Add OpenCode review merge automation - #4

…feating bug

Verified each against the actual ADR text and the sidecar/launcher
source before acting, per this repo's convention.

Finding #1 (critical) was correct: the previous revision's single
retry predicate ("empty response AND finish_reason == 'length'")
cannot fire for the exact live evidence this ADR cites as its own
justification -- a curl timeout with zero bytes received produces no
response object at all, so there is no finish_reason to inspect. As
written, the ADR would not have fixed the reproduced outage motivating
it. Fixed by splitting into two distinct, independently-triggered
retries: Trigger A (no usable response -- timeout, connection failure,
non-2xx) retries at the same budget, since a hang is not a budget
problem; Trigger B (a response was received, empty, finish_reason ==
"length") escalates the budget. Only Trigger B changes max_tokens.

Finding #2 (a real gap): an escalated probe can itself be rejected
outright by a model whose real ceiling sits below the escalated
budget -- a distinct signature from empty content, now its own
recorded outcome (escalated_probe_rejected) rather than blindly
retried or conflated with the down case.

Finding #3 (real arithmetic problem): an unconditional "one retry per
candidate" across up to 12 candidates plus the gateway check was an
unbounded-looking worst case against Layer 1's own 180s readiness
ceiling. Fixed with explicit, computed, shared per-layer retry
budgets: Layer 1 stays within its existing 180s ceiling (12 base
attempts + a capped 4 escalations x 10s = 160s). Layer 2 keeps its
existing, already-evidenced 120s per-attempt timeout UNCHANGED --
verified against this exact file's own prior comment explaining why
30s was raised to 120s (a real reasoning generation can legitimately
need that long, and the job already budgets 120 minutes) --
shortening it would have regressed that fix. Layer 2 gets up to 3
bounded attempts (360s worst case) instead of one with no recovery.

Finding #4: committed to concrete initial values instead of deferring
every number to future telemetry -- each is either already deployed in
this codebase (10s, 120s, 4096, 12) or backed by direct external
documentation (16, per OpenRouter's own schema: "some providers
enforce a minimum of 16"). Both layers now also emit finish_reason,
attempt count, and which trigger fired, so a real follow-up pass can
refine these from actual telemetry.

Finding #5: source citations are now SHA-pinned permalinks
(8b3235d...) instead of bare line numbers that rot as files change.

Co-Authored-By: Claude <[email protected]>

- docs/adr/0003: ADR-0003's amendment said the audit "confirms" both
  OpenCode and Strix vendor/invoke the same sidecar/pool, but the audit
  doc's own item 1 explicitly distinguishes strix.yml (real job-log trace)
  from opencode-review-dispatch.yml (inferred from shared-code identity,
  not independently observed -- blocked by a rate limit that session).
  Reworded to match that distinction instead of folding both into one
  "confirmed" claim.
- docs/product-goal-directive.md: the 2026-08-30 CodeRabbit note still said
  "only Strix uses orchestrator/auto", contradicting the file's own later
  2026-09-02 resolution note and ADR-0003, which both record Strix now also
  pinned to orchestrator/free. Marked the original wording historical and
  updated the pool description to current state.
- docs/doctoring/contextual-orchestrator-gateway-enforcement-audit-20260902.md:
  added `text` language identifiers to the two un-tagged log fences
  (MD040).
- docs/product-technical-gap-baseline.md: escaped three mid-paragraph PR-
  number references ("#4:", "#21", "#1669") that markdownlint's MD018
  misparses as malformed ATX headings when hard-wrapping puts them at the
  start of a line; \# renders identically while satisfying the rule.

Co-Authored-By: Claude Sonnet 5 <[email protected]>