+<meta charset="utf-8">+<title>PR review: acme/widgets #42 &lt;golden&gt;</title>+<meta name="viewport" content="width=device-width, initial-scale=1">+<script type="application/json" id="review-meta">+{+  "title": "PR review: acme/widgets #42",+  "repoUrl": "https://github.com/acme/widgets",+  "pr": 42,+  "severity": "needs-changes",+  "summary": "Registry lands; one major test gap skipped. Contains <\/script> to exercise escaping."+}+</script>+<style>+:root {+  --bg: #0B1020;+  --bg-deep: #050C1B;+  --surface-1: #101A33;+  --surface-2: #142042;+  --border: #26324F;+  --border-subtle: #1F2A45;+  --text-primary: #EAF1FF;+  --text-secondary: #B7C3E3;+  --text-tertiary: #7F8BB0;+  --accent: #44C4DC;+  --accent-2: #E474E4;+  --accent-3: #4C6CBC;+  --code-bg: #0A1226;+  --code-border: #1F2A45;+  --success: #22C55E;+  --warning: #FBBF24;+  --error: #EF476F;+  --diff-add-bg: rgba(34, 197, 94, 0.12);+  --diff-add-fg: #86EFAC;+  --diff-del-bg: rgba(239, 71, 111, 0.12);+  --diff-del-fg: #FCA5A5;+}++* { box-sizing: border-box; }+html { background: var(--bg); }+body {+  background: var(--bg);+  color: var(--text-primary);+  font-family: -apple-system, "SF Pro Text", system-ui, sans-serif;+  line-height: 1.6;+  margin: 0;+  padding: 0;+}++.page { max-width: 1100px; margin: 0 auto; padding: 32px; }++header.top-bar {+  position: sticky; top: 0; z-index: 10;+  background: var(--bg-deep);+  border-bottom: 1px solid var(--border-subtle);+}+.top-stripe { height: 4px; background: linear-gradient(135deg, var(--accent-3), var(--accent-2)); }+.top-content {+  display: flex; gap: 16px; flex-wrap: wrap; align-items: center;+  padding: 14px 32px; max-width: 1100px; margin: 0 auto;+}+.top-content .repo-title { font-weight: 600; font-size: 15px; color: var(--text-primary); }++.chip {+  display: inline-flex; align-items: center; gap: 6px;+  background: var(--surface-1); border: 1px solid var(--border-subtle);+  border-radius: 999px; padding: 4px 12px; font-size: 12px; color: var(--text-secondary);+}+.chip strong { color: var(--text-primary); }++h1, h2, h3 { color: var(--text-primary); line-height: 1.3; }+h1 { font-size: 30px; margin: 8px 0 4px; }+h2 { font-size: 22px; margin: 32px 0 12px; padding-top: 12px; border-top: 1px solid var(--border-subtle); }+h3 { font-size: 17px; margin: 16px 0 8px; }++p { color: var(--text-secondary); }+strong { color: var(--text-primary); }+a { color: var(--accent); text-decoration: none; }+a:hover { text-decoration: underline; }+.muted { color: var(--text-tertiary); }+code { font-family: ui-monospace, "SF Mono", Menlo, monospace; }++.card-grid {+  display: grid; grid-template-columns: repeat(2, 1fr); gap: 16px;+  margin: 24px 0 32px;+}++.card {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 20px;+  transition: background-color 120ms ease;+}+.card:hover { background: var(--surface-2); }+.card h3 {+  margin-top: 0; font-size: 14px;+  text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-tertiary);+}+.card ul { margin: 8px 0 0; padding-left: 20px; }+.card li { margin: 4px 0; color: var(--text-secondary); }++.tag {+  display: inline-block;+  background: rgba(228, 116, 228, 0.15);+  color: var(--accent-2);+  border-radius: 4px;+  padding: 0 6px;+  font-size: 11px;+  font-weight: 600;+  text-transform: uppercase;+  margin-right: 6px;+}++.verdict-pill {+  display: inline-flex; align-items: center; gap: 8px;+  padding: 10px 18px; border-radius: 999px;+  font-weight: 600; font-size: 14px;+  text-transform: uppercase; letter-spacing: 0.05em;+}+.verdict-success { background: rgba(34, 197, 94, 0.18); color: var(--success); border: 1px solid rgba(34,197,94,0.35); }+.verdict-warning { background: rgba(251, 191, 36, 0.15); color: var(--warning); border: 1px solid rgba(251,191,36,0.35); }+.verdict-error   { background: rgba(239, 71, 111, 0.15); color: var(--error);   border: 1px solid rgba(239,71,111,0.35); }++.toc {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 16px 20px; margin: 0 0 24px;+}+.toc ul { list-style: none; padding-left: 0; margin: 0; column-count: 2; column-gap: 24px; }+.toc li { margin: 4px 0; }+.toc a { color: var(--text-secondary); }+.toc a:hover { color: var(--accent); }++.tabs {+  margin: 16px 0; border: 1px solid var(--border);+  border-radius: 16px; background: var(--surface-1);+}+.tabs input[type="radio"] { display: none; }+.tab-labels { display: flex; border-bottom: 1px solid var(--border-subtle); }+.tab-labels label {+  padding: 12px 20px; cursor: pointer; color: var(--text-tertiary);+  font-weight: 600; font-size: 13px;+  text-transform: uppercase; letter-spacing: 0.06em;+  border-bottom: 2px solid transparent; margin-bottom: -1px;+}+.tab-labels label:hover { color: var(--text-secondary); }++#tab-beginner:checked ~ .tab-labels label[for="tab-beginner"],+#tab-intermediate:checked ~ .tab-labels label[for="tab-intermediate"],+#tab-expert:checked ~ .tab-labels label[for="tab-expert"] {+  color: var(--accent);+  border-bottom-color: var(--accent);+}++.tab-panels { padding: 20px; }+.tab-panel { display: none; }+#tab-beginner:checked ~ .tab-panels #panel-beginner,+#tab-intermediate:checked ~ .tab-panels #panel-intermediate,+#tab-expert:checked ~ .tab-panels #panel-expert {+  display: block;+}++.change-card {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 16px; padding: 20px; margin: 16px 0;+  transition: background-color 120ms ease;+}+.change-card:hover { background: var(--surface-2); }++.callout {+  margin: 12px 0; padding: 10px 14px;+  background: var(--bg-deep);+  border-radius: 6px; font-size: 14px; color: var(--text-secondary);+}+.callout-takeaway  { border-left: 3px solid var(--accent-2); }+.callout-rationale { border-left: 3px solid var(--accent); }+.callout-warning   { border-left: 3px solid var(--warning); }++table.findings {+  width: 100%; border-collapse: collapse;+  margin: 16px 0; background: var(--surface-1);+  border: 1px solid var(--border); border-radius: 12px; overflow: hidden;+}+table.findings th, table.findings td {+  padding: 10px 14px; text-align: left;+  border-bottom: 1px solid var(--border-subtle);+  font-size: 14px; vertical-align: top;+}+table.findings th {+  background: var(--surface-2); color: var(--text-secondary);+  text-transform: uppercase; font-size: 11px; letter-spacing: 0.08em;+}+table.findings tr:last-child td { border-bottom: none; }++.pill {+  display: inline-block; padding: 2px 10px; border-radius: 999px;+  font-size: 11px; font-weight: 600;+  text-transform: uppercase; letter-spacing: 0.06em;+}+.pill-error    { background: rgba(239,71,111,0.18); color: var(--error); }+.pill-warning  { background: rgba(251,191,36,0.18); color: var(--warning); }+.pill-success  { background: rgba(34,197,94,0.18); color: var(--success); }+.pill-tertiary { background: rgba(127,139,176,0.18); color: var(--text-tertiary); }++.unresolved-comment {+  background: var(--surface-1); border: 1px solid var(--border);+  border-left: 3px solid var(--warning);+  border-radius: 10px; padding: 14px 16px; margin: 12px 0;+}+.unresolved-header {+  display: flex; flex-wrap: wrap; gap: 8px; align-items: center;+  font-size: 13px; color: var(--text-secondary); margin-bottom: 8px;+}+.unresolved-header code {+  background: var(--code-bg); color: var(--accent);+  padding: 1px 6px; border-radius: 4px; font-size: 12px;+}+.unresolved-body {+  color: var(--text-primary); font-size: 14px; line-height: 1.55;+  white-space: pre-wrap; word-break: break-word;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+}+.replies {+  margin-top: 10px; padding-top: 8px; border-top: 1px solid var(--border-subtle);+}+.replies > summary {+  cursor: pointer; color: var(--text-tertiary); font-size: 12px;+}+.reply { margin: 8px 0 0 12px; padding-left: 10px; border-left: 2px solid var(--border-subtle); }+.reply-header { font-size: 12px; color: var(--text-secondary); margin-bottom: 4px; }+.reply-body {+  color: var(--text-primary); font-size: 13px;+  white-space: pre-wrap; word-break: break-word;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+}++.commit-list { list-style: none; padding-left: 0; }+.commit-list li { padding: 6px 0; border-bottom: 1px solid var(--border-subtle); }+.commit-list li:last-child { border-bottom: none; }+.commit-sha {+  color: var(--accent); background: var(--code-bg);+  padding: 2px 6px; border-radius: 4px;+  font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 12px;+}+.commit-subj { color: var(--text-primary); }+.commit-meta { color: var(--text-tertiary); font-size: 13px; }++.file-diff {+  background: var(--surface-1); border: 1px solid var(--border);+  border-radius: 12px; margin: 8px 0; overflow: hidden;+}+.file-diff > summary {+  cursor: pointer; padding: 12px 16px; font-weight: 500;+  list-style: none; display: flex; gap: 12px; align-items: center;+}+.file-diff > summary::-webkit-details-marker { display: none; }+.file-diff > summary::before {+  content: "▸"; color: var(--text-tertiary); font-size: 12px; margin-right: 4px;+}+.file-diff[open] > summary::before { content: "▾"; }+.file-path { font-family: ui-monospace, "SF Mono", Menlo, monospace; color: var(--text-primary); }+.line-stat {+  color: var(--text-tertiary);+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 12px; margin-left: auto;+}++.badge {+  display: inline-block; font-size: 10px;+  text-transform: uppercase; letter-spacing: 0.06em; font-weight: 700;+  padding: 2px 8px; border-radius: 4px;+}+.badge-added    { background: