Publish the try-fix panel and the independent review in the PR body

The fix phase runs five cross-pollinated try-fix candidates and publishes
one, but only the winner ever reached the pull request. A reader could not
tell a fix selected from five competing approaches from the single candidate
that happened to run, and the body read identically either way. That is not
hypothetical: before the tidiness fix, four of five candidates were routinely
blocked for changing no file at all.

The body now carries a Try-fix panel table - every candidate, its model, its
result, and its approach or the reason it was rejected, with the published one
marked - alongside the independent review of the winning diff. Both report and
never refuse: an absent record renders "Not measured" rather than nothing,
because silence is indistinguishable from a feature nobody wired up, which is
how the regression cross-reference stayed dead for its entire life.

Three defects found and fixed while building it:

- Reading candidate properties by dot threw under StrictMode when a record
  omitted one, letting a display detail abort a fix phase that had already
  produced a winning diff. Now read through PSObject.Properties. The existing
  suite caught this, which is what it is for.
- A pipe in model-written prose ended its table cell and silently shifted
  every later column, so a row could misattribute a result to the wrong
  candidate. Pipes are escaped, not stripped: the character is load-bearing
  in the C# candidates describe.
- Nothing tested that the candidate gate allowlists the manifest fields the
  orchestrator writes. This pipeline has already lost finished runs to exactly
  that. The two are now pinned together, so the next new field fails in
  milliseconds on a laptop instead of after the reproduction, the fix, and
  every arm have been paid for.

Every panel string is bounded with -Prose: a presentation bound must never be
able to discard the work it describes, which has destroyed four completed runs
here already.

17 new tests, each mutation-tested (8 mutations, all killed, including a
guard-the-guard that proves the allowlist cross-check is not vacuous).
60 suites: 4159 passed, 35 failed - the same pre-existing review-half
failures, unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 735ac9a2-7bec-4baa-ad19-c298e5bc795a

