fix: review hardening — full push-range diff, fail-closed diff fetch, crash-safe queue, 403 self-heal

- push reviews now fetch ONE compare diff (before...after) instead of
  slicing to the first 20 commits under a head-sha status; new-branch
  pushes (zero before-sha) fall back to the head commit diff
- truncated diffs can no longer yield a clean pass: verdict capped at
  warn and status description prefixed 'partial review (diff truncated)'
- any diff-fetch failure (throw / empty body on a non-empty push or PR)
  short-circuits to status 'warning' ('review unavailable — diff fetch
  failed (not blocking)') with a ledger row; a diffless prompt is never
  sent to the model
- accepted jobs persist to sqlite (queue_jobs) before the pending status
  posts; startup re-enqueues rows that never reached a final state, so
  restarts no longer strand shas at 'pending'
- 403 on status/comment posts self-heals: admin-scoped token (config
  admin_token) adds shre-reviewer as collaborator (write), retries once
- scripts/wire-repos.mjs: idempotent estate-wide webhook + collaborator
  wiring over GET /repos/search
- tests: 32 -> 51 (truncation cap, persisted-queue reconciliation,
  collab-retry stubs, fetchDiff routing)

Co-Authored-By: Claude Fable 5 <[email protected]>

README.md

@@ -60,12 +60,19 @@ Dependencies: **none**. Node ≥ 22.13 (uses `node:sqlite`, global `fetch`).
   "routerUrl": "http://localhost:5497",
   "model": "anthropic/claude-sonnet-4-6",
   "tenantId": "nirlab",
-  "publicBaseUrl": "http://localhost:5498"
+  "publicBaseUrl": "http://localhost:5498",
+  "admin_token": "<admin-scoped token (user nirpa) — used ONLY to self-heal bot access>",
+  "botUsername": "shre-reviewer"
 }
 ```
 
 Bot identity: Gitea user `shre-reviewer` (created via `gitea admin user create`).
 
+`admin_token` powers the 403 self-heal: when a status/comment post returns 403
+(a repo auto-wired by the admin default hook where the bot has no access yet),
+the service adds `shre-reviewer` as collaborator (write) via the admin token
+and retries the post once. Without `admin_token` the 403 surfaces as before.
+
 ## Deploy (Mac dev tier)
 
 - `launchd/ai.granthi.review.plist` → `~/Library/LaunchAgents/`, KeepAlive service on :5498, running from the `~/Services/granthi-review` clone.
@@ -83,9 +90,15 @@ Bot identity: Gitea user `shre-reviewer` (created via `gitea admin user create`)
 
 ### Known v1 limitations
 
-- The review queue is in-memory: a service restart drops queued/in-flight reviews, leaving that sha's `granthi-review` status at `pending`. Re-push (or push an empty commit) to re-trigger.
 - Bare pushes get status + ledger only (no Gitea commit-comment API).
-- Reviews for repos outside the pilot set require the bot (`shre-reviewer`) to have write access before statuses/comments can post; grant collaborator write when adding repos.
+
+### Hardening (fix/review-hardening)
+
+- **Full push-range review**: pushes are reviewed as ONE compare diff `before...after` (web compare `.diff` route — the 1.27 API has no compare diff variant). New-branch pushes (`before` = zero sha) fall back to the head commit diff. No more first-20-commits slicing under a head-sha status.
+- **Truncated diff ≠ pass**: when the 60KB cap truncates the diff, the prompt and the status description both say `partial review (diff truncated)` and the verdict is capped at `warn` (a confirmed-critical `fail` still fails).
+- **Diff fetch failure ≠ pass**: any diff-fetch failure (throw, non-200, empty body for a non-empty push/PR) short-circuits to status `warning` — `review unavailable — diff fetch failed (not blocking)` — with a ledger row. A diffless prompt is never sent.
+- **Crash-safe queue**: every accepted job is persisted to sqlite (`queue_jobs`) before the pending status posts; on startup, rows that never reached a final state are re-enqueued, so a restart no longer strands a sha at `pending`.
+- **403 self-heal**: see `admin_token` above. `scripts/wire-repos.mjs` wires the webhook + bot collaborator across ALL repos on the peer (idempotent; re-runnable).
 
 ## Adding the Reviews tab later (Granthi overlay)