Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers

[MarketingChronoAi]

Problem

The controller records blocked rows and review evidence, but there is no general repeated-blocker cap for reviewer redispatch. If the same reviewer role keeps producing the same reject/comment class for the same PR/head, the loop may keep spawning new reviewers instead of taking the next productive action.

Confirmed missing behavior

• No normalized repeated-blocker signature.
• No threshold for same blocker repeated N times.
• No forced transition from repeated review blocker to review-fix or human-blocked.

Evidence

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py: _blocked() records blocked rows but does not enforce a repeated-blocker threshold.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py: _record() writes ledger entries without a repeated-blocker cap.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py: redispatch planning is based on missing/stale live-head evidence, not blocker signature repetition.

Suggested fix

• Store normalized blocker signatures keyed by PR number, head SHA, role, verdict, and concise blocker reason.
• After the same blocker repeats 2 or 3 times, stop review redispatch.
• If the blocker is actionable, dispatch review-fix.
• If the blocker is non-actionable or requires maintainer judgment, mark human-blocked.

Acceptance criteria

• Repeating the same role/verdict/blocker does not produce unlimited new reviewer rounds.
• The controller records a durable repeated_review_blocker decision.
• Tests cover repeated reject and repeated comment outcomes.

Review status

This was independently reviewed in /Users/chronoai/Desktop/proposed-main-repo-issues-review-gate.md and classified high confidence.

⟦AI:AUTO-LOOP⟧
ISSUE_RAISED:review-gate-hardening:repeated-review-blockers

[MarketingChronoAi]

crnd:default-issue-intake-claim

First claimer: MarketingChronoAi

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Minimal solver proposes planner-side repeated blocker cap

TL;DR

• What this is: Minimal-change design solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: The violation is real; review_evidence_redispatch_actions can keep producing reviewer redispatch actions without a normalized repeated-blocker cap.
• What the controller does next: Compare this with the other solver outputs and pick whether to implement the planner-side cap.

---

Minimal framing

I recommend adding the cap at the planner projection point that creates review-evidence-redispatch, not in the runner after dispatch. review_evidence_redispatch_actions is the function that decides whether missing or stale reviewer evidence should spawn more reviewers, so it is the smallest boundary that can stop repeated identical blockers before more work is queued.

Relevant source checks:

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2668 matters because this function computes stale reviewer roles and appends the dispatch_reviewers action.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1847 matters because existing review-gate logic already routes a live-head reject verdict to FIX.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437 matters because the runner already dispatches review-fix when review-gate returns FIX.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2329 matters because runner blocked rows are recorded after action validation, which is too late to prevent planner redispatch churn.

Planned shape:

Case	Planner decision	Trade-off
Same PR/head/role/verdict/blocker repeats with reject	Stop reviewer redispatch and route through existing review_gate fix path	Reuses current fix mechanism, no new lifecycle action
Same PR/head/role/verdict/blocker repeats with comment and no actionable reject	Stop reviewer redispatch and record repeated_review_blocker as human-blocked	Avoids pretending repeated non-actionable comments are implementation progress
Non-repeated stale reviewer evidence	Keep current targeted redispatch	Preserves existing recovery behavior

Estimated implementation cost: about +90 / -5 LOC, touching wakeup_plan.py and test_wakeup_plan.py. No governance/ruleset change is needed.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 42
cluster: issue-42
verdict: propose
---

## Recommended framing
最小可行边界是在 `wakeup_plan.py` 的 reviewer redispatch projection 前加一个重复 blocker 判定：基于同一 PR、同一 head SHA、同一 reviewer role、同一 verdict、同一短 blocker reason 生成规范化签名，达到 2 次后不再生成 `dispatch_reviewers`，而是生成一个持久 `repeated_review_blocker` blocked decision；如果 verdict 是 `reject`，保留现有 review-gate FIX 路径，让 runner 走 `review_gate`/review-fix，而不是继续补 reviewer。这个改动直接落在产生无限 reviewer rounds 的规划点，避免扩大 runner 生命周期权限或把 `.refactor-loop/host.env` 变成生产 SSOT。

## Concrete plan
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py`: add a small normalized review blocker signature helper, count matching prior local/GitHub review evidence for candidate stale roles, and suppress `review-evidence-redispatch` once threshold is reached. Emit a blocked action/document with `kind: repeated_review_blocker`, `reason: repeated_review_blocker:<role>:<verdict>:<signature>`, `target_number`, `head_sha`, `role`, `verdict`, `blocker_reason`, and `next_action` set to `review_gate` for actionable reject or `human-blocked` for non-actionable comment/no-action cases.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py`: no primary change required. Existing `_review_gate_decision()` already maps any live-head reject to `FIX` at lines 1847-1877, `_dispatch()` already dispatches review-fix for `review_gate` FIX at lines 1437-1440, and `_blocked()`/`_record()` only records runner-applied blocks at lines 2329-2344.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: add focused regression tests for repeated reject and repeated comment signatures.
- LOC delta: ~+90 / -5.
- Tests to add/modify:
  - Add `test_repeated_reject_review_blocker_routes_to_review_gate_without_reviewer_redispatch` in `test_wakeup_plan.py`.
  - Add `test_repeated_comment_review_blocker_records_human_blocked_without_reviewer_redispatch` in `test_wakeup_plan.py`.
  - Existing `test_reviewing_pr_with_stale_reviewer_head_projects_targeted_redispatch`-style coverage remains the non-repeated control case.
- Governance/ruleset change (if any): none.
- Migration path: no migration needed; the signature can be recomputed from existing review artifacts/comments and the durable decision is written through the existing wakeup-plan blocked/projection output path.

## Risks
- Counting repeated comments from free-form reviewer prose requires normalization. Keep it conservative: use verdict marker plus the first explicit blocker line if present, otherwise a short normalized prefix from the review body, capped to a small byte length.
- A threshold of 2 stops churn quickly but may escalate after one duplicated low-quality review. Make the threshold a module constant, not host config, to avoid new runtime SSOT.
- `comment` verdicts are not always blockers. Only route them to human-blocked when they repeat with the same normalized blocker reason and no reject is present; otherwise preserve existing wait/merge behavior.
- Planner-only enforcement stops new redispatch projections but does not retroactively clean existing queued spawn intents. That is acceptable for the minimum fix because pending intent suppression already prevents duplicate live intent creation for the same role/head.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Reference-frame note: circuit breaker / idempotency key pattern for distributed controllers; repeated identical failure signals should become a bounded terminal decision, not unbounded redispatch.
- Why this is the minimum: the unbounded action is created in `review_evidence_redispatch_actions()` at `wakeup_plan.py` lines 2668-2717, and `build_plan()` writes safe-progress blocked output at lines 5145-5169. Adding suppression there prevents the bad action before runner dispatch, while reusing existing review-gate FIX behavior for rejects.
- What I considered but rejected: adding a new runner ledger subsystem in `_record()`; it records applied actions after validation and is too late to stop planner churn. Adding host config for thresholds; unnecessary and would risk turning runtime config into production authority. Creating a new controller action; unnecessary because `review_gate` already dispatches review-fix for reject.
- What I cannot decide alone: the exact blocker-reason extraction grammar reviewers should use long-term. The minimal implementation can start with conservative normalization and let future work improve structured reviewer fields if needed.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:Add planner-side repeated review blocker cap that routes repeated rejects to review-gate fix and repeated comments to human-blocked without redispatching reviewers

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Structural solver proposes a repeated-review-blocker circuit breaker

TL;DR

• What this is: Structural design solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: I recommend a small shared projection that records repeated reviewer blocker signatures and suppresses further reviewer redispatch at a threshold.
• What the controller does next: The consensus judge can compare this against the other solver outputs and select either implementation or maintainer-blocked routing.

---

Structural recommendation

The current controller has a retry predicate for reviewer evidence: if a PR lacks a complete live-head review round, review_evidence_redispatch_actions() can emit another dispatch_reviewers action. dispatch_reviewers is the controller command that starts reviewer workers. The missing structure is a durable read model for repeated review blockers, so the planner can distinguish "missing reviewer evidence" from "the same reviewer already rejected or commented on the same head for the same reason twice."