Author: kubaflo

.github/scripts/Publish-Replication.Tests.ps1

@@ -45,6 +45,8 @@ BeforeAll {
         'Get-ReplicationPullRequestMarker',
         'New-ReplicationBranchName',
         'Get-ReplicationCandidateText',
+        'Get-ReplicationIndependentReviewBlock',
+        'Get-ReplicationFixPanelBlock',
         'Get-ValidatedFixFiles',
         'Assert-ReplicationStagedFix',
         'Remove-ReplicationPlatformTitlePrefix',
@@ -2169,3 +2171,188 @@ Describe 'The pre-flight upstream duplicate gate refuses only what it measured'
         } finally { Remove-Item -Recurse -Force $root -ErrorAction SilentlyContinue }
     }
 }
+
+Describe 'The pull request body reports the independent review of the winning fix' {
+    BeforeAll {
+        $script:ReviewCandidate = [pscustomobject]@{
+            fixIndependentReview = [pscustomobject]@{
+                model = 'gpt-5.6-sol'
+                summary = 'The diff restores the null guard and the test covers it.'
+                findings = @(
+                    [pscustomobject]@{ severity = 'blocking'; detail = 'The guard is not applied on the Android path.' }
+                    [pscustomobject]@{ severity = 'minor'; detail = 'The new field could be readonly.' }
+                )
+            }
+        }
+    }
+
+    It 'attributes the review to a model that did not write the diff' {
+        $block = Get-ReplicationIndependentReviewBlock -Candidate $script:ReviewCandidate
+
+        $block | Should -Match 'Independent review'
+        $block | Should -Match 'gpt-5\.6-sol'
+        $block | Should -Match 'without having written it'
+        $block | Should -Match 'restores the null guard'
+    }
+
+    It 'surfaces each finding with its severity' {
+        $block = Get-ReplicationIndependentReviewBlock -Candidate $script:ReviewCandidate
+
+        $block | Should -Match '\*\*blocking\.\*\* The guard is not applied on the Android path\.'
+        $block | Should -Match '\*\*minor\.\*\* The new field could be readonly\.'
+    }
+
+    It 'says plainly that findings did not block publication' {
+        # The arm reports, never refuses: its false-positive rate is unmeasured
+        # because every reviewed pull request in the validating corpus carried a
+        # blocking finding, so there is no negative control. A wrong paragraph
+        # costs a reader a minute; a wrong refusal costs a certified fix.
+        Get-ReplicationIndependentReviewBlock -Candidate $script:ReviewCandidate |
+            Should -Match 'did not block publication'
+    }
+
+    It 'caps the findings it renders so one verbose review cannot flood the body' {
+        $many = 1..12 | ForEach-Object { [pscustomobject]@{ severity = 'minor'; detail = "finding number $_" } }
+        $candidate = [pscustomobject]@{
+            fixIndependentReview = [pscustomobject]@{ model = 'gpt-5.6-sol'; summary = 'ok'; findings = $many }
+        }
+
+        $block = Get-ReplicationIndependentReviewBlock -Candidate $candidate
+
+        @([regex]::Matches($block, '(?m)^- \*\*minor\.\*\*')).Count | Should -Be 6
+    }
+
+    It 'reports "Not measured" when the review is absent or unusable' {
+        # Silence is indistinguishable from a feature nobody wired up, which is
+        # exactly how the regression cross-reference stayed dead for its whole
+        # life while passing every behavioural test it had.
+        Get-ReplicationIndependentReviewBlock -Candidate ([pscustomobject]@{ fixFiles = @('a.cs') }) |
+            Should -Match 'Not measured'
+        Get-ReplicationIndependentReviewBlock -Candidate ([pscustomobject]@{ fixIndependentReview = $null }) |
+            Should -Match 'Not measured'
+        Get-ReplicationIndependentReviewBlock -Candidate ([pscustomobject]@{
+            fixIndependentReview = [pscustomobject]@{ model = 'gpt-5.6-sol'; summary = '   '; findings = @() } }) |
+            Should -Match 'Not measured'
+    }
+}
+
+Describe 'The pull request body records the try-fix panel, not only its winner' {
+    BeforeAll {
+        $script:PanelCandidate = [pscustomobject]@{
+            fixPanel = @(
+                [pscustomobject]@{ attempt = 1; model = 'claude-opus-5'; result = 'Blocked'; detail = 'reported a pass without changing any file'; won = $false }
+                [pscustomobject]@{ attempt = 2; model = 'gpt-5.6-sol'; result = 'Fail'; detail = 'oracle failed 1 of 3 runs'; won = $false }
+                [pscustomobject]@{ attempt = 3; model = 'claude-opus-5'; result = 'Pass'; detail = 'Guard the native flow-direction mapper'; won = $true }
+            )
+        }
+    }
+
+    It 'names every candidate that competed, with its model and result' {
+        $block = Get-ReplicationFixPanelBlock -Candidate $script:PanelCandidate
+
+        # The whole point of the disclosure: a reader can tell a fix selected
+        # from competing approaches from the one candidate that happened to run.
+        $block | Should -Match 'gpt-5\.6-sol'