rgba(34,197,94,0.18);  color: var(--success); }+.badge-modified { background: rgba(68,196,220,0.18); color: var(--accent); }+.badge-deleted  { background: rgba(239,71,111,0.18); color: var(--error); }+.badge-renamed  { background: rgba(76,108,188,0.18); color: var(--accent-3); }++.file-diff pre {+  margin: 0; background: var(--code-bg);+  border-top: 1px solid var(--code-border);+  padding: 12px 0; overflow-x: auto; line-height: 1.45;+}+.file-diff code {+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 13px; color: var(--text-secondary);+  display: inline-block; min-width: 100%;+}+.diff-line {+  display: block;+  padding: 0 16px;+  min-height: 1.45em;+}+.diff-add         { background: var(--diff-add-bg); color: var(--diff-add-fg); }+.diff-del         { background: var(--diff-del-bg); color: var(--diff-del-fg); }+.diff-hunk        { color: var(--accent); }+.diff-file-header { color: var(--text-tertiary); }+.diff-meta        { color: var(--text-tertiary); }+.diff-context     { color: var(--text-secondary); }++.pr-description {+  background: var(--surface-1);+  border: 1px solid var(--border);+  border-left: 3px solid var(--accent-2);+  border-radius: 12px;+  padding: 16px 20px;+  margin: 8px 0 16px;+}+.pr-description .meta {+  color: var(--text-tertiary);+  font-size: 12px;+  margin-bottom: 12px;+}+.pr-description pre {+  margin: 0;+  background: transparent;+  font-family: ui-monospace, "SF Mono", Menlo, monospace;+  font-size: 13px;+  line-height: 1.55;+  color: var(--text-secondary);+  white-space: pre-wrap;+  word-wrap: break-word;+}+.pr-description pre code,+.pr-description pre a { color: var(--text-primary); }++footer {+  margin-top: 64px; padding-top: 24px;+  border-top: 1px solid var(--border-subtle);+  color: var(--text-tertiary); font-size: 13px;+}++@media (max-width: 720px) {+  .card-grid { grid-template-columns: 1fr; }+  .toc ul { column-count: 1; }+  .page { padding: 16px; }+}+@media (prefers-reduced-motion: reduce) {+  * { transition: none !important; }+}+</style>+</head>+<body>+<header class="top-bar">+  <div class="top-stripe"></div>+  <div class="top-content">+    <span class="repo-title">acme/widgets</span>+    <span class="chip">Commits <strong>3</strong></span>+<span class="chip">Files <strong>6</strong></span>+<span class="chip">Lines <strong>+120 / -34</strong></span>+  </div>+</header>++<div class="page">+  <h1>PR review: acme/widgets #42 &lt;golden&gt;</h1>+  <p class="muted">Review of <strong>feature/golden</strong> against <code>main</code> &amp; friends</p>++  <section class="card-grid">+    <div class="card">+      <h3>At a glance</h3>+      <ul><li>Adds a <code>Widget</code> registry with lookup by name.</li>+<li>Removes the legacy <code>old_registry.py</code> module.</li></ul>+    </div>+    <div class="card">+      <h3>Important changes</h3>+      <ul><li><span class="tag">key</span><a href="#change-0">Registry class</a></li><li><span class="tag">key</span><a href="#change-1">Legacy module removed</a></li><li><span class="tag">key</span><a href="#change-2">Config key renamed</a></li><li><span class="tag">key</span><a href="#change-3">Docs touch-up</a></li></ul>+    </div>+    <div class="card">+      <h3>Verdict</h3>+      <p><span class="verdict-pill verdict-warning">Needs changes</span></p>+      <p class="muted">One <em>major</em> finding was skipped.</p>+    </div>+    <div class="card">+      <h3>Review findings</h3>+      <p>6 raised · 4 fixed · 2 skipped</p>+      <p><a href="#findings">Jump to findings →</a></p>+    </div>+  </section>++  <nav class="toc"><ul><li><a href="#pr-description">Author&#x27;s description</a></li>+<li><a href="#commits">Commits</a></li>+<li><a href="#explanation">Three-level explanation</a></li>+<li><a href="#important-changes">Important changes (detailed)</a></li>+<li><a href="#decisions">Key decisions</a></li>+<li><a href="#findings">Review findings</a></li>+<li><a href="#unresolved-comments">Unresolved comments</a></li>+<li><a href="#diffs">Per-file diffs</a></li>+<li><a href="#double-check">Things to double-check</a></li></ul></nav>++  <section id="pr-description">+    <h2>Author's PR description</h2>+    <p class="muted">Shown verbatim — the markdown the author wrote, unmodified.</p>+    <div class="pr-description">+      <div class="meta"><a href="https://github.com/acme/widgets/pull/42">octocat</a> · 2026-09-01T10:00:00Z</div>+      <pre>## Why++The old registry was *slow* &amp; untested.++- adds `Registry`+- removes `old_registry.py`++&lt;script&gt;alert(1)&lt;/script&gt;</pre>+    </div>+    </section>+  <section id="commits">+    <h2>Commits</h2>+    <ul class="commit-list"><li><code class="commit-sha">a1b2c3d</code> <span class="commit-subj">[feat]: Add Widget registry</span> <span class="commit-meta">— octocat · 2026-09-01</span></li><li><code class="commit-sha">e4f5a6b</code> <span class="commit-subj">[chore]: Remove old registry</span> <span class="commit-meta">— octocat · 2026-09-02 · 2 files</span></li><li><code class="commit-sha">c7d8e9f</code> <span class="commit-subj">[test]: Cover lookup &amp; duplicate &lt;names&gt;</span> <span class="commit-meta">— hubot · 2026-09-03</span></li></ul>+    </section>+  <section id="explanation">+    <h2>Three-level explanation</h2>+    <div class="tabs">+      <input type="radio" name="tabs" id="tab-beginner" checked>+<input type="radio" name="tabs" id="tab-intermediate">+<input type="radio" name="tabs" id="tab-expert">+      <div class="tab-labels"><label for="tab-beginner">Beginner</label>+<label for="tab-intermediate">Intermediate</label>+<label for="tab-expert">Expert</label></div>+      <div class="tab-panels"><div id="panel-beginner" class="tab-panel"><p>A registry is a lookup table. This change adds one for widgets.</p></div>+<div id="panel-intermediate" class="tab-panel"><p>The registry replaces module-level globals with an explicit <code>Registry</code> object.</p></div>+<div id="panel-expert" class="tab-panel"><p>Registration is idempotent; duplicate names raise <code>KeyError</code> at import time.</p></div></div>+    </div>+    </section>+  <section id="important-changes">+    <h2>Important changes — detailed</h2>+    <div class="change-card" id="change-0">+  <h3>Registry class</h3>+  <p class="muted">src/widgets/registry.py</p>+  <p><strong>Why it matters.</strong> Central lookup replaces scattered globals.</p>+  <p><strong>What to look at.</strong> <a href="#file-c08d64c2c7">The register() and lookup() methods</a></p>+  <div class="callout callout-takeaway"><strong>Takeaway.</strong> Registration order no longer matters.</div>+  <div class="callout callout-rationale"><strong>Rationale.</strong> The author says globals made testing hard.</div>+</div><div class="change-card" id="change-1">+  <h3>Legacy module removed</h3>+  <p class="muted">src/widgets/old_registry.py</p>+  <p><strong>Why it matters.</strong> Dead code after the registry landed.</p>+  <p><strong>What to look at.</strong> <a href="#file-9d982a5230">Confirm nothing else imports it</a></p>++  <div class="callout callout-rationale"><strong>Rationale.</strong> Likely to reduce maintenance surface. <span class="muted">(inferred — not stated by the author)</span></div>+</div><div class="change-card" id="change-2">+  <h3>Config key renamed</h3>+  <p class="muted">config/$settings.toml</p>+  <p><strong>Why it matters.</strong> The key name changed from widget_dir to widgets.dir.</p>+  <p><strong>What to look at.</strong> <a href="#file-d29b91093c">The [widgets] table</a></p>++  <div class="callout callout-warning"><strong>Open question.</strong> Rationale not stated by the author and not inferable from the diff.</div>+</div><div class="change-card" id="change-3">+  <h3>Docs touch-up</h3>+  <p class="muted"></p>+  <p><strong>Why it matters.</strong> README mentions the new registry.</p>++++</div>+    </section>+  <section id="decisions">+    <h2>Key decisions</h2>+    <div class="callout callout-rationale"><strong>Registry is a plain class, not a singleton.</strong> Instances can be created per test.</div><div class="callout callout-rationale"><strong>Duplicate names raise.</strong> Silently overwriting hid bugs before. <span class="muted">(inferred — not stated by the author.)</span></div>+    </section>+  <section id="findings">+    <h2>Review findings</h2>+    <table class="findings">+      <thead><tr><th>Severity</th><th>Area</th><th>Finding</th><th>Resolution</th></tr></thead>+      <tbody><tr><td><span class="pill pill-error">blocking</span></td><td>Correctness</td><td>lookup() returns None on miss but callers index the result</td><td>Raise KeyError instead</td></tr><tr><td><span class="pill pill-error">major</span></td><td>Tests</td><td>No test for duplicate registration</td><td>Left for the author</td></tr><tr><td><span class="pill pill-warning">minor</span></td><td>Style</td><td>Unused import &lt;os&gt;</td><td>Removed</td></tr><tr><td><span class="pill pill-tertiary">nit</span></td><td>Naming</td><td>reg vs registry</td><td>Renamed to registry</td></tr><tr><td><span class="pill pill-tertiary">info</span></td><td>Docs</td><td>README example uses the old API</td><td>Updated</td></tr><tr><td><span class="pill pill-tertiary">unknown-level</span></td><td>Other</td><td>Severity outside the known set</td><td>Rendered as tertiary</td></tr></tbody>+    </table>+    </section>+  <section id="unresolved-comments">+    <h2>Unresolved comments</h2>+    <p class="muted">Open review threads and PR-level comments still awaiting a response.