I recommend adding ReviewBlockerSignature, a compact key made from PR number, head SHA, reviewer role, verdict, and normalized blocker reason. The runner should persist those signatures in wakeup-runner-ledger.jsonl, which is the controller's durable action ledger, and the planner should consult them before creating another reviewer dispatch. When the same signature reaches the threshold, the planner should emit a repeated_review_blocker decision and route to review-fix when actionable, or human-blocked when the blocker needs maintainer judgment.

Relevant verified source points:

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664 matters because review_evidence_redispatch_actions() currently creates reviewer redispatch actions from missing or stale review evidence.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 matters because _record() currently writes only action id, status, reason, kind, and timestamp to the ledger.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437 matters because the existing review_gate path already routes FIX decisions to review-fix, so the new cap can reuse that lifecycle path.
• /Users/chronoai/Desktop/codex/AGENTS.md:366 and /Users/chronoai/Desktop/codex/AGENTS.md:372 matter because MIL-011 and MIL-012 require a recorded mode/stop state and prohibit repeated artifacts without new evidence.

Option	Trade-off
Add shared review_blockers.py projection	About +230/-15 LOC total, but runner and planner share one signature definition and tests can cover the loop break directly.
Add a local counter inside wakeup_plan.py	Less code initially, but duplicates review evidence parsing and leaves the runner ledger under-specified.
Only document a retry cap	No behavioral guarantee; the old stale/missing evidence predicate can still spawn more reviewer rounds.

Recommended implementation scope: one new projection module, small ledger enrichment in wakeup_runner.py, one guard in review_evidence_redispatch_actions(), and focused tests for repeated reject plus repeated comment outcomes. No external API or schema change is needed; old ledger rows remain readable because new fields are optional.

📎 Full raw codex output (archival)

---

solver: structural
issue: 42
cluster: issue-42
verdict: propose

PROJECT_RULES clause violated (quoted verbatim)

• FI-004 Facts that cross processes, turns, or nodes must have an authoritative record; in-process memory, caches, and temporary variables must not masquerade as fact sources.

• FI-005 Boundaries take precedence over convenience; responsibility, layering, protocol, and state ownership must be clear, and shortcut layers must not bypass the main path.

• MIL-011 Exactly one active mode is required. Every loop tick must record one
  action_mode: identify, plan, implement, triage, or human-blocked.
  The productive modes are only identify, plan, and implement. triage
  and human-blocked are allowed stop states, not progress substitutes. A tick
  that opens no issue, writes no plan, changes no branch, raises no PR, and
  records no triage/blocker audit is invalid.

• MIL-012 Repetition is forbidden across issues, branches, and artifacts. Before
  acting, compare the canonical key plus normalized title, upstream mirror
  reference, error signature, target files, existing managed issue numbers,
  branches, PRs, and ledger entries. If the same key or fingerprint appears
  without new reproducer evidence, link the existing record and stop; do not
  create a fresh issue, branch, solver round, implementation artifact, or close
  comment for the duplicate.

• MIL-014 A durable progress record is mandatory for each action. Each issue,
  plan, implementation attempt, triage decision, and 12-hour audit must record:
  timestamp/window, action_mode, canonical key, local issue number, upstream
  reference if any, duplicate search summary, branch, PR, commit, unique diff
  status, tests/verification, resolution, next action, and evidence links. This
  record is the source of truth for deciding whether the next tick may proceed
  autonomously.

Recommended framing

Add a controller-private repeated-review-blocker projection, not another redispatch exception. The projection should treat repeated reviewer reject/comment evidence as a durable circuit-breaker decision keyed by PR, head SHA, role, verdict, and normalized blocker reason. wakeup_runner.py already owns applied/blocked ledger writes and wakeup_plan.py already owns review-evidence-redispatch projection, so the clean structure is a small shared module that both paths call: the runner records the blocker signature when reviewer evidence is observed or a review gate waits, and the planner consults the projected repetition count before emitting another dispatch_reviewers action. At the threshold, the planner emits exactly one bounded next action: review_gate/review-fix when the blocker is actionable, otherwise a durable repeated_review_blocker human-blocked decision. This eliminates the loop by construction because stale/missing evidence is no longer the only planner predicate.

Concrete plan

• New abstractions (if any): ReviewBlockerSignature dataclass with fields pr_number, head_sha, role, verdict, reason_digest, reason_text; RepeatedReviewBlockerDecision dataclass with fields signature, count, threshold, route, actionable, sources; project_repeated_review_blockers(repo_root, pr_number, head_sha, evidences, ledger_rows, threshold=2) -> list[RepeatedReviewBlockerDecision]. Layer: controller read-model/projection. Project: consensus-loop skill scripts. File: scripts/codex_refactor_loop/review_blockers.py.
• Files: /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_blockers.py add the normalization/projection module; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py enrich _record() rows for review-related actions with target_kind, target_number, head_sha, review_blocker_signatures, and write WAKEUP_RUNNER_REPEATED_REVIEW_BLOCKER:<pr>:<head>:<role>:<verdict>:<digest>:<route> when the cap trips; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py consult the projection inside review_evidence_redispatch_actions() before appending review-evidence-redispatch; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py optionally expose a small helper that returns selected live-head comment/reject evidences without duplicating parsing; /Users/chronoai/.claude/skills/consensus-loop/scripts/test_review_blockers.py add focused projection tests; /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py add planner behavior tests; /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py add ledger/event behavior tests.
• LOC delta: ~+230 / -15. New module ~150 LOC, runner changes ~45 LOC, planner changes ~30 LOC, tests ~120 LOC. Net production code stays under ~250 LOC and does not touch .refactor-loop/host.env or host production SSOT.
• Tests to add: test_review_blockers.py::test_same_pr_head_role_verdict_reason_reaches_threshold asserts two matching reject signatures project one decision; test_review_blockers.py::test_reason_normalization_collapses_whitespace_urls_and_line_numbers asserts concise blocker reason stability; test_review_blockers.py::test_different_head_or_role_does_not_count asserts the key boundary; test_wakeup_plan.py::test_repeated_reject_suppresses_review_evidence_redispatch_and_routes_fix asserts no dispatch_reviewers action is produced and a review-fix route is projected for actionable evidence; test_wakeup_plan.py::test_repeated_comment_suppresses_redispatch_and_marks_human_blocked_when_non_actionable asserts durable human-blocked output; test_wakeup_runner_review_gate.py::test_repeated_review_blocker_ledger_row_records_target_head_and_signature asserts _record() persists bounded fields instead of only action_id/status/reason/kind.
• Schema/protocol changes (if any): none for external APIs. Internal ledger rows gain optional backward-compatible keys: target_kind, target_number, head_sha, action_mode, review_blocker_signatures, repeated_review_blocker. Old rows remain readable because the projection ignores missing optional keys.
• Governance/ruleset changes (if any): none. The proposed behavior implements FI-004, FI-005, MIL-011, MIL-012, and MIL-014 without changing their wording or moving any SSOT into .refactor-loop/host.env.
• Runtime cost: one linear scan of wakeup-runner-ledger.jsonl per open PR considered for review redispatch, capped in implementation to the newest 2000 rows or newest 50 matching review rows per PR/head; at typical ledger sizes this is <5 ms local IO. Signature normalization allocates O(number of live-head review evidences) short strings; expected 3-9 signatures per PR. No additional network request is required beyond the existing GitHub comment/readiness calls. No actor hop is added.
• If the structural answer is issue decomposition, use the controller-private IssueDecompositionPlan boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any wakeup_plan.py decompose action/projection.
• Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in refactor(history-overlay): split into modular functions & add tests (fixes #402) openai/codex#403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.

Risks

• This framing intentionally adds a named projection module instead of a local if count >= 2 branch in wakeup_plan.py; the trade-off is ~150 LOC of structure for a reusable, testable read model shared by runner and planner.
• Reason normalization can over-collapse distinct blockers if it is too aggressive. Keep normalization bounded to lowercase, whitespace folding, URL/path line-number elision, and a 160-character text cap plus digest; do not use model summarization or fuzzy matching.
• Actionable vs non-actionable routing can become policy-heavy. Keep v1 deterministic: reject is actionable unless the reason contains explicit maintainer-decision terms such as human, maintainer, credentials, policy, ambiguous, or cannot decide; repeated comment defaults to human-blocked unless the existing review gate already decides FIX.
• The ledger is skill-private runtime state, not host production SSOT. The implementation must treat it as the controller's durable action record under MIL-014, not as branch topology, host path, or maintainer authority.