+        $block | Should -Match 'claude-opus-5'
+        $block | Should -Match 'Blocked'
+        $block | Should -Match 'oracle failed 1 of 3 runs'
+    }
+
+    It 'marks exactly the candidate whose diff was published' {
+        $block = Get-ReplicationFixPanelBlock -Candidate $script:PanelCandidate
+
+        @([regex]::Matches($block, '\(selected\)')).Count | Should -Be 1
+        $block | Should -Match 'Pass \*\*\(selected\)\*\*'
+    }
+
+    It 'escapes a pipe in candidate prose so the table cannot silently shift its columns' {
+        $candidate = [pscustomobject]@{
+            fixPanel = @(
+                [pscustomobject]@{ attempt = 1; model = 'claude-opus-5'; result = 'Pass'; detail = 'restore the a|b fallback'; won = $true }
+            )
+        }
+
+        $block = Get-ReplicationFixPanelBlock -Candidate $candidate
+
+        # An unescaped pipe ends the cell, so every later column reports the
+        # wrong candidate's value. A row that misattributes a result is worse
+        # than no row at all.
+        $block | Should -Match 'a\\\|b'
+        $row = @($block -split "`n" | Where-Object { $_ -match 'claude-opus-5' })[0]
+        @($row -split '(?<!\\)\|').Count | Should -Be 6
+    }
+
+    It 'says the panel was not measured rather than rendering nothing' {
+        Get-ReplicationFixPanelBlock -Candidate ([pscustomobject]@{ fixFiles = @('a.cs') }) |
+            Should -Match 'Not measured'
+        Get-ReplicationFixPanelBlock -Candidate ([pscustomobject]@{ fixPanel = @() }) |
+            Should -Match 'Not measured'
+    }
+
+    It 'is actually invoked by the body builder, not merely defined' {
+        # A test that exercises a new function in isolation says nothing about
+        # the call site, and the call site is where this class of defect lives:
+        # the regression cross-reference passed every behavioural test it had
+        # while returning nothing in production for its entire life.
+        $errors = $null
+        $ast = [System.Management.Automation.Language.Parser]::ParseFile(
+            (Join-Path $PSScriptRoot 'shared/Publish-ReplicationPR.ps1'), [ref]$null, [ref]$errors)
+        $errors | Should -BeNullOrEmpty
+
+        $body = $ast.Find({
+            $args[0] -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+            $args[0].Name -eq 'New-ReplicationPullRequestBody'
+        }, $true)
+        $body | Should -Not -BeNullOrEmpty
+
+        foreach ($name in @('Get-ReplicationFixPanelBlock', 'Get-ReplicationIndependentReviewBlock')) {
+            $calls = @($body.FindAll({
+                $args[0] -is [System.Management.Automation.Language.CommandAst] -and
+                $args[0].GetCommandName() -eq $name
+            }, $true))
+            $calls.Count | Should -BeGreaterThan 0 -Because "$name must be called by the body builder"
+        }
+    }
+}
+
+Describe 'The candidate gate allowlists every manifest field the orchestrator writes' {
+    It 'accepts each fix* key the orchestrator emits, so a new field cannot destroy a completed run' {
+        # This pipeline has already lost finished runs to exactly this: the
+        # orchestrator gains a manifest field, the gate does not know the name,
+        # and the run is refused after the reproduction, the fix, and every arm
+        # have already been paid for. Pinning the two together makes the next
+        # field fail here - in milliseconds, on a laptop - instead of there.
+        $validator = Join-Path $PSScriptRoot 'shared/Validate-ReplicationCandidate.ps1'
+        $errors = $null
+        $ast = [System.Management.Automation.Language.Parser]::ParseFile($validator, [ref]$null, [ref]$errors)
+        $errors | Should -BeNullOrEmpty
+
+        $function = $ast.Find({
+            $args[0] -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+            $args[0].Name -eq 'Read-ReplicationManifest'
+        }, $true)
+        $function | Should -Not -BeNullOrEmpty
+
+        $assignment = $function.Find({
+            $args[0] -is [System.Management.Automation.Language.AssignmentStatementAst] -and
+            $args[0].Left.Extent.Text -eq '$allowedProperties'
+        }, $true)
+        $assignment | Should -Not -BeNullOrEmpty
+
+        $allowed = & ([scriptblock]::Create($assignment.Right.Extent.Text))
+        $allowed.Count | Should -BeGreaterThan 20
+
+        $orchestrator = Join-Path $PSScriptRoot 'Replicate-Issue.ps1'
+        $written = @([regex]::Matches(
+                (Get-Content -LiteralPath $orchestrator -Raw), '(?m)^\s{12}(fix[A-Za-z]+)\s*=') |
+            ForEach-Object { $_.Groups[1].Value } |
+            Sort-Object -Unique)
+
+        # Guards the guard: if the extraction stops matching, the comparison
+        # below passes vacuously and this test protects nothing.
+        $written.Count | Should -BeGreaterThan 4
+        $written | Should -Contain 'fixPanel'
+
+        @($written | Where-Object { $allowed -cnotcontains $_ }) | Should -BeNullOrEmpty
+    }
+}