</p>+    <div class="unresolved-comment"><div class="unresolved-header"><span class="pill pill-warning">code</span> <strong>reviewer1</strong> · <code>src/widgets/registry.py:42</code> · <span class="muted">2026-09-02T09:00:00Z</span> · <a href="https://github.com/acme/widgets/pull/42#discussion_r1" target="_blank" rel="noopener">view on GitHub</a></div><div class="unresolved-body">Should this be a `dict` or an `OrderedDict`?<br>Order might matter for &lt;listing&gt;.</div><details class="replies"><summary>2 earlier replies</summary><div class="reply"><div class="reply-header"><strong>octocat</strong> · <span class="muted">2026-09-02T09:30:00Z</span></div><div class="reply-body">dict preserves insertion order since 3.7</div></div><div class="reply"><div class="reply-header"><strong>reviewer1</strong></div><div class="reply-body">Right, but document it?</div></div></details></div><div class="unresolved-comment"><div class="unresolved-header"><span class="pill pill-warning">review</span> <strong>reviewer2</strong> · <a href="https://github.com/acme/widgets/pull/42#pullrequestreview-1" target="_blank" rel="noopener">view on GitHub</a></div><div class="unresolved-body">Please add a changelog entry.</div><details class="replies"><summary>1 earlier reply</summary><div class="reply"><div class="reply-header"><strong>octocat</strong></div><div class="reply-body">Will do.</div></div></details></div><div class="unresolved-comment"><div class="unresolved-header"><span class="pill pill-warning">discussion</span> <strong>(unknown)</strong> · <code>README.md</code></div><div class="unresolved-body">Typo in the example.</div></div><div class="unresolved-comment"><div class="unresolved-header"><span class="pill pill-warning">discussion</span> <strong>bot</strong></div><div class="unresolved-body">Automated note without a known type.</div></div>+    </section>+  <section id="diffs">+    <h2>Per-file diffs</h2>+    <p class="muted">Click to expand.</p>+    <details id="file-c08d64c2c7" class="file-diff">+  <summary><span class="file-path">src/widgets/registry.py</span> <span class="badge badge-added">Added</span> <span class="line-stat">+48 / -0</span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-context">diff --git a/src/widgets/registry.py b/src/widgets/registry.py</span><span class="diff-line diff-context">new file mode 100644</span><span class="diff-line diff-file-header">--- /dev/null</span><span class="diff-line diff-file-header">+++ b/src/widgets/registry.py</span><span class="diff-line diff-hunk">@@ -0,0 +1,6 @@</span><span class="diff-line diff-add">+class Registry:</span><span class="diff-line diff-add">+    def __init__(self) -&gt; None:</span><span class="diff-line diff-add">+        self._items: dict[str, object] = {}</span><span class="diff-line diff-add">+</span><span class="diff-line diff-add">+    def register(self, name: str, item: object) -&gt; None:</span><span class="diff-line diff-add">+        self._items[name] = item  # &lt;-- &quot;quoted&quot; &amp; escaped</span></code></pre>+</details><details id="file-9d982a5230" class="file-diff">+  <summary><span class="file-path">src/widgets/old_registry.py</span> <span class="badge badge-deleted">Deleted</span> <span class="line-stat">+0 / -12</span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-file-header">--- a/src/widgets/old_registry.py</span><span class="diff-line diff-file-header">+++ /dev/null</span><span class="diff-line diff-hunk">@@ -1,3 +0,0 @@</span><span class="diff-line diff-del">-WIDGETS = {}</span><span class="diff-line diff-del">-def register(name, item):</span><span class="diff-line diff-del">-    WIDGETS[name] = item</span><span class="diff-line diff-meta">\ No newline at end of file</span></code></pre>+</details><details id="file-d29b91093c" class="file-diff">+  <summary><span class="file-path">config/$settings.toml</span> <span class="badge badge-modified">Modified</span> <span class="line-stat">+1 / -1</span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-context">diff --git a/config/$settings.toml b/config/$settings.toml</span><span class="diff-line diff-file-header">--- a/config/$settings.toml</span><span class="diff-line diff-file-header">+++ b/config/$settings.toml</span><span class="diff-line diff-hunk">@@ -1,3 +1,3 @@</span><span class="diff-line diff-context"> [widgets]</span><span class="diff-line diff-del">-widget_dir = &quot;widgets&quot;</span><span class="diff-line diff-add">+dir = &quot;widgets&quot;</span><span class="diff-line diff-context"> context &lt;tail&gt; &amp; more</span></code></pre>+</details><details id="file-f5affc48ee" class="file-diff">+  <summary><span class="file-path">src/widgets/lookup.py</span> <span class="badge badge-renamed">Renamed</span> <span class="line-stat">+2 / -2</span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-context">(diff fragment &#x27;golden-missing.diff&#x27; missing)</span></code></pre>+</details><details id="file-667fb7df63" class="file-diff">+  <summary><span class="file-path">docs/widgets.md</span> <span class="badge badge-modified">Modified</span> <span class="line-stat">+5 / -1</span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-context">(no diff provided)</span></code></pre>+</details><details id="file-149272c650" class="file-diff">+  <summary><span class="file-path">assets/logo.png</span> <span class="badge badge-binaryfile">Binary file</span> <span class="line-stat"></span></summary>+  <pre><code class="diff-block"><span class="diff-line diff-context">Binary files a/assets/logo.png and b/assets/logo.png differ</span></code></pre>+</details>+    </section>+  <section id="double-check">+    <h2>Things to double-check</h2>+    <div class="callout callout-warning"><strong>Import cycle.</strong> <code>registry.py</code> imports <code>widget.py</code> which imports the registry.</div><div class="callout callout-warning"><strong>Config migration.</strong> Existing installs still carry <code>widget_dir</code>.</div>+    </section>++  <footer>+    Generated 2026-09-04 12:14:39 UTC · repo <code>/home/dev/widgets</code> · regenerate with <code>/pre-push-review</code>.+  </footer>+</div>+</body>+</html>

diff --git a/scripts/tests/fixtures/golden.json b/scripts/tests/fixtures/golden.jsonnew file mode 100644index 0000000..3dc02b2--- /dev/null+++ b/scripts/tests/fixtures/golden.json@@ -0,0 +1,156 @@+{+  "repo": {"name": "acme/widgets", "path": "/home/dev/widgets", "branch": "feature/golden", "remote": "origin"},+  "title": "PR review: acme/widgets #42 <golden>",+  "subtitle": "Review of <strong>feature/golden</strong> against <code>main</code> &amp; friends",+  "metrics": [+    {"label": "Commits", "value": 3},+    {"label": "Files", "value": 6},+    {"label": "Lines", "value": "+120 / -34"}+  ],+  "verdict": {"label": "Needs changes", "tone": "warning", "detail": "One <em>major</em> finding was skipped."},+  "at_a_glance": [+    "Adds a <code>Widget</code> registry with lookup by name.",+    "Removes the legacy <code>old_registry.py</code> module."+  ],+  "pr_description": {+    "author": "octocat",+    "url": "https://github.com/acme/widgets/pull/42",+    "created_at": "2026-09-01T10:00:00Z",+    "body": "## Why\n\nThe old registry was *slow* & untested.\n\n- adds `Registry`\n- removes `old_registry.py`\n\n<script>alert(1)</script>"+  },+  "explanation": {+    "beginner": "<p>A registry is a lookup table. This change adds one for widgets.</p>",+    "intermediate": "<p>The registry replaces module-level globals with an explicit <code>Registry</code> object.</p>",+    "expert": "<p>Registration is idempotent; duplicate names raise <code>KeyError</code> at import time.</p>"+  },+  "commits": [+    {"sha": "a1b2c3d", "subject": "[feat]: Add Widget registry", "author": "octocat", "date": "2026-09-01"},+    {"sha": "e4f5a6b", "subject": "[chore]: Remove old registry", "author": "octocat", "date": "2026-09-02", "meta": "octocat · 2026-09-02 · 2 files"},+    {"sha": "c7d8e9f", "subject": "[test]: Cover lookup & duplicate <names>", "author": "hubot", "date": "2026-09-03"}+  ],+  "important_changes": [+    {+      "title": "Registry class",+      "file": "src/widgets/registry.py",+      "why": "Central lookup replaces scattered globals.",+      "what": "The register() and lookup() methods",+      "takeaway": "Registration order no longer matters.",+      "rationale": "The author says globals made testing hard."+    },+    {+      "title": "Legacy module removed",+      "file": "src/widgets/old_registry.py",+      "why": "Dead code after the registry landed.",+      "what": "Confirm nothing else imports it",+      "rationale": "Likely to reduce maintenance surface.",+      "rationale_inferred": true+    },+    {+      "title": "Config key renamed",+      "file": "config/$settings.toml",+      "why": "The key name changed from widget_dir to widgets.dir.",+      "what": "The [widgets] table",+      "rationale_unknown": true+    },+    {+      "title": "Docs touch-up",+      "why": "README mentions the new registry.",+      "what": ""+    }+  ],+  "decisions": [+    {"title": "Registry is a plain class, not a singleton.", "body": "Instances can be created per test."