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Reference-frame note: control-loop circuit breaker plus idempotent command projection. Mature shape: detect repeated equivalent failure signals, persist a compact signature, and transition to a different bounded state instead of retrying the same command.
• Why this structure beats a documented exception: a documented exception would still leave review_evidence_redispatch_actions() using only missing/stale reviewer-head evidence, so the controller could continue to satisfy the old predicate forever. A projection changes the predicate: repeated blockers become a first-class stop/route condition before redispatch is created.
• Why I picked this abstraction over alternatives: the issue names three concrete callers/surfaces: _blocked()/_record() for durable rows, review_evidence_redispatch_actions() for planner redispatch, and existing review-fix/human-blocked routes for next action. A single review_blockers.py read model lets those surfaces share the signature definition without plumbing review policy through unrelated controller layers.
• What I cannot decide alone: the exact threshold default could be 2 or 3. I recommend 2 for same PR/head/role/verdict/reason because the key is narrow and a third identical reviewer round spends one more worker without adding evidence. Maintainers can tune the constant if they prefer one extra confirmation round.
  ⟦AI:AUTO-LOOP⟧
  SOLVER_DONE:structural:propose:add-durable-repeated-review-blocker-projection-and-route-before-reviewer-redispatch

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Delete solver abstains: keep reviewer redispatch, add a cap elsewhere

TL;DR

• What this is: Delete-role design solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: I found no safe deletion; reviewer redispatch is load-bearing recovery for stale or missing live-head review evidence.
• What the controller does next: Compare this abstain with the minimal/structural proposals and implement a repeated-blocker circuit breaker without deleting the redispatch path.

---

Delete-role conclusion

I do not recommend deleting review_evidence_redispatch_actions, the planner function that creates reviewer redispatch actions when a PR lacks a complete live-head review round. Deleting it would remove recovery for dead reviewer workers, stale reviewer heads, and archived invalid spawn intents.

Relevant source checks:

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664 matters because this is where reviewer redispatch actions are created from missing or stale review evidence.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2680 matters because the existing path already stops once a complete required live-head review round exists.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1869 matters because a live-head reject already routes to FIX, so repeated actionable blockers should reuse review-fix rather than delete reviewer recovery.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 matters because the runner ledger currently records status rows without a normalized repeated-blocker signature or threshold.

Option	Trade-off
Delete reviewer redispatch	Stops churn but strands PRs when review evidence is genuinely stale, missing, or produced by dead workers.
Keep redispatch and add a repeated-blocker cap	Preserves transient recovery while bounding identical blocker loops.
Only record blocked rows after dispatch	Improves diagnostics but may still allow planner-side redispatch churn.

Delete-role verdict: abstain. The issue should be solved as a circuit breaker/retry-budget change at the planner or shared projection boundary, not by removing the existing redispatch capability.

📎 Full raw codex output (archival)

---
solver: delete
issue: 42
cluster: issue-42
verdict: abstain
---

## Classification
e) Genuinely needed and right-sized enough for this issue; no current deletion/collapse is justified.

## Recommended action
我不建议删除 reviewer redispatch 或 review-gate 路径。`review_evidence_redispatch_actions()` 负责在 reviewer evidence 缺失、过期、或 worker 失败后重新补齐同一 PR/head 的 reviewer 证据；直接删除会让 review-gate 卡在缺证据状态。Issue #42 指向的是缺少“重复 blocker 熔断/转向”的控制逻辑，而不是已有功能本身多余。delete 角色应 abstain，让 minimal/structural 方案在现有 planner/runner 边界内增加重复签名 cap，并复用现有 review-fix / human-blocked 路由。

## Concrete plan (if propose)
- Files to delete: none
- Caller migrations: none
- Tests to delete: none
- LOC delta: 0
- Philosophy/CLAUDE.md/SPEC/Tier changes (if any): none

## Reverse-evidence (why this is safe to delete)
- Not safe to delete: reviewer redispatch is load-bearing recovery for stale or missing live-head review evidence.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664` defines `review_evidence_redispatch_actions()`, which emits `dispatch_reviewers` only for open PRs in review phases that do not yet have a complete required review round for the live head.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2680` skips redispatch once `highest_complete_required_review_round()` exists, so the current abstraction is bounded by completion state but not by repeated blocker signature.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2687` computes targeted `stale_roles`, which means redispatch is already role-scoped rather than a broad duplicate spawn primitive.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1847` decides review-gate outcomes, and `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1869` routes any live-head reject to `FIX`; this is the existing path a repeated actionable blocker should reuse rather than delete.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2329` and `:2333` show `_blocked()` / `_record()` append pending events and ledger rows, but the row shape lacks a normalized repeated blocker signature or cap.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:5129` asserts stale/missing reviewer head evidence projects `dispatch_reviewers`, confirming this path is intentionally tested behavior.
- `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:6068` asserts archived invalid pending reviewer intent does not suppress redispatch, confirming the recovery path is intentionally preserved after invalid spawn evidence.
- Git history for the installed skill copy was unavailable because `/Users/chronoai/.claude/skills/consensus-loop` is not a git checkout; I did not infer original commit intent from absent history.

## Risks
- If redispatch is deleted, PRs with dead reviewer workers, stale reviewer heads, or invalid archived spawn intents can remain permanently under-reviewed.
- If the repeated-blocker guard is added too late in `_record()` only, the planner may still keep projecting redispatch actions before the runner can suppress them.
- If `comment` verdicts are treated as actionable without a conservative reason classifier, the controller may dispatch fix work for maintainer-judgment questions.
- If signature state is stored as host production configuration or in `.refactor-loop/host.env`, it would violate the host SSOT boundary; any durable record should stay in the existing controller runtime ledger/projection surfaces.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — for meta-judge)
- Reference-frame note: circuit breaker / retry-budget pattern for distributed controllers. Retried equivalent failures should become a bounded route decision, but the retry mechanism itself remains necessary for transient failure recovery.
- Why I claim this should not be deleted: the cited code has active callers, tests, and a clear controller capability: recovering missing or stale reviewer evidence until review-gate has a complete live-head round. The issue describes a missing cap, not dead code or an orphan feature.
- What I checked to verify safety: source lines in `wakeup_plan.py` for redispatch projection, source lines in `wakeup_runner.py` for review-gate FIX and ledger recording, focused tests in `test_wakeup_plan.py`, the issue snapshot, live issue comments, and the local `AGENTS.md` managed-loop invariants.
- What I cannot decide alone: the final threshold value and blocker-reason normalization grammar. A threshold of 2 with a narrow key is plausible, but that belongs to the implementation consensus, not the delete solver.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:abstain:reviewer-redispatch-is-load-bearing-recovery; issue-needs-a-repeated-blocker-circuit-breaker-not-deletion

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Meta-judge requests one convergence round

TL;DR

• What this is: Round 1 design-consensus meta-judge result for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: The solvers agree on the repeated-blocker behavior, but not on the implementation boundary.
• What the controller does next: Run round 2 with a narrowed question about planner-local guard versus shared runner/planner projection.

---

Consensus arbitration

The result is converge, not implementation authorization. The repeated review blocker should stop unbounded reviewer redispatch after the same PR/head/role/verdict/reason repeats, route repeated reject evidence to review-gate/review-fix, and route repeated comment or non-actionable blocker evidence to human-blocked. The unresolved point is where the first implementation must live.

Option	Trade-off
Planner-local guard in wakeup_plan.py	Smaller change, but the next round must prove it records a durable repeated_review_blocker decision without runner ledger enrichment.
Shared review_blockers.py projection plus runner ledger enrichment	Stronger shared read model, but larger scope and a different abstraction boundary than the minimal proposal.
Delete reviewer redispatch	Rejected by the delete solver because redispatch is still needed for stale or missing live-head review evidence.

The convergence question for round 2 is: should the repeated review blocker cap be implemented as a planner-local guard in wakeup_plan.py, or as a shared runner/planner projection with ledger enrichment, and what exact files and durable record fields are required for the first implementation?

