Never fold two findings that both name no rule

Found by the review pass the plan schedules after this cluster. The fold
compared rule codes for equality, and two absent codes are equal, so a
deletions-stage finding citing no rule could be folded into an unrelated
adversarial finding that happened to overlap it in the same file.

Every duplicate actually observed carried a rule code, so this was a latent
path rather than a live defect. It is also the one direction this fold must
never take: a surviving duplicate is noise a person can dismiss, and a folded
finding is gone with nothing to notice. Two findings at one line that both
cite nothing are indistinguishable to this code, so folding them is a guess,
and the guess now goes toward keeping both.

Removing the guard fails the new test by name.

Author: Poolchaos

docs/DECISIONS.md

@@ -1636,3 +1636,22 @@ verified evidence, in writing, here.
   minimum is S1's risk rationale, which disposes of nothing and refuses
   nothing; it stays as it is rather than gaining a constraint that could fail
   a run over a cosmetic field.
+- 2026-08-04 REVIEW ROUND (after the WP-A to WP-F cluster, per the plan's
+  cadence): a pass over the day's eight behaviour-changing commits. One
+  finding, fixed in the same pass.
+  Finding 1: the D-59 fold matched on rule code equality, and two findings
+  that both name no rule compared equal, so a deletions-stage finding citing
+  nothing could be folded into an unrelated adversarial one at the same line.
+  The observed duplication always carried rule codes, so this was a latent
+  path rather than an active defect, but it is the one direction this fold
+  must never take. A finding naming no rule is now never folded; the test
+  fails by name when the guard is removed.
+  Checked and sound: the literal-pattern fallback never changes a valid
+  regex's meaning; the fold cannot merge across repositories, since ledger
+  paths carry their slug; the deleted-module finding, which S4 raises by
+  design, is not foldable because no adversarial finding exists in a file
+  outside the change set; the rule-code reader strips a word and its
+  punctuation, never digits, so "Rule 1a" against a ruleset holding "1" is
+  kept rather than snapped; and the private-material scan over untracked
+  files did not grow the file count, so .gitignore is doing the excluding.
+  `./verify.sh --build --e2e` exited 0 over the whole cluster.

src/server/review/pipeline.ts

@@ -489,21 +489,28 @@ export async function runReviewPipeline(input: PipelineInput): Promise<PipelineR
   // candidates, each one twice, and the person deciding them would have
   // decided every finding in the review twice (D-59).
   //
-  // The match is deliberately narrow: same file, same rule, and line ranges
-  // that overlap. Folding on position alone would merge two genuinely
+  // The match is deliberately narrow: same file, same named rule, and line
+  // ranges that overlap. Folding on position alone would merge two genuinely
   // different findings that happen to cite one line, and losing a real
   // finding silently is the one failure this pipeline exists to prevent.
   // A duplicate that survives because the two stages spelled the rule
   // differently is visible noise; a fold that ate a finding is not.
+  //
+  // A finding that names no rule is never folded. Two such findings at one
+  // line are indistinguishable to this code, so folding them would be a
+  // guess, and the direction to guess in is the one that keeps both.
   const foldedIntoEarlier: string[] = [];
   for (const finding of deletions.findings) {
-    const alreadyRaised = candidates.find(
-      (existing) =>
-        existing.filePath === finding.path &&
-        existing.ruleCode === finding.ruleCode &&
-        existing.lineStart <= finding.lineEnd &&
-        finding.lineStart <= existing.lineEnd,
-    );
+    const alreadyRaised =
+      finding.ruleCode === null
+        ? undefined
+        : candidates.find(
+            (existing) =>
+              existing.filePath === finding.path &&
+              existing.ruleCode === finding.ruleCode &&
+              existing.lineStart <= finding.lineEnd &&
+              finding.lineStart <= existing.lineEnd,
+          );
     if (alreadyRaised) {
       foldedIntoEarlier.push(`${finding.path}:${finding.lineStart}`);
       continue;

tests/server/review/pipeline.test.ts

@@ -311,6 +311,26 @@ describe("a finding two stages both report", () => {
     expect(result.candidatesRaised).toBe(2);
   });
 
+  it("keeps a finding that names no rule, rather than guessing it is the same one", async () => {
+    // Two findings at one line that both cite nothing are indistinguishable
+    // here, so folding them would be a guess. The direction to guess in is
+    // the one that keeps both: a duplicate is noise, a lost finding is not.
+    const result = await run({
+      ...BASE_ANSWERS,
+      s3_adversarial: {
+        ...COMPLETE_ADVERSARIAL,
+        findings: [{ ...COMPLETE_ADVERSARIAL.findings[0]!, ruleCode: null }],
+      },
+      s4_deletions: {
+        findings: [restated({ ruleCode: null, issue: "Also unattributed, also line 2." })],
+        reviewedDeletions: [],
+      },
+      s5_verification: { verdicts: [] },
+    });
+
+    expect(result.candidatesRaised).toBe(2);
+  });
+
   it("keeps a finding at a line the earlier one does not cover", async () => {
     const result = await run({
       ...BASE_ANSWERS,