},+    {"title": "Duplicate names raise.", "body": "Silently overwriting hid bugs before.", "inferred": true}+  ],+  "findings": [+    {"severity": "blocking", "area": "Correctness", "finding": "lookup() returns None on miss but callers index the result", "resolution": "Raise KeyError instead", "status": "fixed"},+    {"severity": "major", "area": "Tests", "finding": "No test for duplicate registration", "resolution": "Left for the author", "status": "skipped"},+    {"severity": "minor", "area": "Style", "finding": "Unused import <os>", "resolution": "Removed", "status": "fixed"},+    {"severity": "nit", "area": "Naming", "finding": "reg vs registry", "resolution": "Renamed to registry"},+    {"severity": "info", "area": "Docs", "finding": "README example uses the old API", "resolution": "Updated", "status": "fixed"},+    {"severity": "unknown-level", "area": "Other", "finding": "Severity outside the known set", "resolution": "Rendered as tertiary", "status": "skipped"}+  ],+  "unresolved_comments": [+    {+      "author": "reviewer1",+      "type": "code",+      "path": "src/widgets/registry.py",+      "line": 42,+      "body": "Should this be a `dict` or an `OrderedDict`?\nOrder might matter for <listing>.",+      "url": "https://github.com/acme/widgets/pull/42#discussion_r1",+      "created_at": "2026-09-02T09:00:00Z",+      "replies": [+        {"author": "octocat", "body": "dict preserves insertion order since 3.7", "created_at": "2026-09-02T09:30:00Z"},+        {"author": "reviewer1", "body": "Right, but document it?"}+      ]+    },+    {+      "author": "reviewer2",+      "type": "review",+      "body": "Please add a changelog entry.",+      "url": "https://github.com/acme/widgets/pull/42#pullrequestreview-1",+      "replies": [+        {"author": "octocat", "body": "Will do."}+      ]+    },+    {+      "author": "",+      "type": "discussion",+      "path": "README.md",+      "body": "Typo in the example."+    },+    {+      "author": "bot",+      "type": "",+      "body": "Automated note without a known type."+    }+  ],+  "double_check": [+    {"title": "Import cycle.", "body": "<code>registry.py</code> imports <code>widget.py</code> which imports the registry."},+    {"title": "Config migration.", "body": "Existing installs still carry <code>widget_dir</code>."}+  ],+  "files": [+    {+      "path": "src/widgets/registry.py",+      "badge": "Added",+      "stat": "+48 / -0",+      "diff": "diff --git a/src/widgets/registry.py b/src/widgets/registry.py\nnew file mode 100644\n--- /dev/null\n+++ b/src/widgets/registry.py\n@@ -0,0 +1,6 @@\n+class Registry:\n+    def __init__(self) -> None:\n+        self._items: dict[str, object] = {}\n+\n+    def register(self, name: str, item: object) -> None:\n+        self._items[name] = item  # <-- \"quoted\" & escaped\n"+    },+    {+      "path": "src/widgets/old_registry.py",+      "badge": "Deleted",+      "stat": "+0 / -12",+      "diff": "--- a/src/widgets/old_registry.py\n+++ /dev/null\n@@ -1,3 +0,0 @@\n-WIDGETS = {}\n-def register(name, item):\n-    WIDGETS[name] = item\n\\ No newline at end of file\n"+    },+    {+      "path": "config/$settings.toml",+      "badge": "Modified",+      "stat": "+1 / -1",+      "diff_file": "golden-settings.diff"+    },+    {+      "path": "src/widgets/lookup.py",+      "badge": "Renamed",+      "stat": "+2 / -2",+      "diff_file": "golden-missing.diff"+    },+    {+      "path": "docs/widgets.md",+      "badge": "Modified",+      "stat": "+5 / -1"+    },+    {+      "path": "assets/logo.png",+      "badge": "Binary file",+      "stat": "",+      "diff": "Binary files a/assets/logo.png and b/assets/logo.png differ\n"+    }+  ],+  "publish_metadata": {+    "title": "PR review: acme/widgets #42",+    "repoUrl": "https://github.com/acme/widgets",+    "pr": 42,+    "severity": "needs-changes",+    "summary": "Registry lands; one major test gap skipped. Contains </script> to exercise escaping."+  }+}

diff --git a/scripts/tests/test_blast_radius.py b/scripts/tests/test_blast_radius.pynew file mode 100644index 0000000..a380c33--- /dev/null+++ b/scripts/tests/test_blast_radius.py@@ -0,0 +1,599 @@+"""Tests for scripts/blast_radius.py against a generated git repository.++One repository is built per test class in a temp directory with Go, Python,+TypeScript, Rust, and Swift files; a base commit, a snapshot commit with every+change kind, a docs-only commit on a side branch, and an untracked file. The+script is driven in-process through ``main`` so ``--remote`` can be served by+a fake ``gh_api`` fed from the same repository.+"""+from __future__ import annotations++import base64+import contextlib+import io+import json+import os+import re+import subprocess+import sys+import tempfile+import unittest+from pathlib import Path++import blast_radius++REPO_ROOT = Path(__file__).resolve().parents[2]+SCRIPT = REPO_ROOT / "scripts" / "blast_radius.py"+ECOSYSTEMS = REPO_ROOT / "scripts" / "ecosystems.json"++BASE_FILES = {+    "go.mod": "module example.com/m\n\ngo 1.21\n",+    "main.go": (+        'package main\n\nimport (\n\t"fmt"\n\n\t"example.com/m/pkg"\n\t"example.com/m/util"\n)\n\n'+        "func main() { fmt.Println(pkg.A(), util.U()) }\n"+    ),+    "pkg/a.go": 'package pkg\n\nimport "example.com/m/util"\n\nfunc A() string { return util.U() }\n',+    "pkg/b.go": 'package pkg\n\nfunc B() string { return "b" }\n',+    "pkg/gone.go": (+        'package pkg\n\nimport "example.com/m/util"\n\n// Gone is the legacy entry point.\n'+        'func Gone() string { return "gone:" + util.U() }\n\n'+        "// GoneTwice repeats Gone.\nfunc GoneTwice() string { return Gone() + Gone() }\n"+    ),+    "pkg/a_test.go": (+        'package pkg_test\n\nimport (\n\t"testing"\n\n\t"example.com/m/pkg"\n)\n\n'+        "func TestA(t *testing.T) { _ = pkg.A() }\n\nfunc TestOld(t *testing.T) {}\n"+    ),+    "util/u.go": 'package util\n\nfunc U() string { return "u" }\n',+    "util/u_test.go": 'package util\n\nimport "testing"\n\nfunc TestU(t *testing.T) { _ = U() }\n',+    "src/app/__init__.py": "",+    "src/app/core.py": (+        "from .helpers import h\nfrom app.models import M\nfrom app.legacy import L\n\n\n"+        "def core():\n    return h(), M, L\n"+    ),+    "src/app/helpers.py": "def h():\n    return 1\n",+    "src/app/models.py": "M = 1\n",+    "src/app/legacy.py": "L = 2\n",+    "src/app/report.py": "from app.models import M\n\n\ndef report():\n    return M\n",+    # Under src/ so the Swift Tests/ directory does not collide with it on+    # case-insensitive filesystems.+    "src/tests/test_core.py": "from app.core import core\n\n\ndef test_one():\n    assert core()\n",+    "web/index.ts": 'export * from "./lib";\n',+    "web/lib/index.ts": 'import { x } from "./x.js";\nexport { x };\n',+    "web/lib/x.ts": "export const x = 1;\n",+    "web/app.ts": 'import { x } from "./lib";\nconsole.log(x);\n',+    "web/lib/x.test.ts": 'import { x } from "./x";\n\nit("does x", () => { expect(x).toBe(1); });\n',+    "src/lib.rs": "mod foo;\nmod bar;\n\nuse crate::bar::baz::Q;\n\npub fn lib() -> i32 { foo::f() + Q }\n",+    "src/foo.rs": "pub fn f() -> i32 { 1 }\n",+    "src/bar/mod.rs": "pub mod baz;\n",+    "src/bar/baz.rs": "pub const Q: i32 = 2;\n",+    "Sources/App/main.swift": "import Foundation\nimport Core\n\nprint(core())\n",+    "Sources/Core/core.swift": 'public func core() -> String { "core" }\n',+    "Tests/CoreTests/CoreTests.swift": (+        "import XCTest\n@testable import Core\n\nfinal class CoreTests: XCTestCase {\n"+        "    func testCore() { XCTAssertEqual(core(), \"core\") }\n}\n"+    ),+    "notes.txt": "notes\n",+    "README.md": "# readme\n",+}++BIG_LINE = "// " + "x" * 97 + "\n"          # 101 bytes+BIG_FILE = "package pkg\n" + BIG_LINE * 10500  # > 1 MiB+++def git(repo: Path, *args: str) -> str:+    result = subprocess.run(["git", "-C", str(repo), *args], check=True,+                            capture_output=True, text=True)+    return result.stdout+++def write(repo: Path, rel: str, content: str) -> None:+    path = repo / rel+    path.parent.mkdir(parents=True, exist_ok=True)+    path.write_text(content, encoding="utf-8")+++def build_repo(repo: Path) -> dict:+    git(repo, "init", "-q", "-b", "main")+    git(repo, "config", "user.email", "t@example.com")+    git(repo, "config", "user.name", "T")+    git(repo, "config", "core.symlinks", "true")+    for rel, content in BASE_FILES.items():+        write(repo, rel, content)+    os.symlink("pkg/a.go", repo / "link_to_a.go")+    git(repo, "add", "-A")+    git(repo, "commit", "-q", "-m", "base")+    base = git(repo, "rev-parse", "HEAD").strip()++    write(repo, "pkg/a.go", BASE_FILES["pkg/a.go"] + "\n// changed\n")+    write(repo, "pkg/c.go", (+        'package pkg\n\nimport (\n\t"strings"\n\n\t"example.com/m/util"\n)\n\n'+        "// C upper-cases the util value.\nfunc C() string { return strings.ToUpper(util.U()) }\n"+        "\nfunc c2() int { return 2 }\n"))+    (repo / "pkg/gone.go").unlink()+    write(repo, "util/v.go", BASE_FILES["util/u.go"])            # copy of u.go ...