---

📎 Full raw codex output (archival)

---

issue: 42
cluster: issue-42
convergence_round: 1
solver_verdicts:
minimal: propose
structural: propose
delete: abstain
decision: converge
action_mode: plan
canonical_key: #42
next_action: plan

Decision

本轮不能授权实现。minimal 和 structural 都确认重复 reviewer blocker 会导致 reviewer redispatch 继续生成，并且都同意用同一 PR、head SHA、role、verdict、normalized blocker reason 的签名在阈值后停止 redispatch，同时将 repeated reject 路由到 review-gate/review-fix、将 repeated comment 或非可行动 blocker 路由到 human-blocked。delete abstain 与这个 Path A greenfield 问题兼容，因为它只说明 reviewer redispatch 是必要恢复路径、不能删除。但两个 implementation-bearing proposal 在实现边界上没有深度一致：minimal 方案把判断放在 wakeup_plan.py，约 +90/-5 LOC，不主改 runner；structural 方案新增 review_blockers.py projection、扩展 runner ledger 字段并增加多组测试，约 +230/-15 LOC。按同文件、同抽象、LOC 变动不超过约 30% 的规则，本轮应收敛而不是 dispatch implement。

Reference-frame note: control-loop circuit breaker plus idempotent command projection. The mature shape is to bound repeated equivalent failure signals, persist enough evidence for the next tick, and transition to a different state instead of retrying the same command indefinitely.

If converge

• Convergence question (specific): Should the repeated review blocker cap be implemented as a planner-local guard in wakeup_plan.py, or as a shared runner/planner projection with ledger enrichment, and what exact files and durable record fields are required for the first implementation?
• What each solver should address explicitly:
  • Minimal solver: state whether planner-local recomputation from existing review artifacts is sufficient to satisfy the durable repeated_review_blocker acceptance criterion, and list the exact output shape the controller can record without runner ledger changes.
  • Structural solver: justify why a new review_blockers.py module and _record() ledger enrichment are required for round-1 correctness rather than a later hardening step, or narrow the plan to the same file boundary as minimal.
  • Delete solver: keep the compatible-neutral check focused on whether reviewer redispatch remains load-bearing; only contradict implementation if the selected boundary would break stale/missing reviewer recovery.
• Round number this fires: 2; marker payload uses source round 1
• Progress since prior round: Round 1 established that the issue is real, reviewer redispatch should not be deleted, repeated blocker keys should include PR/head/role/verdict/reason, threshold 2 is plausible, repeated reject should route to review-gate/review-fix, and repeated comment/non-actionable blocker should route to human-blocked. The remaining split is implementation boundary and durable record shape.
• Human-intervention threshold: not reached

Round audit trail (links to local artifacts)

• solver-minimal: .refactor-loop/logs/phase9-issue42-r1-minimal.log
• solver-structural: .refactor-loop/logs/phase9-issue42-r1-structural.log
• solver-delete: .refactor-loop/logs/phase9-issue42-r1-delete.log
• work-unit-producer: manual-issue (prompt-only provenance)
• work-unit-source-ref: gh-issue-42
• action_mode: plan
• canonical_key: Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42
• duplicate_search_summary: Checked only the router-scoped issue snapshot and the three listed solver logs for issue 42 round 1; sibling issue artifacts and unlisted round artifacts were intentionally out of scope.
• branch: none
• PR: none
• commit: none
• unique_diff_status: not-applicable
• tests_verification: not run; this was a design-consensus arbitration and made no source changes.
• resolution: converge
• next_action: plan

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-1:Should the repeated review blocker cap be planner-local or a shared runner/planner projection with ledger enrichment?

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Delete solver abstains: keep reviewer redispatch and add the cap around it

TL;DR

• What this is: Round 2 delete-role design solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: I found no safe deletion; reviewer redispatch is still needed for missing, stale, or failed live-head review evidence.
• What the controller does next: Choose a planner-local or shared-projection repeated-blocker circuit breaker, preserving redispatch recovery while recording durable repeated_review_blocker decisions.

---

Delete-role conclusion

I do not recommend deleting review_evidence_redispatch_actions(), the planner function that creates targeted reviewer redispatch actions when an open PR in review lacks a complete required live-head review round. The problem in issue #42 is not that redispatch exists; the problem is that repeated equivalent reviewer blockers do not currently force a transition to review-fix or human-blocked.

Relevant source checks:

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664 matters because this is where reviewer redispatch actions are projected from missing or stale review evidence.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2680 matters because redispatch is already suppressed once a complete required live-head review round exists.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2687 matters because redispatch is role-targeted through stale_roles, so deleting it would remove recovery for only one failed or stale reviewer role.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437 and :1869 matter because existing review-gate logic already routes live-head rejects to review-fix.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 matters because the current runner ledger does not store a normalized repeated-blocker signature or threshold decision.

Option	Trade-off
Delete reviewer redispatch	Stops churn but strands PRs when reviewer evidence is genuinely missing, stale, or from failed workers.
Keep redispatch and add a repeated-blocker cap	Preserves recovery while bounding repeated identical blocker loops.
Only record blocked rows after dispatch	Improves diagnostics but can still allow planner-side redispatch churn before the next durable transition.

Delete-role verdict: abstain. The first implementation should preserve reviewer redispatch and add the repeated-blocker circuit breaker either in wakeup_plan.py or in a shared runner/planner projection, with a durable repeated_review_blocker decision and routing to review-fix for repeated rejects or human-blocked for repeated non-actionable comments.

📎 Full raw codex output (archival)

    ---
    solver: delete
    issue: 42
    cluster: issue-42
    verdict: abstain
    ---
    
    ## Classification
    e) Genuinely needed and right-sized enough for this issue; no current deletion/collapse is justified.
    
    ## Recommended action
    我不建议删除 `review_evidence_redispatch_actions()`、`dispatch_reviewers`，或现有 `review_gate`/review-fix 路径。第 2 轮收敛问题是在 planner-local guard 与 shared runner/planner projection 之间选边界；从 delete 视角看，redispatch 仍然是缺失、过期、失败 reviewer evidence 的恢复机制，不能删。最小可行删除结论是 abstain：保留 reviewer redispatch，并在 minimal/structural 方案中加入重复 blocker 熔断；重复 `reject` 应复用现有 review-gate 到 review-fix 的路径，重复 `comment` 或不可行动 blocker 应生成 durable `repeated_review_blocker` / human-blocked 决策，而不是删除恢复通道。
    
    ## Concrete plan (if propose)
    - Files to delete: none
    - Caller migrations: none
    - Tests to delete: none
    - LOC delta: 0
    - Philosophy/CLAUDE.md/SPEC/Tier changes (if any): none
    - If deletion is unsafe because the issue is merely too large, you may propose a bounded `IssueDecompositionPlan` artifact path instead of deletion; do not propose direct GitHub lifecycle calls, public issue factories, or any `wakeup_plan.py` decompose action/projection.
    - Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in #403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.
    
    ## Reverse-evidence (why this is safe to delete)
    - Not safe to delete: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664` defines `review_evidence_redispatch_actions()`, the planner projection that creates targeted redispatch actions when a PR is open, in review phase, has a live head, and lacks a complete required live-head review round.
    - Not safe to delete: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2680` already suppresses redispatch once `highest_complete_required_review_round()` exists. That shows the abstraction is a bounded recovery path, not an unconditional retry loop.
    - Not safe to delete: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2687` computes per-role `stale_roles`, excluding pending/fresh review evidence and existing pending review spawns. Removing this would strand stale or failed role-specific review evidence instead of topping up only the missing role.
    - Not safe to delete: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437` routes `review_gate` decisions, and `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1869` already maps live-head rejects to `FIX`. Repeated actionable blockers should reuse this path rather than delete reviewer recovery.
    - Current missing behavior is real but additive: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333` records ledger rows with `action_id`, `status`, `reason`, `kind`, and `ts`, but no normalized repeated blocker signature or cap.
    - Caller/test evidence says the path is load-bearing: `review_evidence_redispatch_actions()` is imported in `test_wakeup_plan.py`, extended into the top-level plan at `wakeup_plan.py:5102`, and covered by tests for missing reviewer heads, stale heads, terminal failed logs, stale pending logs, complete-round suppression, pending spawn suppression, archived invalid spawn handling, and rollup exclusion.
    - Runner-side tests also treat redispatch as a real command path: `test_wakeup_runner.py` covers `review-evidence-redispatch` routing to `dispatch_reviewers`, retry after stale evidence, and suppression after target roles become current or the live head advances.
    - No public API deletion is proposed; therefore no external integration surface is broken by this abstain.
    - Git history check could not be completed because `/Users/chronoai/.claude/skills/consensus-loop` is not a git repository in this environment. I did not fabricate commit provenance.
    
