feat(review): content-anchored incremental rounds for the local review-fix loop

packages/cli/src/commands/review/capture-local.test.ts

@@ -19,6 +19,7 @@ import { DEADLINE_ENV } from './lib/deadline.js';
 
 const captureMock = vi.hoisted(() => vi.fn());
 const settingsMock = vi.hoisted(() => vi.fn(() => ({ merged: {} })));
+const visibilityMock = vi.hoisted(() => vi.fn((): string[] | null => []));
 vi.mock('../../config/settings.js', async (orig) => ({
   ...(await orig<Record<string, unknown>>()),
   loadSettings: settingsMock,
@@ -27,6 +28,15 @@ vi.mock('./lib/local-diff.js', async (orig) => ({
   ...(await orig<Record<string, unknown>>()),
   captureLocalDiff: captureMock,
 }));
+// The git layer is tested elsewhere (the integration suites run a real
+// repository); the scratch directory here is not one. The visibility-bit
+// oracle answers "no tracked path carries a bit" — the shape a clean tree
+// has — because without an answer the stops must fail closed, and the
+// tests below pin the clean claim.
+vi.mock('./lib/local-anchor.js', async (orig) => ({
+  ...(await orig<Record<string, unknown>>()),
+  invisibleTrackedPaths: visibilityMock,
+}));
 
 const { captureLocalCommand } = await import('./capture-local.js');
 
@@ -69,6 +79,8 @@ beforeEach(() => {
   cwd = process.cwd();
   process.chdir(dir);
   errs = [];
+  visibilityMock.mockReset();
+  visibilityMock.mockReturnValue([] as string[]);
   vi.spyOn(process.stderr, 'write').mockImplementation((chunk) => {
     errs.push(String(chunk));
     return true;
@@ -83,6 +95,40 @@ afterEach(() => {
   rmSync(dir, { recursive: true, force: true });
 });
 
+describe('capture-local — the re-captures\u2019 skipped lists ride the guard', () => {
+  it('withholds the stop when only a RE-capture skipped content', () => {
+    // R21-2: the sampling loop kept only `.diff` from re-captures 1 and 2 —
+    // an unreviewable file entering the window lands in `skipped`, never in
+    // the diff BYTES, so the byte comparison read "held still" and the
+    // decided stops fired over content two of the three captures skipped.
+    // Skip-set movement is tree movement.
+    let call = 0;
+    captureMock.mockImplementation(() => {
+      call += 1;
+      return {
+        diff: Buffer.from('', 'utf8'),
+        untracked: [],
+        skipped:
+          call === 1
+            ? []
+            : [{ path: 'huge.bin', bytes: 1, reason: 'over the cap' }],
+        unbornHead: false,
+        repoRoot: dir,
+      };
+    });
+    run('plan.json');
+
+    const plan = JSON.parse(readFileSync(join(dir, 'plan.json'), 'utf8'));
+    expect(plan.nothingToReview).toBeUndefined();
+    expect(existsSync(join(dir, '.qwen/tmp/qwen-review-local-stop.json'))).toBe(
+      false,
+    );
+    expect(errs.join('')).toContain(
+      'the working tree changed while the capture was being hashed',
+    );
+  });
+});
+
 describe('capture-local (command boundary)', () => {
   it('writes the diff and a plan the review can read', () => {
     capture();
@@ -209,6 +255,32 @@ describe('capture-local (command boundary)', () => {
     expect(plan.effort).toBeUndefined();
   });
 
+  it('withholds the cache candidate when the visibility bits cannot be enumerated', () => {
+    // The candidate records the identity of the tree this round reviewed;
+    // an oracle the capture cannot run leaves that identity uncertified, so
+    // the write fails closed exactly like the decided stops do.
+    capture();
+    visibilityMock.mockReturnValue(null);
+    run('plan.json');
+    expect(
+      existsSync(join(dir, '.qwen/tmp/qwen-review-local-cache-candidate.json')),
+    ).toBe(false);
+    expect(errs.join('')).toContain('could not be enumerated');
+  });
+
+  it('withholds the cache candidate while tracked paths carry a visibility bit', () => {
+    // `hash-object` reads through a set --assume-unchanged/--skip-worktree
+    // bit while `git diff` cannot see the edit it hides — the candidate
+    // would record the identity of bytes this round never reviewed.
+    capture();
+    visibilityMock.mockReturnValue(['src/pay.ts']);
+    run('plan.json');
+    expect(
+      existsSync(join(dir, '.qwen/tmp/qwen-review-local-cache-candidate.json')),
+    ).toBe(false);
+    expect(errs.join('')).toContain('the cache candidate is withheld');
+  });
+
   it('escapes a filename carrying terminal control characters', () => {
     // A filename is workspace-controlled, and git permits an ESC or a newline in
     // one. Printed raw it can forge a second warning line or drive the user's