+    write(repo, "util/u.go", BASE_FILES["util/u.go"] + "// modified\n")  # ... whose source changed+    git(repo, "mv", "src/app/models.py", "src/app/entities.py")+    write(repo, "src/app/core.py",+          "from .helpers import h\nfrom app.entities import M\n\n\ndef core():\n    return h(), M\n")+    (repo / "src/app/legacy.py").unlink()+    (repo / "notes.txt").unlink()+    os.symlink("README.md", repo / "notes.txt")                # type change+    write(repo, "pkg/big.go", BIG_FILE)+    write(repo, "web/lib/x.ts", "export const x = 2;\n")+    write(repo, "src/foo.rs", "pub fn f() -> i32 { 11 }\n")+    write(repo, "src/bar/baz.rs", "pub const Q: i32 = 22;\n")+    write(repo, "Sources/Core/core.swift", 'public func core() -> String { "core2" }\n')+    write(repo, "Tests/CoreTests/CoreTests.swift",+          BASE_FILES["Tests/CoreTests/CoreTests.swift"].replace(+              "}\n}\n", "}\n    func testNew() {}\n}\n"))+    write(repo, "pkg/a_test.go", BASE_FILES["pkg/a_test.go"].replace("TestOld", "TestNew"))+    write(repo, "src/tests/test_core.py",+          BASE_FILES["src/tests/test_core.py"] + "\n\ndef test_two():\n    assert True\n")+    write(repo, "spec/foo_spec.rb", 'describe "foo" do\n  it "works" do\n  end\nend\n')+    git(repo, "add", "-A")+    git(repo, "commit", "-q", "-m", "snapshot")+    snapshot = git(repo, "rev-parse", "HEAD").strip()++    git(repo, "checkout", "-q", "-b", "docs")+    write(repo, "README.md", "# readme\n\nmore\n")+    write(repo, "spec/foo_spec.rb", 'describe "foo" do\n  it "works better" do\n  end\nend\n')+    git(repo, "add", "-A")+    git(repo, "commit", "-q", "-m", "docs")+    docs = git(repo, "rev-parse", "HEAD").strip()+    git(repo, "checkout", "-q", "main")++    write(repo, "pkg/untracked.go", 'package pkg\n\nimport "example.com/m/util"\n\nfunc N() string { return util.U() }\n')+    return {"base": base, "snapshot": snapshot, "docs": docs}+++def run(args: list, stderr: io.StringIO = None) -> tuple:+    """Run main() in-process and return (exit code, diagram, diff_tests, stderr)."""+    buf = stderr if stderr is not None else io.StringIO()+    with tempfile.TemporaryDirectory() as out:+        with contextlib.redirect_stderr(buf), contextlib.redirect_stdout(io.StringIO()):+            try:+                code = blast_radius.main(args + ["--out", out])+            except SystemExit as exc:      # argparse errors+                code = exc.code+        diagram = diff_tests = None+        if (Path(out) / "diagram.json").exists():+            diagram = json.loads((Path(out) / "diagram.json").read_text(encoding="utf-8"))+        if (Path(out) / "diff-tests.json").exists():+            diff_tests = json.loads((Path(out) / "diff-tests.json").read_text(encoding="utf-8"))+    return code, diagram, diff_tests, buf.getvalue()+++def node_map(diagram: dict) -> dict:+    return {n["path"]: n for n in diagram["nodes"]}+++def edge_map(diagram: dict) -> dict:+    return {(e["from"], e["to"]): e for e in diagram["edges"]}+++EXPECTED_EDGES = {+    # (from, to): (method, granularity, tree)+    ("main.go", "pkg/a.go"): ("expansion", "package", "snapshot"),+    ("main.go", "pkg/c.go"): ("expansion", "package", "snapshot"),+    ("main.go", "pkg/gone.go"): ("expansion", "package", "base"),+    ("main.go", "util/u.go"): ("expansion", "package", "snapshot"),+    ("main.go", "util/v.go"): ("expansion", "package", "snapshot"),+    ("pkg/a.go", "util/u.go"): ("expansion", "package", "snapshot"),+    ("pkg/c.go", "util/u.go"): ("expansion", "package", "snapshot"),+    ("pkg/c.go", "util/v.go"): ("expansion", "package", "snapshot"),+    ("pkg/gone.go", "util/u.go"): ("expansion", "package", "base"),+    ("pkg/a_test.go", "pkg/a.go"): ("expansion", "package", "snapshot"),+    ("pkg/a_test.go", "pkg/gone.go"): ("expansion", "package", "base"),+    ("src/app/core.py", "src/app/helpers.py"): ("import", "file", "snapshot"),+    ("src/app/core.py", "src/app/entities.py"): ("import", "file", "snapshot"),+    ("src/app/core.py", "src/app/legacy.py"): ("import", "file", "base"),+    ("src/app/report.py", "src/app/entities.py"): ("import", "file", "base"),+    ("src/tests/test_core.py", "src/app/core.py"): ("import", "file", "snapshot"),+    # Expansion reaches every file in the imported package, test files included;+    # the renderer, not the script, drops test files from the side columns.+    ("pkg/a_test.go", "pkg/b.go"): ("expansion", "package", "snapshot"),+    ("pkg/a.go", "util/u_test.go"): ("expansion", "package", "snapshot"),+    ("web/lib/index.ts", "web/lib/x.ts"): ("import", "file", "snapshot"),+    ("web/lib/x.test.ts", "web/lib/x.ts"): ("import", "file", "snapshot"),+    ("src/lib.rs", "src/foo.rs"): ("import", "file", "snapshot"),+    ("src/lib.rs", "src/bar/baz.rs"): ("import", "file", "snapshot"),+    ("src/bar/mod.rs", "src/bar/baz.rs"): ("import", "file", "snapshot"),+    ("Sources/App/main.swift", "Sources/Core/core.swift"): ("expansion", "package", "snapshot"),+    ("Tests/CoreTests/CoreTests.swift", "Sources/Core/core.swift"): ("expansion", "package", "snapshot"),+}++EXPECTED_NODES = {+    # path: (status, group, is_test, old_path)+    "pkg/a.go": ("modified", "example.com/m/pkg", False, None),+    "pkg/c.go": ("added", "example.com/m/pkg", False, None),+    "pkg/gone.go": ("deleted", "example.com/m/pkg", False, None),+    "pkg/big.go": ("added", "example.com/m/pkg", False, None),+    "pkg/a_test.go": ("modified", "example.com/m/pkg", True, None),+    "util/u.go": ("modified", "example.com/m/util", False, None),+    "util/v.go": ("added", "example.com/m/util", False, None),+    "main.go": ("unchanged", "example.com/m", False, None),+    "src/app/core.py": ("modified", "src/app", False, None),+    "src/app/entities.py": ("renamed", "src/app", False, "src/app/models.py"),+    "src/app/legacy.py": ("deleted", "src/app", False, None),+    "src/app/helpers.py": ("unchanged", "src/app", False, None),+    "src/app/report.py": ("unchanged", "src/app", False, None),+    "src/tests/test_core.py": ("modified", "src/tests", True, None),+    "pkg/b.go": ("unchanged", "example.com/m/pkg", False, None),+    "util/u_test.go": ("unchanged", "example.com/m/util", True, None),+    "web/lib/x.ts": ("modified", "web/lib", False, None),+    "web/lib/index.ts": ("unchanged", "web/lib", False, None),+    "web/lib/x.test.ts": ("unchanged", "web/lib", True, None),+    "src/foo.rs": ("modified", "src", False, None),+    "src/bar/baz.rs": ("modified", "src/bar", False, None),+    "src/lib.rs": ("unchanged", "src", False, None),+    "src/bar/mod.rs": ("unchanged", "src/bar", False, None),+    "Sources/Core/core.swift": ("modified", "Core", False, None),+    "Sources/App/main.swift": ("unchanged", "App", False, None),+    "Tests/CoreTests/CoreTests.swift": ("modified", "Tests/CoreTests", True, None),+    "notes.txt": ("modified", ".", False, None),+    "spec/foo_spec.rb": ("added", "spec", True, None),+}+++class RepoTestCase(unittest.TestCase):+    @classmethod+    def setUpClass(cls) -> None:+        cls._tmp = tempfile.TemporaryDirectory()+        cls.repo = Path(cls._tmp.name) / "repo"+        cls.repo.mkdir()+        cls.shas = build_repo(cls.repo)++    @classmethod+    def tearDownClass(cls) -> None:+        cls._tmp.cleanup()++    def assert_graph(self, diagram: dict, snapshot_tree: str) -> None:+        self.assertEqual(diagram["snapshot_tree"], snapshot_tree)+        self.assertEqual(diagram["base_tree"], self.shas["base"])+        nodes = node_map(diagram)+        for path, (status, group, is_test, old_path) in EXPECTED_NODES.items():+            with self.subTest(node=path):+                self.assertIn(path, nodes)+                n = nodes[path]+                self.assertEqual(n["status"], status)+                self.assertEqual(n["group"], group)+                self.assertEqual(n["is_test"], is_test)+                self.assertEqual(n["old_path"], old_path)+        for absent in ("link_to_a.go", "web/index.ts", "web/app.ts", "go.mod", "README.md",+                       "fmt", "testing", "strings", "src/app/models.py", "src/app/__init__.py"):+            self.assertNotIn(absent, nodes, absent)+        edges = edge_map(diagram)+        for key, (method, granularity, tree) in EXPECTED_EDGES.items():+            with self.subTest(edge=key):+                self.assertIn(key, edges)+                e = edges[key]+                self.assertEqual(e["method"], method)+                self.assertEqual(e["granularity"], granularity)+                self.assertEqual(e["tree"], tree)+        for (a, b) in edges:+            self.assertIn(a, nodes, a)+            self.assertIn(b, nodes, b)+            self.assertTrue(nodes[a]["status"] != "unchanged" or nodes[b]["status"] != "unchanged")+        self.assertFalse(any(a == "pkg/big.go" for (a, _) in edges))+        self.assertEqual(diagram["column_status"], {"dependents": "complete", "dependencies": "complete"})+        self.assertIn({"path": "pkg/big.go", "reason": "blob over 1 MB"}, diagram["skipped"])++    def assert_diff_tests(self, diff_tests: dict) -> None:+        self.assertEqual(diff_tests["added"], ["TestNew", "testNew", "test_two"])+        self.assertEqual(diff_tests["removed"], ["TestOld"])+        self.assertEqual(diff_tests["unpatterned_files"], ["spec/foo_spec.rb"])+++class ShaSnapshotTest(RepoTestCase):+    def test_graph_and_diff_tests(self) -> None:+        code, diagram, diff_tests, err = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]])+        self.assertEqual(code, 0, err)+        self.assert_graph(diagram, self.shas["snapshot"])+        self.assertNotIn("pkg/untracked.go", node_map(diagram))+        self.assert_diff_tests(diff_tests)++    def test_output_is_deterministic(self) -> None:+        args = ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]]+        _, a, ta, _ = run(args)+        _, b, tb, _ = run(args)+        self.assertEqual(a, b)+        self.assertEqual(ta, tb)++    def test_failed_columns_without_import_patterns(self) -> None:+        code, diagram, diff_tests, err = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["docs"], "--base", self.shas["snapshot"]])+        self.assertEqual(code, 0, err)+        self.assertEqual(diagram["column_status"], {+            "dependents": "failed: no import patterns for .md, .rb",+            "dependencies": "failed: no import patterns for .md, .rb",+        })+        self.assertEqual(diagram["edges"], [])+        self.assertEqual(sorted(node_map(diagram)), ["README.md", "spec/foo_spec.rb"])+        self.assertEqual(diff_tests, {"added": [], "removed": [], "unpatterned_files": ["spec/foo_spec.rb"]})++    def test_script_runs_from_the_command_line(self) -> None:+        with tempfile.TemporaryDirectory() as out:+            result = subprocess.run(+                [sys.executable, str(SCRIPT), "--repo", str(self.repo),+                 "--snapshot", self.shas["snapshot"], "--base", self.shas["base"], "--out", out],+                capture_output=True, text=True,+            )+            self.assertEqual(result.returncode, 0, result.stderr)+            self.assertTrue((Path(out) / "diagram.json").exists())+            self.assertTrue((Path(out) / "diff-tests.json").exists())+            self.assertIn("diagram.json", result.stdout)++    def test_bad_base_exits_non_zero(self) -> None:+        code, diagram, _, err = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", "0" * 40])+        self.assertNotEqual(code, 0)+        self.assertIsNone(diagram)+        self.assertIn("error", err)+++class WorkingTreeSnapshotTest(RepoTestCase):+    def test_reads_disk_and_counts_untracked_as_added(self) -> None:+        code, diagram, diff_tests, err = run(+            ["--repo", str(self.repo), "--snapshot", "working-tree", "--base", self.shas["base"]])+        self.assertEqual(code, 0, err)+        self.assert_graph(diagram, "working-tree")+        nodes = node_map(diagram)+        self.assertEqual(nodes["pkg/untracked.go"],+                         {"path": "pkg/untracked.go", "status": "added", "group": "example.com/m/pkg",+                          "is_test": False, "old_path": None})+        edges = edge_map(diagram)+        self.assertEqual(edges[("pkg/untracked.go", "util/u.go")]["tree"], "snapshot")+        self.assertEqual(edges[("main.go", "pkg/untracked.go")]["method"], "expansion")+        self.assert_diff_tests(diff_tests)++    def test_untracked_test_file_contributes_diff_tests(self) -> None:+        write(self.repo, "pkg/extra_test.go",+              'package pkg\n\nimport "testing"\n\nfunc TestExtra(t *testing.T) {}\n')+        try:+            code, diagram, diff_tests, err = run(+                ["--repo", str(self.repo), "--snapshot", "working-tree", "--base", self.shas["base"]])+            self.assertEqual(code, 0, err)+            self.assertIn("TestExtra", diff_tests["added"])+            self.assertTrue(node_map(diagram)["pkg/extra_test.go"]["is_test"])+        finally:+            (self.repo / "pkg/extra_test.go").unlink()+++GO_LIST_STUB = '''\+import json, sys+repo = sys.argv[1]+pkgs = [+    {"ImportPath": "example.com/m", "Dir": repo, "GoFiles": ["main.go"],+     "Imports": ["fmt", "example.com/m/pkg", "example.com/m/util"]},+    {"ImportPath": "example.com/m/pkg", "Dir": repo + "/pkg", "GoFiles": ["a.go", "b.go", "c.go"],+     "TestGoFiles": [], "XTestGoFiles": ["a_test.go"], "XTestImports": ["testing", "example.com/m/pkg"],+     "Imports": ["example.com/m/util"]},+    {"ImportPath": "example.com/m/util", "Dir": repo + "/util", "GoFiles": ["u.go", "v.go"],+     "Imports": []},+]+for p in pkgs:+    print(json.dumps(p, indent=1))+'''+++class ToolsTest(RepoTestCase):+    def ecosystems_with_tool(self, deps: str) -> Path:+        data = json.loads(ECOSYSTEMS.read_text(encoding="utf-8"))+        data["go"]["tool"] = {"name": "go list", "deps": deps, "format": "go-list-json",+                              "granularity": "package"}+        path = Path(self._tmp.name) / "eco.json"+        path.write_text(json.dumps(data), encoding="utf-8")+        return path++    def test_tool_edges_replace_scanned_pairs(self) -> None:+        stub = Path(self._tmp.name) / "golist.py"+        stub.write_text(GO_LIST_STUB, encoding="utf-8")+        eco = self.ecosystems_with_tool(f'"{sys.executable}" "{stub}" "{self.repo}"')+        code, diagram, _, err = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", self.shas["base"],+             "--tools", "--ecosystems", str(eco)])+        self.assertEqual(code, 0, err)+        edges = edge_map(diagram)+        for key in (("main.go", "pkg/a.go"), ("main.go", "pkg/c.go"), ("pkg/a.go", "util/u.go"),+                    ("pkg/a_test.go", "pkg/a.go")):+            self.assertEqual(edges[key]["method"], "tool:go list", key)+            self.assertEqual(edges[key]["granularity"], "package")+            self.assertEqual(edges[key]["tree"], "snapshot")+        # The tool knows nothing about the base tree or other languages.+        self.assertEqual(edges[("main.go", "pkg/gone.go")]["method"], "expansion")+        self.assertEqual(edges[("main.go", "pkg/gone.go")]["tree"], "base")+        self.assertEqual(edges[("src/app/core.py", "src/app/helpers.py")]["method"], "import")+        self.assertEqual(edges[("pkg/a_test.go", "pkg/b.go")]["method"], "tool:go list")++    def test_failing_tool_keeps_scanned_edges_with_a_warning(self) -> None:+        eco = self.ecosystems_with_tool(f'"{sys.executable}" -c "import sys; sys.exit(3)"')+        code, diagram, _, err = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", self.shas["base"],+             "--tools", "--ecosystems", str(eco)])+        self.assertEqual(code, 0, err)+        self.assertEqual(edge_map(diagram)[("main.go", "pkg/a.go")]["method"], "expansion")+        self.assertIn("warning", err)+        self.assertIn("go list", err)+++class FakeGitHub:+    """Serves compare, trees, and blobs from the local repository."""++    def __init__(self, repo: Path, truncated: bool = False) -> None:+        self.repo = repo+        self.truncated = truncated+        self.blob_calls = 0+        self.tree_calls = 0+        self.compare_calls = 0++    def __call__(self, path: str) -> object:+        m = re.match(r"repos/([^/]+/[^/]+)/(compare|git/trees|git/blobs)/([^?]+)(?:\?(.*))?$", path)+        assert m, path+        kind, rest = m.group(2), m.group(3)+        if kind == "compare":+            self.compare_calls += 1+            base, head = rest.split("...")+            files = []+            raw = git(self.repo, "diff", "--name-status", "-M", "-C", "-z", base, head)+            parts = raw.split("\0")+            i = 0+            names = {"A": "added", "M": "modified", "D": "removed", "R": "renamed",+                     "C": "copied", "T": "changed"}+            while i < len(parts) and parts[i]:+                status = parts[i][0]+                if status in "RC":+                    old, new = parts[i + 1], parts[i + 2]+                    i += 3+                else:+                    old, new = None, parts[i + 1]+                    i += 2+                entry = {"status": names[status], "filename": new}+                if old:+                    entry["previous_filename"] = old+                patch = git(self.repo, "diff", base, head, "-M", "-C", "--", *(p for p in (old, new) if p))+                body = patch.split("\n@@", 1)+                if len(body) == 2:+                    entry["patch"] = "@@" + body[1]+                files.append(entry)+            page = int(re.search(r"(?:^|&)page=(\d+)", m.group(4) or "page=1").group(1))+            return {"files": files if page == 1 else [], "merge_base_commit": {"sha": base}}+        if kind == "git/trees":+            self.tree_calls += 1+            entries = []+            for line in git(self.repo, "ls-tree", "-r", "-l", rest).splitlines():+                meta, _, p = line.partition("\t")+                mode, typ, sha, size = meta.split()+                entries.append({"path": p, "mode": mode, "type": typ, "sha": sha,+                                "size": int(size) if size != "-" else 0})+            return {"sha": rest, "tree": entries, "truncated": self.truncated}+        self.blob_calls += 1+        raw = subprocess.run(["git", "-C", str(self.repo), "cat-file", "blob", rest],+                             check=True, capture_output=True).stdout+        return {"sha": rest, "encoding": "base64", "content": base64.b64encode(raw).decode()}+++class RemoteTest(RepoTestCase):+    def setUp(self) -> None:+        self._gh = blast_radius.gh_api+        self._cap = blast_radius.REMOTE_BLOB_CAP++    def tearDown(self) -> None:+        blast_radius.gh_api = self._gh+        blast_radius.REMOTE_BLOB_CAP = self._cap++    def test_remote_matches_local(self) -> None:+        fake = FakeGitHub(self.repo)+        blast_radius.gh_api = fake+        code, diagram, diff_tests, err = run(+            ["--remote", "acme/widgets", "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]])+        self.assertEqual(code, 0, err)+        self.assert_graph(diagram, self.shas["snapshot"])+        self.assert_diff_tests(diff_tests)+        self.assertEqual(fake.tree_calls, 2)+        self.assertGreater(fake.blob_calls, 0)+        self.assertLessEqual(fake.blob_calls, blast_radius.REMOTE_BLOB_CAP)+        _, local, _, _ = run(+            ["--repo", str(self.repo), "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]])+        self.assertEqual(diagram, local)++    def test_blob_cap_marks_dependents_partial(self) -> None:+        fake = FakeGitHub(self.repo)+        blast_radius.gh_api = fake+        blast_radius.REMOTE_BLOB_CAP = 1+        code, diagram, _, err = run(+            ["--remote", "acme/widgets", "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]])+        self.assertEqual(code, 0, err)+        self.assertEqual(diagram["column_status"]["dependents"], "partial: remote scan cap reached")+        self.assertEqual(diagram["column_status"]["dependencies"], "complete")+        edges = edge_map(diagram)+        # Dependencies come from the changed files' own blobs and are unaffected.