    ## Risks
    - If the review evidence helpers have an undocumented replacement outside the checked source tree, a collapse plan might exist, but no such replacement appeared in the local caller graph.
    - If repeated reviewer blockers are stored only in GitHub comments and not local artifacts, a planner-local recomputation must parse that evidence carefully; otherwise the cap could miss repeated blockers. This risk argues for a cap/projection design, not deletion.
    - If the threshold is implemented only after `dispatch_reviewers` runs, redispatch churn can still happen before the runner records a blocked row. The first implementation should stop the repeated command before creating another reviewer spawn action.
    
    ## Escalation triggers (if any)
    - None.
    
    ## Reasoning trace (internal — for meta-judge)
    - Why I claim this can be deleted: I do not claim deletion is safe. The delete-role classification is abstain because the issue describes missing repeated-blocker control around a needed recovery path.
    - What I checked to verify safety: I inspected `wakeup_plan.py:2664-2715`, `wakeup_runner.py:1437-1449`, `wakeup_runner.py:1848-1877`, `wakeup_runner.py:2329-2344`, searched call sites and tests with `rg`, and attempted the requested git history check. The source directory has no `.git`, so history was unavailable.
    - What I cannot decide alone: Whether the first implementation should be planner-local or a shared runner/planner projection. Delete-role evidence supports both as long as they preserve stale/missing reviewer recovery and record a durable `repeated_review_blocker` decision.
    
    Reference-frame note: circuit breaker plus idempotent command projection. A mature controller keeps retry/recovery for transient missing evidence, but bounds repeated equivalent failure signals and transitions to a different state rather than spawning the same command indefinitely.
    
    ⟦AI:AUTO-LOOP⟧
    SOLVER_DONE:delete:abstain:reviewer redispatch is load-bearing recovery for missing or stale live-head review evidence; solve issue 42 with a repeated-blocker circuit breaker, not deletion

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Minimal solver recommends planner-local cap plus durable ledger action

TL;DR

• What this is: Round 2 minimal-change solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: Use a planner-local repeated blocker cap first, with one tiny runner action so the stop decision is durable.
• What the controller does next: Compare this with the structural/delete round 2 outputs and decide whether to authorize implementation.

---

Minimal Round 2 Answer

I recommend the planner-local boundary for the first implementation. review_evidence_redispatch_actions() is the planner function that creates review-evidence-redispatch, the controller action that starts more reviewer workers when review evidence is missing or stale. Adding the cap there stops the repeated command before it is queued.

The durable record requirement still needs a runner touch. The planner should project a normal, non-status_only repeated-review-blocker action, and wakeup_runner.py should validate and record it as blocked with a reason shaped like repeated_review_blocker:<role>:<verdict>:<signature>:<next_action>. The existing runner ledger already writes action id, status, reason, kind, and timestamp, so this does not require a new ledger schema in the first implementation.

Boundary	Trade-off
Planner-local detector plus ledger-only runner action	About +120 / -5 LOC; stops unbounded redispatch and records a durable decision without adding a new shared projection module.
Shared review_blockers.py plus ledger enrichment	Cleaner long-term read model, but larger than needed for the first cap and not required to satisfy the current acceptance criteria.
Planner-only status action	Too weak: it can suppress a plan view, but it does not give the runner a durable blocked row.

Exact first implementation shape:

• wakeup_plan.py: normalize (PR, head SHA, role, verdict, concise blocker reason), count repeats from existing review artifacts/logs/comments, suppress only the repeated stale roles, and emit repeated-review-blocker at threshold 2.
• wakeup_runner.py: add record_repeated_review_blocker as a named helper that only validates shape and records the blocked decision; it must not call dispatch_reviewers.
• Tests: one repeated reject, one repeated comment, and one runner ledger-only recording test.

For repeated reject, the action should carry next_action: review_gate; the existing review-gate path can then dispatch review-fix when the gate has complete live-head evidence. For repeated comment or non-actionable blockers, the action should carry next_action: human-blocked.

📎 Full raw codex output (archival)

---

solver: minimal
issue: 42
cluster: issue-42
verdict: propose

Recommended framing

最小可行实现应放在 wakeup_plan.py 的 review_evidence_redispatch_actions() 旁边：在生成 review-evidence-redispatch 前，从现有 reviewer artifact/log/GitHub review evidence 中计算同一 PR、head SHA、role、verdict、normalized blocker reason 的重复签名；达到阈值后不再派发同一 role 的 reviewer，而是投射一个普通、非 status_only 的 repeated_review_blocker controller action，让 wakeup_runner.py 通过现有 ledger _record() 写入 durable decision。这个边界直接拦住无限 reviewer redispatch，又不把 .refactor-loop/host.env 变成事实源；shared projection/ledger enrichment 可以作为后续硬化，不是 round-1 正确性所必需。

Concrete plan

• Files:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py: add small planner-local helpers near review evidence functions:
    • normalize blocker reason from review artifact/log/comment text into a bounded lower-case signature token, preferring an explicit blocker_reason:/reason: line when present and falling back to the first concise non-marker review line; cap stored text length.
    • collect valid same-head review blocker evidence for a candidate stale role from existing durable sources already used by the planner: .refactor-loop/runs/review-pr<N>-<role>-r*.md, matching .refactor-loop/logs/review-pr<N>-<role>-r*.log, and parsed GitHub review comments when available through existing review evidence plumbing.
    • before appending review-evidence-redispatch, split stale_roles into retryable roles and repeated-blocked roles. Keep redispatch for retryable roles. For each repeated signature at threshold 2, append a non-status_only action with kind: "repeated-review-blocker", controller_action: "record_repeated_review_blocker", action_id: "repeated-review-blocker:<pr>:<head>:<role>:<signature>", target_kind: "PR", target_number, head_sha, role, verdict, blocker_reason, blocker_signature, repeat_count, next_action, and preconditions.
    • set next_action to review_gate for repeated reject so the controller can move to the existing review-gate/fix path when gate evidence is complete; set next_action to human-blocked for repeated comment or otherwise non-actionable blockers.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py: add "record_repeated_review_blocker" to RUNNER_NAMED_HELPER_ACTIONS, validate the action shape, and dispatch it as a ledger-only controller action that calls _blocked(action, reason) with reason shaped as repeated_review_blocker:<role>:<verdict>:<blocker_signature>:<next_action>. This is a runner change only to make the planner decision durable; it does not need _record() ledger schema enrichment for round-1 correctness because _record() already persists action_id, status, reason, kind, and timestamp.
• LOC delta: ~+120 / -5.
• Tests to add/modify:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py: add one repeated reject case proving the second same PR/head/role/verdict/reason suppresses that role from review-evidence-redispatch and projects repeated-review-blocker with next_action: "review_gate".
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py: add one repeated comment case proving reviewer redispatch is suppressed and the projected decision carries next_action: "human-blocked".
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner.py: add one ledger-only action test proving record_repeated_review_blocker records a blocked row whose reason starts with repeated_review_blocker: and does not call dispatch_reviewers.
• Governance/ruleset change (if any): none.
• Migration path: no migration needed; old reviewer artifacts/logs and old runner ledger rows remain readable. The new action is projected only when repeated blocker evidence is present.

Risks

• Planner-local normalization can drift from future runner review parsing if later changes add new reviewer evidence formats. A shared review_blockers.py module would reduce that drift, but it is not needed to stop the current unbounded redispatch loop.
• A repeated reject with incomplete required review evidence should not bypass review-gate safety. The first implementation should record next_action: "review_gate" rather than directly dispatching review-fix unless the existing gate can make a FIX decision.
• Reason normalization must be bounded and conservative. If no concise blocker reason can be extracted, the planner should keep the existing redispatch path instead of grouping unrelated comments.

Escalation triggers (if any)

• none.

