fix(review): recalibrate interactive findings

plugins/engineering/skills/pr-interactive-review/SKILL.md

@@ -30,12 +30,16 @@ After the review completes, actively enrich every finding without modifying `rev
 {
   "#1": {
     "what_actually_happens": "When an operator saves a label containing markup, the page renders it and the browser executes it.",
+    "what_actually_happens_evidence": {
+      "triggering_setup": "tests/config-label.test.ts creates and saves a label containing markup.",
+      "observable_outcome": "src/config-label.test.ts asserts the rendered label is interpreted as markup."
+    },
     "expected_suggested": "When that label is saved, the page displays the characters as text after encoding at the rendering boundary."
   }
 }
 ```
 
-`what_actually_happens` must state a triggering setup/action and observable failure. `expected_suggested` must state the expected resulting behavior and correction. This sidecar is presentation context only: it must not change review scope, personas, severity, validation, deduplication, or required response. If direct evidence cannot support either statement, omit that field; the site labels the gap instead of inventing a scenario. `prepare` rejects malformed sidecars and IDs that are not review findings.
+`what_actually_happens` must state a triggering setup/action and observable failure. It is rendered as a present defect only when `what_actually_happens_evidence` identifies both the concrete triggering setup/reachability and the observable outcome from a reviewed repository test or fixture, saved configuration/preset, production registry/declaration, reachable callsite, or explicit requirement. Without both, `prepare` removes the unsupported assertion and renders an evidence gap: treat it as an open question, not a defect. `expected_suggested` must state the expected resulting behavior and correction. Compatibility or future-risk observations must stay distinct from present defects and use an evidence-seeking open question until present reachability is proven. This sidecar is presentation context only: it must not change review scope, personas, validation, deduplication, or required response. `prepare` rejects malformed sidecars and IDs that are not review findings.
 
 Specifications may be private when the user authorizes access. Use the appropriate host tool to read or extract an authorized local file, document, or URL. Derive only concise labeled primer fields from that material, then pass the derived text with `--spec`; never put the original source content in this public repository.
 
@@ -103,7 +107,7 @@ bun "$SKILL_DIR/scripts/review-site.ts" serve \
 
 The warning is part of the command contract. Do not expose a review site that contains material the intended network audience may not read.
 
-## Comment handoff loop
+## Comment handoff and lifecycle loop
 
 Reviewers can save general comments or comments attached to a finding. The browser sends only validated, bounded JSON to the local server. Comments are atomically written to `comments.json` in the external workspace; comment bodies are not logged.
 
@@ -113,17 +117,23 @@ To respond as the assistant, first inspect only unanswered local comments:
 curl -sS "http://127.0.0.1:<port>/api/comments?status=unanswered"
 ```
 
-Use the returned comment `id`, formulate an evidence-based response from the review artifact and reviewed code, then save it locally:
+Re-ground every reviewer correction against the review artifact and reviewed code. Never defend an initial finding merely because it appears in the original artifact. Save the evidence-based reply locally, then revise the finding when the correction narrows, reclassifies, or disproves it:
 
 ```bash
 curl -sS -X POST "http://127.0.0.1:<port>/api/comments/<comment-id>/replies" \
   -H 'content-type: application/json' \
   --data '{"role":"assistant","author":"Assistant","body":"Verified response with the required next action."}'
+
+curl -sS -X POST "http://127.0.0.1:<port>/api/findings/%231/revisions" \
+  -H 'content-type: application/json' \
+  --data '{"commentId":"<comment-id>","status":"withdrawn","rationale":"Reviewed fixture and registry show this configuration path is not reachable.","scenario":{"actualHappens":null,"actualTriggerEvidence":null,"actualOutcomeEvidence":null}}'
 ```
 
-The page renders replies with an Assistant label. Refresh unanswered comments until the queue is empty. Never treat this local operation as authority to post a GitHub comment; GitHub posting requires a separate explicit, user-confirmed feature.
+The lifecycle states are `active`, `question`, and `withdrawn`. Every revision requires the attached reviewer comment ID and a rationale. The site preserves the immutable original claim, comments/replies, and append-only revision history, while current status, severity, scenario, active counts, and verdict are recalculated for presentation. Withdrawn findings remain auditable but do not block the verdict. Use `question` when evidence remains incomplete rather than asserting a current defect.
+
+Refresh the site and unanswered queue until the queue is empty. Never treat this local operation as authority to post a GitHub comment; GitHub posting requires a separate explicit, user-confirmed feature.
 
 ## Completion
 1. Confirm the review artifact was consumed as JSON, not markdown.
-2. Browser-check the local site: business context comes first; every finding shows `What actually happens` and `Expected / suggested` (or an explicit evidence gap); severity filters and search work; the responsive layout works; a local comment and assistant reply render; a GitHub remote produces a reviewed-commit line link.
+2. Browser-check the local site: business context comes first; active findings, open questions, and withdrawn findings are visibly separate; verdict/counts exclude withdrawn findings; every finding shows `What actually happens` and `Expected / suggested` (or an explicit evidence gap); severity/status filters and search work; the responsive layout works; a local comment, assistant reply, and lifecycle revision render; a GitHub remote produces a reviewed-commit line link.
 3. State the workspace path and loopback URL. Do not include comment text, credentials, or source contents in the report.