+        self.assertIn(("src/app/core.py", "src/app/helpers.py"), edges)+        self.assertIn(("pkg/a.go", "util/u.go"), edges)+        self.assertNotIn(("web/lib/index.ts", "web/lib/x.ts"), edges)++    def test_truncated_tree_fails_both_columns(self) -> None:+        blast_radius.gh_api = FakeGitHub(self.repo, truncated=True)+        code, diagram, _, err = run(+            ["--remote", "acme/widgets", "--snapshot", self.shas["snapshot"], "--base", self.shas["base"]])+        self.assertEqual(code, 0, err)+        self.assertEqual(diagram["column_status"], {+            "dependents": "failed: tree listing truncated",+            "dependencies": "failed: tree listing truncated",+        })+        self.assertEqual(diagram["edges"], [])+        self.assertIn("pkg/a.go", node_map(diagram))++    def test_remote_rejects_working_tree_and_tools(self) -> None:+        blast_radius.gh_api = FakeGitHub(self.repo)+        code, diagram, _, err = run(+            ["--remote", "acme/widgets", "--snapshot", "working-tree", "--base", self.shas["base"]])+        self.assertEqual(code, 2)+        self.assertIsNone(diagram)+        self.assertIn("working-tree", err)+        code, diagram, _, err = run(+            ["--remote", "acme/widgets", "--snapshot", self.shas["snapshot"], "--base", self.shas["base"],+             "--tools"])+        self.assertEqual(code, 2)+        self.assertIsNone(diagram)+        self.assertIn("--tools", err)+++class ParserTest(unittest.TestCase):+    def test_name_status_mapping(self) -> None:+        raw = ("A\0a.go\0M\0b.go\0D\0c.go\0R100\0old.py\0new.py\0C075\0src.go\0copy.go\0"+               "T\0notes.txt\0")+        changed = blast_radius.parse_name_status(raw)+        self.assertEqual(+            [(c.path, c.status, c.old_path) for c in changed],+            [("a.go", "added", None), ("b.go", "modified", None), ("c.go", "deleted", None),+             ("new.py", "renamed", "old.py"), ("copy.go", "added", None),+             ("notes.txt", "modified", None)],+        )++    def test_ls_tree_parsing_skips_symlinks_and_submodules(self) -> None:+        raw = ("100644 blob aaaa     12\tpkg/a.go\0"+               "120000 blob bbbb      8\tlink.go\0"+               "160000 commit cccc       -\tvendor/sub\0"+               "100755 blob dddd 2000000\tpkg/big.go\0"+               "100644 blob eeee      3\tdir with\ttab/x.py\0")+        entries = blast_radius.parse_ls_tree(raw)+        self.assertEqual(sorted(entries), ["dir with\ttab/x.py", "pkg/a.go", "pkg/big.go"])+        self.assertEqual(entries["pkg/a.go"].sha, "aaaa")+        self.assertEqual(entries["pkg/big.go"].size, 2000000)++    def test_test_decl_names(self) -> None:+        eco = blast_radius.load_ecosystems(ECOSYSTEMS)+        diff = ("@@ -1,3 +1,4 @@\n+func TestNew(t *testing.T) {}\n-func TestOld(t *testing.T) {}\n"+                " func helper() {}\n+++ b/x_test.go\n")+        added, removed = blast_radius.diff_test_names(diff, eco.row_for("x_test.go"))+        self.assertEqual((added, removed), ({"TestNew"}, {"TestOld"}))+        rust = ("+#[test]\n+fn added_case() {}\n-#[tokio::test]\n-async fn removed_case() {}\n"+                "+fn not_a_test() {}\n")+        added, removed = blast_radius.diff_test_names(rust, eco.row_for("src/lib.rs"))+        self.assertEqual((added, removed), ({"added_case"}, {"removed_case"}))+        ts = "+it('adds numbers', () => {});\n+test(\"names things\", () => {});\n"+        added, _ = blast_radius.diff_test_names(ts, eco.row_for("a.test.ts"))+        self.assertEqual(added, {"adds numbers", "names things"})++    def test_test_file_detection(self) -> None:+        eco = blast_radius.load_ecosystems(ECOSYSTEMS)+        cases = {+            "pkg/a_test.go": True, "pkg/a.go": False,+            "tests/test_core.py": True, "src/app/core.py": False, "conftest.py": True,+            "web/lib/x.test.ts": True, "web/__tests__/y.ts": True, "web/lib/x.ts": False,+            "Tests/CoreTests/CoreTests.swift": True, "Sources/Core/core.swift": False,+            "tests/integration.rs": True, "src/lib.rs": False,+            "spec/foo_spec.rb": True, "lib/foo.rb": False, "docs/testing.md": False,+            # No row: whole-token names and directories only.+            "specs/review-html-tests-diagram/design.md": False, "specs/overview.md": False,+            "contest/latest.md": False, "lib/foo-test.sh": True, "lib/foo.spec.rb": True,+            "app/test/Helpers.kt": True, "Sources/App/AppTests.kt": True,+        }+        for path, expected in cases.items():+            with self.subTest(path=path):+                self.assertEqual(blast_radius.is_test_file(path, eco.row_for(path)), expected)+++if __name__ == "__main__":+    unittest.main()

diff --git a/scripts/tests/test_coverage.py b/scripts/tests/test_coverage.pynew file mode 100644index 0000000..96d45c5--- /dev/null+++ b/scripts/tests/test_coverage.py@@ -0,0 +1,330 @@+"""Tests for review_html.coverage: parsers, path mapping, matching, arithmetic."""+from __future__ import annotations++import contextlib+import io+import random+import tempfile+import unittest+from pathlib import Path++from review_html.coverage import (+    Entry,+    apply_path_map,+    diff_coverage,+    match,+    normalise,+    overall,+    parse_coverage,+)+from review_html.warnings import Warnings++LCOV = """\+TN:+SF:src/a.py+DA:1,1+DA:2,0+DA:3,4,checksum+end_of_record+SF:src/b.py+DA:10,0+end_of_record+SF:src/a.py+DA:2,2+DA:4,0+end_of_record+"""++COBERTURA = """\+<?xml version="1.0" ?>+<coverage line-rate="0.5" version="6.0">+  <sources>+    <source>/home/ci/repo</source>+    <source>/home/ci/repo/src</source>+  </sources>+  <packages>+    <package name="pkg">+      <classes>+        <class name="a.py" filename="pkg/a.py" line-rate="0.5">+          <methods>+            <method name="f"><lines><line number="1" hits="1"/></lines></method>+          </methods>+          <lines>+            <line number="1" hits="1"/>+            <line number="2" hits="0" branch="true" condition-coverage="50% (1/2)"/>+          </lines>+        </class>+      </classes>+    </package>+  </packages>+</coverage>+"""++COBERTURA_NO_SOURCES = """\+<coverage>+  <packages><package name="p"><classes>+    <class filename="x.py"><lines><line number="7" hits="3"/></lines></class>+  </classes></package></packages>+</coverage>+"""++COVERPROFILE_SET = """\+mode: set+github.com/org/repo/pkg/a.go:3.10,5.2 2 1+github.com/org/repo/pkg/a.go:5.2,7.1 1 0+github.com/org/repo/pkg/b.go:1.1,1.20 1 0+"""++COVERPROFILE_COUNT = """\+mode: count+github.com/org/repo/pkg/a.go:3.10,5.2 2 4+github.com/org/repo/pkg/a.go:4.1,4.30 1 0+github.com/org/repo/pkg/a.go:5.2,6.1 1 9+"""+++def entry(path: str, *aliases: str, hits: dict | None = None) -> Entry:+    return Entry([path, *aliases], dict(hits or {1: 1}))+++class ParserTest(unittest.TestCase):+    def setUp(self) -> None:+        self._tmp = tempfile.TemporaryDirectory()+        self.dir = Path(self._tmp.name)+        self.warnings = Warnings()+        self._stderr = contextlib.redirect_stderr(io.StringIO())+        self._stderr.__enter__()++    def tearDown(self) -> None:+        self._stderr.