Reasoning trace (internal — short, for meta-judge)

• Why this is the minimum: the violation is created where review_evidence_redispatch_actions() appends more dispatch_reviewers actions from stale/missing reviewer evidence. A local guard there prevents the repeated command before it exists, while a tiny runner ledger-only action satisfies the durable repeated_review_blocker acceptance criterion without redesigning the ledger.
• What I considered but rejected: a new shared review_blockers.py projection and _record() ledger enrichment. That is a better long-term read model, but it touches more abstraction boundary than needed for the first cap because the current durable review artifacts already contain PR/head/role/verdict/reason inputs and _record() already persists blocked decisions by action id/reason/kind.
• What I cannot decide alone: the exact blocker-reason extraction vocabulary beyond explicit blocker_reason:/reason: lines. If maintainers want richer semantic grouping, that should be a follow-up after the cap exists.

Reference-frame note: this is a retry-budget/circuit-breaker problem. The known-good shape is to normalize equivalent failure signals, persist the stop decision, and transition away from issuing the same command again.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:Planner-local repeated-review-blocker cap with a ledger-only runner action is the smallest durable first implementation.

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Structural solver recommends shared repeated-blocker projection

TL;DR

• What this is: Round 2 structural solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: Use a shared review_blockers.py projection, not a planner-only counter, so repeated reviewer blockers have one normalized signature and durable ledger metadata.
• What the controller does next: Compare this with the minimal and delete outputs, then authorize implementation if consensus selects the shared projection boundary.

---

Structural recommendation

The repeated reviewer blocker cap should be implemented as a shared runner/planner projection. ReviewBlockerSignature means a compact key made from PR number, head SHA, reviewer role, verdict, and a capped normalized blocker reason; putting that in a small shared module prevents planner and runner from drifting on what counts as the same blocker.

/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664 matters because review_evidence_redispatch_actions() is where stale or missing reviewer evidence becomes a new dispatch_reviewers command. /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437 matters because the existing review_gate command already owns review lifecycle routing. /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1869 matters because live-head rejects already route to review-fix through the existing FIX decision. /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 matters because _record() writes the durable wakeup runner ledger row that later ticks can consult.

Option	Trade-off
Shared review_blockers.py projection plus additive ledger fields	About +210/-15 LOC, but one signature definition serves planner suppression and runner durability.
Planner-local guard only	Smaller first diff, but the durable repeated_review_blocker record and signature semantics remain underspecified.
Delete reviewer redispatch	Stops churn but breaks recovery for genuinely stale, missing, or failed reviewer evidence.

Concrete first implementation: add review_blockers.py, guard review_evidence_redispatch_actions() before it appends review-evidence-redispatch, emit a repeated_review_blocker decision at threshold 2, route repeated reject to review_gate, and mark repeated comment or non-actionable evidence as human-blocked/status-only. Add tests for repeated reject, repeated comment, signature scoping, and ledger metadata preservation.

---

📎 Full raw codex output (archival)

---

solver: structural
issue: 42
cluster: issue-42
verdict: propose

PROJECT_RULES clause violated (quoted verbatim)

• FI-004 Facts that cross processes, turns, or nodes must have an authoritative record; in-process memory, caches, and temporary variables must not masquerade as fact sources.

• FI-005 Boundaries take precedence over convenience; responsibility, layering, protocol, and state ownership must be clear, and shortcut layers must not bypass the main path.

• MIL-011 Exactly one active mode is required. Every loop tick must record one
  action_mode: identify, plan, implement, triage, or human-blocked.
  The productive modes are only identify, plan, and implement. triage
  and human-blocked are allowed stop states, not progress substitutes. A tick
  that opens no issue, writes no plan, changes no branch, raises no PR, and
  records no triage/blocker audit is invalid.

• MIL-012 Repetition is forbidden across issues, branches, and artifacts. Before
  acting, compare the canonical key plus normalized title, upstream mirror
  reference, error signature, target files, existing managed issue numbers,
  branches, PRs, and ledger entries. If the same key or fingerprint appears
  without new reproducer evidence, link the existing record and stop; do not
  create a fresh issue, branch, solver round, implementation artifact, or close
  comment for the duplicate.

Recommended framing

建议首轮实现采用共享 runner/planner 投影，而不是只在 wakeup_plan.py 内放局部计数器。现有 review_gate_selection.py 已经是 reviewer evidence 的共享解析/选择边界；新增相邻的 review_blockers.py 让 ReviewBlockerSignature 成为同一 PR、head SHA、role、verdict、normalized blocker reason 的权威签名，并让 planner 在生成 review-evidence-redispatch 前先读取该投影。runner 只做窄幅 ledger enrichment：当 action 已携带 repeated_review_blocker 字段时，把可选字段写入 wakeup-runner-ledger.jsonl。这样重复 blocker 从“下一轮又缺 evidence”变成“已记录的 stop decision”，重复 reject 走现有 review_gate/review-fix，重复 comment 或不可行动 blocker 进入 human-blocked，不靠临时内存或口头规则阻止 redispatch。

Reference-frame note: circuit breaker plus idempotent command projection. A retry loop should continue for missing transient evidence, but once the same normalized failure repeats for the same resource/version, the controller must persist the breaker state and project a different command/state.

Concrete plan

• New abstractions (if any): ReviewBlockerSignature and RepeatedReviewBlockerDecision in Layer: consensus-loop controller projection, Project: codex_refactor_loop, File: /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_blockers.py.
  • ReviewBlockerSignature(pr_number: int, head_sha: str, role: str, verdict: str, blocker_reason: str) is a frozen dataclass with a stable key or digest field.
  • RepeatedReviewBlockerDecision(signature, count, threshold, next_action) returns next_action == "review_gate" for reject and next_action == "human-blocked" for comment or non-actionable evidence.
  • Public functions: normalize_blocker_reason(text: str, *, max_len: int = 160) -> str, review_blocker_signatures_from_evidence(...) -> list[ReviewBlockerSignature], repeated_review_blocker_decisions(...) -> list[RepeatedReviewBlockerDecision], and ledger_rows_for_repeated_review_blockers(...).
• Files:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_blockers.py: add the shared signature normalization and threshold projection. It should reuse review evidence objects selected by review_gate_selection.py rather than reparsing GitHub comments or run artifacts independently.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py: import the shared projection and call it inside review_evidence_redispatch_actions() after stale_roles is computed and before appending review-evidence-redispatch. If a stale role has a repeated blocker decision at threshold 2, suppress that role from stale_review_roles. If all stale roles are suppressed, append a durable action:
    • kind: "repeated_review_blocker"
    • action_id: "repeated-review-blocker:<pr_number>:<head_sha>:<role>:<signature-digest>"
    • phase: "review-gate"
    • action_mode: "human-blocked" for comment/non-actionable blockers or "plan" with controller_action: "review_gate" for reject blockers
    • controller_action: "review_gate" only for repeated reject
    • target_kind: "PR", target_number, target, head_sha, role, verdict, blocker_reason, blocker_signature, repeat_count, repeat_threshold
    • next_action: "review_gate" for reject, next_action: "human-blocked" for comment/non-actionable
    • reason: "repeated_review_blocker:<role>:<verdict>:<signature-digest>"
    • status_only: true for human-blocked/non-actionable decisions so no reviewer worker is spawned
    • preconditions adds "repeated_review_blocker_threshold_reached" and keeps "live_open_target_if_present"
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py: extend _record() only to copy optional action metadata for kind == "repeated_review_blocker" into the ledger row: target_number, head_sha, role, verdict, blocker_reason, blocker_signature, repeat_count, repeat_threshold, next_action, action_mode. Old rows remain readable because these are additive fields.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py: add behavior tests around review_evidence_redispatch_actions() and full run_plan.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner.py: add one ledger enrichment test that asserts repeated-blocker fields are durable without changing generic ledger compatibility.
• LOC delta: ~+210 / -15 total.
  • review_blockers.py: ~+115 / -0.
  • wakeup_plan.py: ~+55 / -10.
  • wakeup_runner.py: ~+20 / -5.
  • tests: ~+120 / -0.
• Tests to add:
  • test_repeated_reject_blocker_suppresses_reviewer_redispatch_and_routes_review_gate in test_wakeup_plan.py: two identical live-head reject evidences for the same role/reason produce a repeated_review_blocker action with controller_action == "review_gate", no dispatch_reviewers for that role, and durable signature fields.
  • test_repeated_comment_blocker_suppresses_reviewer_redispatch_and_records_human_blocked in test_wakeup_plan.py: two identical live-head comment blocker evidences produce a repeated_review_blocker status-only/human-blocked action and no review-evidence-redispatch.
  • test_repeated_blocker_is_pr_head_role_verdict_reason_scoped in test_wakeup_plan.py: changing head SHA, role, verdict, or normalized blocker reason leaves normal review-evidence-redispatch behavior intact.
  • test_repeated_review_blocker_ledger_row_preserves_signature_metadata in test_wakeup_runner.py: _record() writes optional repeated-blocker metadata into wakeup-runner-ledger.jsonl and preserves existing action_id/status/reason/kind/ts fields.
• Schema/protocol changes (if any): none. This is controller-private JSON action/ledger data under .refactor-loop, with additive fields only.
• Governance/ruleset changes (if any): none. The plan implements FI-004/FI-005/MIL-011/MIL-012 directly and does not make .refactor-loop/host.env a host production SSOT.
• Runtime cost: O(R + L) per open review PR, where R is local/GitHub review evidence count already read for review-gate selection and L is ledger rows for repeated blocker decisions. Expected added work is under 1 ms for tens of local rows and one small dict per candidate blocker; no network calls beyond existing evidence loading. Allocation estimate: one ReviewBlockerSignature dataclass per relevant review evidence plus one short normalized reason string capped at 160 chars.
• If the structural answer is issue decomposition, use the controller-private IssueDecompositionPlan boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any wakeup_plan.py decompose action/projection.
• Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in refactor(history-overlay): split into modular functions & add tests (fixes #402) openai/codex#403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.