.github/scripts/Replicate-Issue.Tests.ps1

@@ -167,6 +167,9 @@ BeforeAll {
         'Test-ReplicationScopeMatchesHead',
         'Read-ReplicationFixScope',
         'Read-ReplicationFixWinner',
+        'Read-ReplicationFixReview',
+        'Invoke-ReplicationFixReview',
+        'Get-ReplicationFixPanelRecord',
         'Get-ReplicationFixArmEvidence',
         'Invoke-ReplicationFixArms',
         'Write-ReplicationFixArmResults',
@@ -8810,6 +8813,7 @@ Describe 'A fix phase is told a different truth than a reproduction phase' {
         $script:agentDir = '/tmp/artifacts/agent'
         $script:fixScopePath = '/tmp/artifacts/agent/fix-scope.json'
         $script:fixWinnerPath = '/tmp/artifacts/agent/fix-winner.json'
+        $script:fixReviewPath = '/tmp/artifacts/agent/fix-review.json'
         $script:fixOracleRunnerPath = '/tmp/artifacts/fix/run-oracle.ps1'
         $script:appiumPlanPath = '/tmp/repo/appium-plan.json'
         $script:sandboxProposalPath = '/tmp/artifacts/agent/sandbox-proposal.json'
@@ -10908,6 +10912,7 @@ Describe 'Every way the fix phase can fail still ships the reproduction' {
 
