Complete Diff Improvements Phase B audit

[pandemicsyn]

Outcome

• Completes the final Diff Improvements Phase B audit across the shared review source, surface, finding, navigation, and refresh contracts and the focused GitHub PR, prepared-diff, and prepared-backed Kilo/worktree surfaces.
• Reconciles the Phase B plan, retained static frontend report, performance record, and deviation log without deleting historical findings, measurements, sequence items, or later phases.
• Leaves Phases C–E explicitly planned and unstarted at the user-selected Phase B stopping milestone.

Corrections

• Keeps an already-applied prepared-diff review and its approval/recovery context mounted when a background metadata refresh fails, while surfacing the refresh error. Adds focused regression coverage and a patch changeset.
• Updates the local GitHub route cache fixture to bind both base and head SHAs, matching the revision-v2 cache contract landed in PR feat: keep review refresh revision-safe #154.
• Qualifies the 30-second worktree fingerprint poll truthfully: cadence and changed-path query scope are bounded, but full-file content hashing remains byte- and time-unbounded for pathological huge changed files.

Verification

All commands used Node 26.4.0.

• Focused Phase B unit/component/API suite: 17 files passed, 178 tests passed.
• Prepared refresh regression file: 12 tests passed.
• Route safety/API test after the isolated fixture correction: 22 tests passed.
• npm run typecheck:app: passed.
• npm run lint: passed.
• Targeted Prettier checks, git diff --check, and standalone HTML/jsdom integrity validation: passed. The HTML retains 32 findings, 26 non-performance findings, 14 sequence items, and no duplicate IDs.
• npm run verify: run exactly once. Layer, database, TypeScript, docs, and lint gates passed. The unit stage reported 107 files passed / 1 failed and 705 tests passed / 1 failed because the pre-PR feat: keep review refresh revision-safe #154 route fixture expected two fetches without supplying the newly required base SHA. That stale fixture was then corrected and the smallest affected src/app-routes.test.ts check passed 22/22. Per the audit policy, the full suite was not rerun.

Retained performance evidence and misses

• Lead rerun of npm run bench:review-fixtures: large committed-PR medians were 41.9 ms tree, 163.7 ms first patch, and 0 ms in-process thread projection, inside the 500/1,000/500 ms fixture budgets. This harness exercises pr-local-diffs only.
• Exact-head 305-file worktree approximation on Node 26.4.0/arm64: repo/prepared metadata medians 140.9/137.0 ms and scoped active-patch medians 179.1/177.2 ms, all inside the 500 ms tree and 1,000 ms patch budgets. The fixture contained 120 modified, 30 deleted, 25 renamed, and 130 added files and exercised the production B5 stable-read/revision paths.
• Historical deterministic and real-PR values remain untouched. Production tree visibility, one-time cold-object fetch, and uncached review-thread latency remain explicit retained misses, not relabeled passes.

Deviations and stopping handoff

• Records the bounded prepared-refresh correction and the deferred byte/time-unbounded fingerprint limitation in .plans/DEVIATIONS.md.
• No caching or hard content bound was introduced because that changes revision identity/freshness semantics and requires lead/product-owner discussion.
• Phase B is complete. This PR intentionally stops before Phase C changeset mode, Phase D source-aware depth, and Phase E TUI reuse. It does not merge or enable auto-merge.