Risks

• This is ~100 LOC larger than a planner-only guard. The trade-off is one shared signature definition across planner and runner instead of two near-identical normalizers that can drift.
• The new module can become over-engineered if it tries to own all review-gate semantics. Keep it bounded to blocker signature normalization, threshold counting, and decision projection; leave evidence parsing/selection in review_gate_selection.py and lifecycle execution in wakeup_runner.py.
• The precise source of blocker_reason must be conservative. Prefer explicit review artifact front matter/body fields when available, then concise invalid/pending reasons from review_gate_selection.py; do not hash full comments into the signature without a hard cap.

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why this structure beats a documented exception: a documented retry cap would not change review_evidence_redispatch_actions() at /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664, which currently appends dispatch_reviewers whenever stale roles remain. The breaker must live in the projection that creates the command.
• Why I picked this abstraction over alternatives: review_gate_selection.py is already the shared review evidence selection primitive, and wakeup_runner.py:_record() at /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 is already the durable action ledger writer. A sibling review_blockers.py keeps the signature definition shared without moving lifecycle authority into the runner.
• What I cannot decide alone: the exact threshold should be 2 unless maintainers prefer 3 for noisy reviewer comments. The implementation should make the constant named and test-covered, not host-env-driven.
• Verified source points: /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2664 creates reviewer redispatch actions; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1437 routes review_gate; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:1869 maps live-head reject to FIX; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2333 writes ledger rows; /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:1 is the existing shared review-gate evidence module.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:shared review_blockers projection plus additive runner ledger fields should cap repeated reviewer blockers and route reject to review_gate or comment to human-blocked

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Meta-judge requests one more convergence round

TL;DR

• What this is: Round 2 design-consensus meta-judge result for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: The repeated-blocker behavior is agreed, but the first implementation boundary still differs.
• What the controller does next: Run round 3 focused only on choosing planner-local ledger-only action versus shared review_blockers.py projection with ledger metadata.

---

Consensus Arbitration

The decision is converge, not implementation authorization. The applicable reference frame is circuit breaker plus idempotent command projection: retry transient missing evidence, but once the same normalized failure repeats for the same PR/head/role/verdict/reason, persist a stop decision and transition to a different state.

All solvers agree on the behavior: keep reviewer redispatch for missing, stale, or failed live-head evidence; stop redispatch when the same blocker repeats at threshold; route repeated reject through review_gate/review-fix; and route repeated comment or non-actionable blocker evidence to human-blocked.

The disagreement is still the concrete implementation boundary:

Option	Trade-off
Minimal planner-local detector plus ledger-only runner action	About +120 / -5 LOC; stops the repeated command and records a blocked row without a shared projection module.
Structural shared review_blockers.py projection plus additive ledger metadata	About +210 / -15 LOC; gives planner and runner one signature definition and preserves repeated-blocker fields in the ledger.
Delete reviewer redispatch	Rejected/abstained: redispatch is still needed for genuinely missing, stale, or failed reviewer evidence.

The compatible-neutral delete exception applies only to the delete abstain. It does not resolve the mismatch between the two implementation-bearing proposals because their file sets, abstractions, ledger semantics, and LOC profiles still differ.

The round 3 question should be narrow: pick either the minimal ledger-only boundary or the shared projection/ledger metadata boundary, and list the exact durable fields plus tests that make that boundary sufficient.

📎 Full raw codex output (archival)

---

issue: 42
cluster: issue-42
convergence_round: 2
solver_verdicts:
minimal: propose
structural: propose
delete: abstain
decision: converge
action_mode: plan
canonical_key: #42
next_action: plan

Decision

本轮结论是 converge，不是实现授权。参考框架是 circuit breaker plus idempotent command projection：重复等价失败信号应被规范化、持久记录，并转向 fix 或 human-blocked，而不是继续投射同一个 reviewer redispatch 命令。三位 solver 对目标行为已经一致：保留 reviewer redispatch 的缺失/过期证据恢复能力；同一 PR/head/role/verdict/reason 达到阈值后停止派发同一 reviewer；重复 reject 路由到 review_gate/review-fix；重复 comment 或不可行动 blocker 路由到 human-blocked。但 minimal 与 structural 仍未在实现边界上达成同一 concrete plan：minimal 选择 wakeup_plan.py 局部检测加 wakeup_runner.py ledger-only record_repeated_review_blocker action，约 +120/-5 LOC，不新增共享投影也不扩展 _record() schema；structural 选择新增 review_blockers.py 共享投影，wakeup_plan.py 调用该投影，并在 wakeup_runner.py::_record() 添加可选 repeated-blocker metadata，约 +210/-15 LOC。两者文件集合、抽象边界、ledger 语义和 LOC 变动差异超过共识门槛；delete 的 abstain 在 Path A 下可兼容“保留 redispatch 并加 cap”，但不能消除两个 implementation-bearing proposals 之间的分歧。

If converge

• Convergence question (specific): For the first implementation, should issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42 use the minimal planner-local detector plus a ledger-only record_repeated_review_blocker runner action, or the structural shared review_blockers.py projection plus additive _record() ledger metadata; list the exact durable fields and tests that make the chosen boundary sufficient.
• What each solver should address explicitly:
  • Minimal solver: state whether adding a shared review_blockers.py module and additive _record() metadata is acceptable for the first implementation; if not, identify the exact acceptance criterion satisfied by action_id/status/reason/kind/ts alone and the exact action fields the runner must validate.
  • Structural solver: state whether the first implementation can be narrowed to planner-local detection plus a ledger-only runner helper; if not, identify the exact failure mode created by not sharing ReviewBlockerSignature and not preserving optional repeated-blocker metadata in _record().
  • Delete solver: keep the compatible-neutral check focused on whether the selected boundary preserves missing/stale/failed reviewer recovery; only contradict a proposal if it would suppress non-repeated stale roles, bypass review_gate, or fail to record a durable repeated_review_blocker decision.
• Round number this fires: 3; marker payload uses source round 2.
• Progress since prior round: minimal added the runner touch needed for a durable ledger row and specified record_repeated_review_blocker; structural anchored the shared projection next to review_gate_selection.py, listed exact optional ledger fields, and added signature-scoping tests; delete verified redispatch is load-bearing and compatible with either cap boundary.
• Human-intervention threshold: not reached. Round 2 produced new information; if round 3 repeats the same planner-local versus shared-projection split without narrowing, the router should evaluate its stalled/no-progress predicate before spawning more solver churn.