         $script:fixScopePath = Join-Path $script:agentDir 'fix-scope.json'
         $script:fixWinnerPath = Join-Path $script:agentDir 'winner.json'
+        $script:fixReviewPath = Join-Path $script:agentDir 'review.json'
         $script:fixPatchPath = Join-Path $script:repoRoot 'fix.patch'
         $script:fixOracleRunnerPath = Join-Path $script:repoRoot 'run-oracle.ps1'
 
@@ -11293,6 +11298,7 @@ Describe 'A fix phase may only ask to write files that can be granted' {
         $script:IssueNumber = 12345
         $script:fixScopePath = Join-Path $script:agentDir 'fix-scope.json'
         $script:fixWinnerPath = Join-Path $script:agentDir 'fix-winner.json'
+        $script:fixReviewPath = Join-Path $script:agentDir 'fix-review.json'
         $script:fixPatchPath = Join-Path $script:repoRoot 'fix.patch'
         $script:fixOracleRunnerPath = Join-Path $script:repoRoot 'run-oracle.ps1'
         $script:granted = [Collections.Generic.List[object]]::new()
@@ -14350,3 +14356,146 @@ Describe 'A name that exists is a missing using, not a wrong name' {
         }
     }
 }
+
+Describe 'The independent review cannot cost the fix it describes' {
+    BeforeAll {
+        $script:ReviewSource = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'Replicate-Issue.ps1') -Raw
+        $script:ReviewAst = [System.Management.Automation.Language.Parser]::ParseInput(
+            $script:ReviewSource, [ref]$null, [ref]$null)
+        $script:FixPhaseFn = $script:ReviewAst.Find({
+            param($n)
+            $n -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+            $n.Name -eq 'Invoke-ReplicationFixPhase'
+        }, $true)
+    }
+
+    It 'writes the four-arm results before it asks for a review' {
+        # A step timeout KILLS the process, so no try/catch inside the review
+        # can contain it - and 23% of runs that reach the fix panel time out
+        # inside it. Were the review to run first, a timeout during the model
+        # call would destroy the fix-control and restoration evidence of a fix
+        # that had already passed every arm.
+        #
+        # This arm publishes a paragraph that nothing acts on. It must never be
+        # able to discard the work it describes.
+        $script:FixPhaseFn | Should -Not -BeNullOrEmpty
+
+        $calls = $script:FixPhaseFn.FindAll({
+            param($n) $n -is [System.Management.Automation.Language.CommandAst]
+        }, $true) | Where-Object {
+            $_.GetCommandName() -in @('Write-ReplicationFixArmResults', 'Invoke-ReplicationFixReview')
+        }
+
+        $writeAt = @($calls | Where-Object { $_.GetCommandName() -eq 'Write-ReplicationFixArmResults' } |
+            ForEach-Object { $_.Extent.StartOffset })
+        $reviewAt = @($calls | Where-Object { $_.GetCommandName() -eq 'Invoke-ReplicationFixReview' } |
+            ForEach-Object { $_.Extent.StartOffset })
+
+        $writeAt | Should -Not -BeNullOrEmpty
+        $reviewAt | Should -Not -BeNullOrEmpty
+        ($writeAt | Measure-Object -Maximum).Maximum |
+            Should -BeLessThan ($reviewAt | Measure-Object -Minimum).Minimum
+    }
+
+    It 'contains every failure inside the review rather than letting it reach the fix phase' {
+        $reviewFn = $script:ReviewAst.Find({
+            param($n)
+            $n -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+            $n.Name -eq 'Invoke-ReplicationFixReview'
+        }, $true)
+        $reviewFn | Should -Not -BeNullOrEmpty
+
+        # Every model call and every property read in this arm must sit inside a
+        # try, because StrictMode turns an absent property into a throw and that
+        # throw would land in the fix phase rather than here.
+        $copilotCalls = $reviewFn.FindAll({
+            param($n)
+            $n -is [System.Management.Automation.Language.CommandAst] -and
+            $n.GetCommandName() -eq 'Invoke-ReplicationCopilot'
+        }, $true)
+        @($copilotCalls) | Should -Not -BeNullOrEmpty
+
+        foreach ($call in $copilotCalls) {
+            $guarded = $false
+            $node = $call
+            while ($node) {
+                if ($node -is [System.Management.Automation.Language.TryStatementAst]) { $guarded = $true; break }
+                $node = $node.Parent
+            }
+            $guarded | Should -BeTrue -Because 'a throw here would cost a fix that has already passed all four arms'
+        }
+    }
+}
+
+Describe 'The fix panel record reaches the published manifest' {
+    It 'records every candidate that competed, not only the one that won' {
+        $results = @(
+            [pscustomobject]@{ Attempt = 1; Model = 'claude-opus-5'; Result = 'Blocked'; Rejection = 'changed no file'; Approach = '' }
+            [pscustomobject]@{ Attempt = 2; Model = 'gpt-5.6-sol'; Result = 'Fail'; Rejection = ''; Approach = 'widen the guard' }
+            [pscustomobject]@{ Attempt = 3; Model = 'claude-opus-5'; Result = 'Pass'; Rejection = ''; Approach = 'restore the null check' }
+        )
+
+        $record = @(Get-ReplicationFixPanelRecord -Results $results -WinnerAttempt $results[2])
+
+        $record.Count | Should -Be 3
+        @($record | Where-Object { $_.won }).Count | Should -Be 1
+        ($record | Where-Object { $_.won }).attempt | Should -Be 3
+        ($record | Where-Object { $_.attempt -eq 2 }).model | Should -Be 'gpt-5.6-sol'
+    }
+
+    It 'prefers the rejection for a blocked candidate, whose approach is empty' {
+        # A blocked candidate is the most informative row in the table - it is
+        # the one a reader cannot reconstruct from the published diff - and it
+        # is exactly the row whose approach field is empty.
+        $results = @(
+            [pscustomobject]@{ Attempt = 1; Model = 'claude-opus-5'; Result = 'Blocked'; Rejection = 'changed protected files'; Approach = '' }
+            [pscustomobject]@{ Attempt = 2; Model = 'gpt-5.6-sol'; Result = 'Pass'; Rejection = ''; Approach = 'restore the null check' }
+        )
+
+        $record = @(Get-ReplicationFixPanelRecord -Results $results -WinnerAttempt $results[1])
+
+        ($record | Where-Object { $_.attempt -eq 1 }).detail | Should -Be 'changed protected files'
+        ($record | Where-Object { $_.attempt -eq 2 }).detail | Should -Be 'restore the null check'
+    }
+
+    It 'bounds panel prose without discarding it, because nothing downstream parses it' {
+        # Four completed runs in this pipeline have been destroyed by a bound
+        # that refused instead of trimming. A presentation field must never be
+        # able to do that, so every panel string is converted with -Prose.
+        $results = @(
+            [pscustomobject]@{ Attempt = 1; Model = 'claude-opus-5'; Result = 'Pass'; Rejection = ''; Approach = ('x' * 5000) }
+        )
+
+        { Get-ReplicationFixPanelRecord -Results $results -WinnerAttempt $results[0] } | Should -Not -Throw
+
+        $record = @(Get-ReplicationFixPanelRecord -Results $results -WinnerAttempt $results[0])
+        $record[0].detail.Length | Should -BeLessOrEqual 300
+        $record[0].detail | Should -Not -BeNullOrEmpty
+    }
+
+    It 'survives a candidate record that carries none of the optional properties' {
+        # StrictMode turns a missing property into a thrown error, so reading
+        # by dot would let a display detail abort a fix phase that had already
+        # produced a winning diff. The panel is the last thing that should be
+        # able to destroy a fix, and the existing suite caught exactly this.
+        Set-StrictMode -Version Latest
+
+        $bare = @([pscustomobject]@{ Attempt = 1 })
+
+        { Get-ReplicationFixPanelRecord -Results $bare -WinnerAttempt $bare[0] } | Should -Not -Throw
+
+        $record = @(Get-ReplicationFixPanelRecord -Results $bare -WinnerAttempt $bare[0])
+        $record.Count | Should -Be 1
+        $record[0].attempt | Should -Be 1
+        $record[0].won | Should -BeTrue
+    }
+
+    It 'is written into the candidate manifest under fixPanel' {
+        # The renderer is worthless if the field never reaches the manifest the
+        # publisher reads. This is the call-site half of the panel disclosure.
+        $source = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'Replicate-Issue.ps1') -Raw
+
+        $source | Should -Match '(?m)^\s{12}fixPanel\s*='
+        $source | Should -Match 'Panel = @\(Get-ReplicationFixPanelRecord'
+    }
+}