[polewskm]

Findings get an optional suggestion: { startLine, endLine, replacement }. Specialists fill it only for a mechanical fix of 5 lines or fewer, and synthesis keeps it unchanged when it merges. placeFindings attaches it only when every line in the range is added by the pull request, the range holds the finding's line, and the comment wasn't snapped. The comment then spans start_line/line with a ```suggestion block, and the fence is longer than any run of backticks in the code. Otherwise the prose fix stands alone. The hidden marker gains reviewer=<names>. parsePosted reads the last marker in a comment, so an older comment without the field still parses and dedupes.

Decisions

• The engine also enforces the 5-line limit: a range or replacement over 5 lines, or a range that doesn't include the finding's own line, is dropped to prose.
• No code fallback restores a suggestion that synthesis left out. Synthesis is told to keep it and may drop it when it changes the fix.
• A one-line suggestion posts with line only. GitHub requires start_line < line.

Not verified: applying a suggestion on a real pull request on GitHub, which this environment can't do, including GitHub's handling of a fence longer than three backticks.

Closes #54

[ncode-review]

🤖 NCode Review at 0ce9bf6: 8 new findings on the changed lines.

[ncode-review]

🤖 Review complete

Verdict: 💬 Comment — This PR adds an optional suggestion to findings. When the fix replaces at most five lines that the PR itself added, around the finding's own line, it is posted as a one-click GitHub suggestion block. The inline marker now also records the reviewers, and markers posted before this change still parse. The design holds together: validation in usableSuggestion is strict and well tested, the backtick fence is sized safely, and taking the last marker stops planted markers from passing as the real one. The main open question is whether code written by the model should get an apply button with no content check or label.

8 reviewers run — 4 findings (run details)

Reviewer	Model	Findings	Top
synthesis	opus-5-5	4	🟠
architecture	sonnet-5-5	0	🟢
completeness	sonnet-5-5	0	🟢
conventions	sonnet-5-5	0	🟢
correctness	sonnet-5-5	0	🟢
data-model	haiku-5-5	0	🟢
hygiene	haiku-5-5	2	🟡
rule-check	sonnet-5-5	1	🟡
security	sonnet-5-5	1	🟠

Skipped: api-compat, infrastructure, intent, performance, tests

Findings

• 🟠 F1 src/threads.ts:100: Model-written suggestion code gets a one-click apply button with no content check
• 🟡 F2 CHANGELOG.md:9: Is Post a suggestion block for a mechanical fix of a few lines #54 the right issue for this entry?
• 🟡 F3 test/engine.test.ts:715: Old-marker test checks both parsing and dedup
• 🟡 F4 src/review.ts:81: Schemas exported only for a test

_{Trial: findings are posted as review threads and in the check run. $0.46 on Amazon Bedrock, 60s, at 6c9d1b8. (how to interact)}

[polewskm]

/review

[ncode-review]

🤖 NCode Review at 892f0c3: 4 new findings on the changed lines.

[polewskm]

Autopilot: Round 2 answered. No blocker or should-fix is left open; the remaining threads are nits, answered above. Recommend merging once you've resolved them.

[ncode-review]

🤖 NCode Review at 6c9d1b8: 3 new findings on the changed lines.
1 more was already posted on this pull request.

[polewskm]

Autopilot: answering F4 (src/review.ts:81: Schemas exported only for a test) in #63 (comment), which has no thread of its own: declined: specialistSchema and synthesisSchema were exported in round 2 to answer the earlier request for a test that suggestion stays optional (#63 (comment)); un-exporting them would undo that, and the review-round limit (3) is reached. F1–F3 are answered on their threads.

[polewskm]

Autopilot: Round 3 answered. The review-round limit (3) is reached; no verified blocker or should-fix showing a defect in this PR's behavior is left open. The repeated security finding is declined as a design choice of #54 (a generated-suggestion note could be a follow-up issue), and the remaining threads are nits, answered above. The branch is up to date with main (488436d). Recommend merging once you've resolved them.