Round audit trail (links to local artifacts)

• solver-minimal: .refactor-loop/logs/phase9-issue42-r2-minimal.log
• solver-structural: .refactor-loop/logs/phase9-issue42-r2-structural.log
• solver-delete: .refactor-loop/logs/phase9-issue42-r2-delete.log
• work-unit-producer: manual-issue (prompt-only provenance)
• work-unit-source-ref: gh-issue-42
• action_mode: plan
• canonical_key: Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42
• duplicate_search_summary: issue source snapshot and the three router-scoped round 2 solver logs were checked; no sibling artifacts, branches, PRs, or unlisted issue records were searched under the router-scoped input boundary.
• branch: none
• PR: none
• commit: none
• unique_diff_status: not-applicable
• tests_verification: not run; design-consensus judge only wrote an arbitration artifact and GitHub comment.
• resolution: converge
• next_action: plan

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-2:choose planner-local ledger-only action or shared review_blockers projection with ledger metadata

⟦AI:AUTO-LOOP⟧

[MarketingChronoAi]

🤖 Minimal solver selects shared blocker projection for round 3

TL;DR

• What this is: Round 3 minimal-change design solver output for issue Consensus loop: repeated review blockers should route to fix or human-blocked instead of spawning more reviewers #42.
• Current state or conclusion: Use a small shared review_blockers.py projection plus additive ledger metadata, not a planner-only reason string.
• What the controller does next: Compare this with the other round 3 outputs and authorize implementation if consensus now selects this boundary.

---

Minimal round 3 recommendation

I verified the cited controller paths. review_evidence_redispatch_actions() is the planner function that currently creates review-evidence-redispatch, which queues dispatch_reviewers when review evidence is missing or stale. wakeup_runner.py::_record() is the durable runner ledger writer, and it currently records only generic action status fields. The existing review_gate_selection.py module already shows a local pattern for shared review evidence parsing.

My round 3 answer is to choose the small shared projection boundary. ReviewBlockerSignature means a compact key made from PR number, head SHA, reviewer role, verdict, and a bounded normalized blocker reason. Defining that once lets the planner suppress repeated reviewer redispatch and lets the runner persist the same identity in the ledger.

Option	Trade-off
Shared review_blockers.py plus additive ledger metadata	About +190 / -10 LOC; one signature definition for planner suppression and durable runner records.
Planner-local detector plus ledger-only action	Smaller by roughly 70 LOC, but future ticks only get a reason string instead of structured repeated-blocker fields.
Delete reviewer redispatch	Not recommended; redispatch still recovers genuinely missing, stale, or failed reviewer evidence.

The first implementation should emit kind: repeated-review-blocker, controller_action: record_repeated_review_blocker, target_number, head_sha, role, verdict, blocker_reason, blocker_signature, repeat_count, threshold: 2, and next_action. Repeated reject should route to review_gate; repeated comment should route to human-blocked. Tests should cover repeated reject, repeated comment, signature scoping, and runner ledger metadata preservation.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 42
cluster: issue-42
verdict: propose
---

## Recommended framing
最小可行边界应选择 shared `review_blockers.py` 投影加少量 planner/runner 接线，而不是纯 planner-local 计数。原因是第 3 轮的分歧已经缩小到“ledger-only action 是否足够持久”；我验证到 `review_evidence_redispatch_actions()` 当前直接生成 `dispatch_reviewers`，`_record()` 当前只写通用 ledger 行，而仓库已经有 `review_gate_selection.py` 这种共享 review evidence 解析边界。用一个小共享模块定义同一 PR、head SHA、role、verdict、normalized blocker reason 的签名，planner 用它在阈值 2 时停止同一 role 的 redispatch，runner 用同一字段记录 blocked decision，是比复制解析逻辑更小的正确性边界；它仍保留 redispatch 对缺失、过期、失败 reviewer evidence 的恢复能力。

## Concrete plan
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_blockers.py`: add a small shared projection with `ReviewBlockerSignature`, bounded reason normalization, artifact/log/GitHub-comment evidence extraction, repeat counting, and `next_action` classification. The helper should use existing review markers and reviewed-head parsing conventions, cap normalized reason text, and return only compact serializable fields.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py`: import the shared helper, evaluate each candidate `stale_role` before appending `review-evidence-redispatch`, remove repeated roles from `stale_review_roles`, and append one `repeated-review-blocker` action per repeated signature. Keep ordinary redispatch when the role has no repeated signature or when evidence is genuinely missing/stale/dead without the same blocker repeated.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py`: add supported controller action `record_repeated_review_blocker`, validate required fields, and record it as blocked without dispatching reviewers. Extend `_record()` additively with optional repeated-blocker metadata copied from the action.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: add planner coverage for repeated `reject`, repeated `comment`, and signature scoping by PR/head/role/verdict/reason.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner.py`: add runner coverage that `record_repeated_review_blocker` writes a blocked ledger row with metadata and does not call `dispatch_reviewers`.
- LOC delta: ~+190 / -10.
- Tests to add/modify:
  - `test_wakeup_plan.py::test_repeated_reject_review_blocker_suppresses_role_redispatch_and_routes_review_gate`
  - `test_wakeup_plan.py::test_repeated_comment_review_blocker_suppresses_role_redispatch_and_routes_human_blocked`
  - `test_wakeup_plan.py::test_repeated_review_blocker_signature_is_scoped_to_pr_head_role_verdict_and_reason`
  - `test_wakeup_runner.py::test_record_repeated_review_blocker_records_blocked_ledger_metadata_without_dispatch`
- Durable fields:
  - `kind: repeated-review-blocker`
  - `controller_action: record_repeated_review_blocker`
  - `action_id: repeated-review-blocker:<pr>:<head_sha>:<role>:<verdict>:<signature_hash_or_token>`
  - `target_kind: PR`
  - `target_number`
  - `head_sha`
  - `role`
  - `verdict`
  - `blocker_reason`
  - `blocker_signature`
  - `repeat_count`
  - `threshold: 2`
  - `next_action: review_gate | human-blocked`
  - `reason: repeated_review_blocker:<role>:<verdict>:<blocker_signature>:<next_action>` in the runner result
  - Optional `_record()` ledger metadata fields with the same names: `target_number`, `head_sha`, `role`, `verdict`, `blocker_reason`, `blocker_signature`, `repeat_count`, `threshold`, `next_action`.
- Governance/ruleset change (if any): none.
- Migration path: no migration needed; old ledger rows remain readable because new ledger fields are optional and planner evidence is recomputed from existing artifacts/logs/comments.

## Risks
- Adds one small module instead of a planner-local helper, so the first diff is about 70 LOC larger than the absolute smallest patch.
- Reason normalization can over-collapse distinct blocker wording; cap this by preferring explicit `blocker_reason:` or `reason:` lines, falling back to the first concise review line, lower-casing, whitespace-normalizing, and length-capping.
- Repeated `reject` routing to `review_gate` depends on existing complete live-head gate behavior; if required roles are still missing, the runner may still wait rather than immediately dispatch review-fix. That is acceptable because the cap stops the repeated blocker role from spawning again, while other genuinely missing roles can still be recovered.
- GitHub comment evidence extraction must stay bounded and use already-loaded issue/PR comments or local artifacts; it must not introduce unbounded API pagination inside the planner.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: the verified violation is at `review_evidence_redispatch_actions()`, which emits `review-evidence-redispatch` for stale roles without a blocker repeat check. The verified durable sink is `wakeup_runner.py::_record()`, which currently records only generic action status. A tiny shared blocker signature is the smallest way to make planner suppression and runner durability agree on the exact repeated-blocker identity.
- What I considered but rejected: a planner-local detector plus generic blocked row is smaller but leaves two semantics underspecified: what exact signature future ticks should treat as repeated, and which fields make `repeated_review_blocker` durable beyond a human-readable reason string. A larger lifecycle rewrite is unnecessary because existing `review_gate` already routes live-head rejects to `FIX`.
- What I cannot decide alone: whether maintainers want threshold 2 or 3 operationally. For this issue's acceptance criteria, choose threshold 2 as the first cap because it proves boundedness and matches the current solver convergence examples.

Reference-frame note: circuit breaker plus idempotent command projection. Repeated equivalent failure signals should be normalized, persisted, and routed to a different state instead of retrying the same command indefinitely; transient missing or stale evidence should still retain retry recovery.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:choose shared review_blockers projection with additive ledger metadata as the smallest correct durable cap

⟦AI:AUTO-LOOP⟧