__exit__(None, None, None)+        self._tmp.cleanup()++    def parse(self, name: str, text: str) -> list[Entry]:+        path = self.dir / name+        path.write_text(text, encoding="utf-8")+        return parse_coverage(path, self.warnings)++    def test_lcov_keeps_repeated_sf_as_separate_entries(self) -> None:+        cov = self.parse("lcov.info", LCOV)+        self.assertEqual([e.paths for e in cov], [["src/a.py"], ["src/b.py"], ["src/a.py"]])+        self.assertEqual(cov[0].hits, {1: 1, 2: 0, 3: 4})+        self.assertEqual(cov[1].hits, {10: 0})+        self.assertEqual(cov[2].hits, {2: 2, 4: 0})+        self.assertEqual(self.warnings.items, [])++    def test_lcov_without_trailing_end_of_record_keeps_last_entry(self) -> None:+        cov = self.parse("lcov.info", "SF:a.py\nDA:1,1\n")+        self.assertEqual(cov, [Entry(["a.py"], {1: 1})])++    def test_cobertura_two_source_roots_become_aliases(self) -> None:+        cov = self.parse("coverage.xml", COBERTURA)+        self.assertEqual(len(cov), 1)+        self.assertEqual(cov[0].paths,+                         ["pkg/a.py", "/home/ci/repo/pkg/a.py", "/home/ci/repo/src/pkg/a.py"])+        self.assertEqual(cov[0].hits, {1: 1, 2: 0})++    def test_cobertura_without_sources_has_primary_path_only(self) -> None:+        cov = self.parse("coverage.xml", COBERTURA_NO_SOURCES)+        self.assertEqual(cov, [Entry(["x.py"], {7: 3})])++    def test_coverprofile_set_mode_expands_blocks_to_lines(self) -> None:+        cov = self.parse("coverage.out", COVERPROFILE_SET)+        self.assertEqual([e.paths for e in cov],+                         [["github.com/org/repo/pkg/a.go"], ["github.com/org/repo/pkg/b.go"]])+        # block 3..5 count 1, block 5..7 count 0: line 5 keeps the maximum+        self.assertEqual(cov[0].hits, {3: 1, 4: 1, 5: 1, 6: 0, 7: 0})+        self.assertEqual(cov[1].hits, {1: 0})++    def test_coverprofile_count_mode_takes_maximum_on_overlap(self) -> None:+        cov = self.parse("coverage.out", COVERPROFILE_COUNT)+        self.assertEqual(len(cov), 1)+        self.assertEqual(cov[0].hits, {3: 4, 4: 4, 5: 9, 6: 9})++    def test_coverprofile_without_mode_line_is_rejected(self) -> None:+        cov = self.parse("coverage.out", "a.go:1.1,2.1 1 1\n")+        self.assertEqual(cov, [])+        self.assertEqual(len(self.warnings.items), 1)+        self.assertIn("coverage.out", self.warnings.items[0])++    def test_cobertura_doctype_is_rejected(self) -> None:+        cov = self.parse("coverage.xml", "<!DOCTYPE coverage><coverage/>")+        self.assertEqual(cov, [])+        self.assertIn("DOCTYPE", self.warnings.items[0])++    def test_malformed_xml_warns(self) -> None:+        cov = self.parse("coverage.xml", "<coverage><packages></coverage>")+        self.assertEqual(cov, [])+        self.assertIn("coverage.xml", self.warnings.items[0])++    def test_unknown_xml_root_warns(self) -> None:+        cov = self.parse("junit.xml", "<testsuite/>")+        self.assertEqual(cov, [])+        self.assertIn("junit.xml", self.warnings.items[0])++    def test_unrecognised_format_warns(self) -> None:+        cov = self.parse("notes.txt", "hello\n")+        self.assertEqual(cov, [])+        self.assertIn("notes.txt", self.warnings.items[0])++    def test_missing_file_warns(self) -> None:+        cov = parse_coverage(self.dir / "absent.info", self.warnings)+        self.assertEqual(cov, [])+        self.assertIn("absent.info", self.warnings.items[0])+++class PathMapTest(unittest.TestCase):+    def test_normalise(self) -> None:+        self.assertEqual(normalise("./src\\a.py"), "src/a.py")+        self.assertEqual(normalise("src//pkg/../a.py"), "src/a.py")+        self.assertEqual(normalise("/abs/./x.go"), "/abs/x.go")++    def test_strip_and_prepend_on_primary_and_aliases(self) -> None:+        cov = [entry("./src\\pkg/a.py", "/ci/repo/src/pkg/a.py", "srcx/pkg/a.py")]+        mapped = apply_path_map(cov, "src", "lib")+        self.assertEqual(mapped[0].paths,+                         ["lib/pkg/a.py", "lib/ci/repo/src/pkg/a.py", "lib/srcx/pkg/a.py"])+        self.assertIs(mapped[0].hits, cov[0].hits)++    def test_strip_only_whole_segments(self) -> None:+        cov = [entry("srcx/a.py"), entry("src/a.py"), entry("src")]+        self.assertEqual([e.paths for e in apply_path_map(cov, "src/", None)],+                         [["srcx/a.py"], ["a.py"], ["src"]])++    def test_no_map_only_normalises(self) -> None:+        cov = [entry("./a\\b.py")]+        self.assertEqual(apply_path_map(cov, None, None)[0].paths, ["a/b.py"])+++class MatchTest(unittest.TestCase):+    def test_exact_match_leaves_the_pool(self) -> None:+        cov = [entry("src/a.py", hits={1: 1})]+        hits, unmatched = match(cov, ["src/a.py", "pkg/src/a.py"])+        self.assertEqual(hits, {"src/a.py": {1: 1}})+        self.assertEqual(unmatched, {"pkg/src/a.py": "no candidate"})++    def test_exact_match_beats_suffix_candidates(self) -> None:+        cov = [entry("a/util.py", hits={1: 1}), entry("x/a/util.py", hits={2: 1})]+        hits, unmatched = match(cov, ["a/util.py"])+        self.assertEqual(hits, {"a/util.py": {1: 1}})+        self.assertEqual(unmatched, {})++    def test_exact_alias_equal_to_two_files_is_ambiguous_for_both(self) -> None:+        cov = [entry("a.py", "src/a.py", hits={1: 1})]+        hits, unmatched = match(cov, ["a.py", "src/a.py"])+        self.assertEqual(hits, {})+        self.assertEqual(unmatched, {"a.py": "ambiguous", "src/a.py": "ambiguous"})++    def test_shared_entry_removed_once_and_both_files_ambiguous(self) -> None:+        cov = [entry("util.py", hits={1: 1})]+        hits, unmatched = match(cov, ["a/util.py", "b/util.py"])+        self.assertEqual(hits, {})+        self.assertEqual(unmatched, {"a/util.py": "ambiguous", "b/util.py": "ambiguous"})++    def test_shared_removal_does_not_cascade(self) -> None:+        # util.py sits in both pools and is removed once; a/util.py stays+        # unique to src/a/util.py, which must match it.+        cov = [entry("util.py", hits={1: 1}), entry("a/util.py", hits={2: 1})]+        hits, unmatched = match(cov, ["src/a/util.py", "src/util.py"])+        self.assertEqual(hits, {"src/a/util.py": {2: 1}})+        self.assertEqual(unmatched, {"src/util.py": "ambiguous"})++    def test_distinct_residuals_are_ambiguous(self) -> None:+        cov = [entry("v1/a.py", hits={1: 1}), entry("v2/a.py", hits={1: 1})]+        hits, unmatched = match(cov, ["a.py"])+        self.assertEqual(hits, {})+        self.assertEqual(unmatched, {"a.py": "ambiguous"})++    def test_equal_residuals_merge_by_summing_hits(self) -> None:+        cov = [entry("/ci/repo/src/a.py", hits={1: 1, 2: 0}),+               entry("/ci/repo/src/a.py", hits={2: 3, 4: 0})]+        hits, unmatched = match(cov, ["src/a.py"])+        self.assertEqual(hits, {"src/a.py": {1: 1, 2: 3, 4: 0}})+        self.assertEqual(unmatched, {})++    def test_changed_path_longer_than_entry_matches(self) -> None:+        cov = [entry("pkg/a.go", hits={5: 2})]+        hits, unmatched = match(cov, ["cmd/pkg/a.go"])+        self.assertEqual(hits, {"cmd/pkg/a.go": {5: 2}})++    def test_partial_segment_is_not_a_suffix(self) -> None:+        cov = [entry("xa.py", hits={1: 1})]+        hits, unmatched = match(cov, ["a.py"])+        self.assertEqual(hits, {})+        self.assertEqual(unmatched, {"a.py": "no candidate"})++    def test_alias_can_carry_the_suffix_match(self) -> None:+        cov = [entry("a.py", "/ci/repo/src/a.py", hits={1: 1})]+        hits, unmatched = match(cov, ["src/a.py"])+        self.assertEqual(hits, {"src/a.py": {1: 1}})++    def test_paths_are_normalised_before_matching(self) -> None:+        cov = [entry(".\\src\\a.py", hits={1: 1})]+        hits, unmatched = match(cov, ["./src/a.py"])+        self.assertEqual(hits, {"./src/a.py": {1: 1}})++    def test_empty_coverage_reports_no_candidate(self) -> None:+        hits, unmatched = match([], ["a.py"])+        self.assertEqual(hits, {})+        self.assertEqual(unmatched, {"a.py": "no candidate"})+++class MatchPropertyTest(unittest.TestCase):+    SEGMENTS = ["src", "pkg", "a", "b", "lib", "x"]+    NAMES = ["util.py", "main.py", "a.py"]++    def random_path(self, rng: random.Random) -> str:+        depth = rng.randint(0, 3)+        segs = [rng.choice(self.SEGMENTS) for _ in range(depth)]+        return "/".join(segs + [rng.choice(self.NAMES)])++    def test_each_file_and_entry_used_at_most_once_and_order_independent(self) -> None:+        for seed in range(200):+            rng = random.Random(seed)+            changed = list({self.random_path(rng) for _ in range(rng.randint(1, 5))})+            # sentinel line numbers identify which entries contributed+            cov = [Entry([self.random_path(rng)] + [self.random_path(rng) for _ in range(rng.randint(0, 1))],+                         {1000 + i: 1})+                   for i in range(rng.randint(0, 6))]+            hits, unmatched = match(cov, changed)+            self.assertEqual(set(hits) | set(unmatched), set(changed), seed)+            self.assertEqual(set(hits) & set(unmatched), set(), seed)+            seen: dict[int, str] = {}+            for path, merged in hits.items():+                self.assertTrue(merged, seed)+                for line in merged:+                    self.assertNotIn(line, seen, f"seed {seed}: entry used by {seen.get(line)} and {path}")+                    seen[line] = path+            for reason in unmatched.values():+                self.assertIn(reason, ("no candidate", "ambiguous"))++            shuffled_cov = list(cov)+            rng.shuffle(shuffled_cov)+            shuffled_changed = list(changed)+            rng.shuffle(shuffled_changed)+            hits2, unmatched2 = match(shuffled_cov, shuffled_changed)+            self.assertEqual(hits2, hits, seed)+            self.assertEqual(unmatched2, unmatched, seed)+++class ArithmeticTest(unittest.TestCase):+    def test_diff_coverage_counts_only_added_lines_with_data(self) -> None:+        self.assertEqual(diff_coverage({1, 2, 3, 4}, {1: 1, 2: 0, 3: 5, 9: 1}), (2, 3))++    def test_diff_coverage_zero_denominator_is_none(self) -> None:+        self.assertIsNone(diff_coverage({1, 2}, {3: 1}))+        self.assertIsNone(diff_coverage(set(), {1: 1}))+        self.assertIsNone(diff_coverage({1}, {}))++    def test_overall_merges_repeated_entries_by_normalised_primary_path(self) -> None:+        cov = [Entry(["src/a.py"], {1: 1, 2: 0}),+               Entry(["./src\\a.py"], {2: 2, 3: 0}),+               Entry(["b.py", "src/a.py"], {1: 0})]+        # a.py: lines 1,2,3 with 2 covered; b.py: line 1 uncovered+        self.assertEqual(overall(cov), (2, 4))++    def test_overall_empty(self) -> None:+        self.assertEqual(overall([]), (0, 0))+++if __name__ == "__main__":+    unittest.main()