fix(code-review): make replay fields conditional in the Impact suffix

The suffix injected into the Impact Analyzer's task prompt still stated
the grep contract unconditionally -- "Always run grep too", "populated
external_impact[] and grep_query_used", "If grep returns zero external
usages" -- so the no-text-search fallback was contradicted at the point
of injection even after the prompt file itself was qualified.

Adds coverage for the shape that fallback emits: an all-graph finding
with grep_query_used null, and with the field absent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011QjUMmrqfGU4QNXDDRLPrN

Author: wongk

plugins/code-review/skills/spawn-reviewers/SKILL.md

@@ -274,8 +274,9 @@ entries can cite any repo file.
 
 Write findings to <output_file> in the JSON shape documented in
 shared_prompt.txt (`category: "ImpactAnalysis"`, populated
-external_impact[] and grep_query_used). Emit findings only when you
-have ≥1 concrete external usage with cited breakage. If grep returns
+external_impact[]; `grep_query_used` populated whenever any entry is
+`discovery: "grep"`). Emit findings only when you
+have ≥1 concrete external usage with cited breakage. If your search finds
 zero external usages OR every usage is guarded, do not emit a finding
 for that symbol.
 
@@ -285,17 +286,22 @@ deferred schemas with ToolSearch first) and ALSO use its capability C2 (usage/ca
 enumeration) to reach callers grep cannot (aliases,
 re-exports, dynamic dispatch); tag those entries `discovery: "graph"` and put
 them in the certificate's `graph_discovered_usages` per the Inputs/Step 2
-sections of impact_analyzer_prompt.txt. Always run grep too and record a real
+sections of impact_analyzer_prompt.txt. Run your text-search tool too whenever you
+hold one, and record the real query you ran in
 `grep_query_used` for the `discovery: "grep"` entries (the verifier replays it
-against `external_usages_found`). Read every callsite to capture its verbatim
+against `external_usages_found`). If you hold NO text-search tool at all, leave
+`grep_query_used` null and `external_usages_found` empty and tag every entry
+`discovery: "graph"` — never write a query you did not execute. Read every callsite
+to capture its verbatim
 `callsite_snippet` regardless of substrate, and validate substrate-returned paths are
-inside this checkout. When CODE_INTEL_ALLOWED is false or nothing answers C2, grep only.
+inside this checkout. When CODE_INTEL_ALLOWED is false or nothing answers C2, use
+text search alone (or targeted Reads if you hold no search tool).
 
 Respond ONLY with:
   DONE findings={count} file={output_file_path}
 
-Use Read, Grep, and Glob — plus whatever code-intelligence MCP tools your
-session provides. Do NOT use Bash.
+Use Read, plus whatever text-search and code-intelligence tools your session
+provides. Do NOT use Bash.
 ```
 
 **Design Critic** (conditional, deep tier only, `subagent_type: "code-review:code-review-worker-graph"`, model `sonnet`, `AGENT_ID: "design_critic"`):

plugins/code-review/tools/python/test_code_review_schema.py

@@ -994,6 +994,26 @@ def test_external_impact_discovery_mixed_substrates_valid():
     assert validate_finding(f) == []
 
 
+def test_external_impact_all_graph_with_null_grep_query_valid():
+    # The no-text-search fallback shape: a session holding no Grep and no
+    # MCP equivalent cannot produce a replayable query, so the analyzer
+    # emits every entry as discovery="graph" with grep_query_used null.
+    # The verifier skips the replay gate for this case and audits each
+    # entry by file-read + content match instead, so the validator must
+    # accept it — rejecting it here would silently drop the fallback's
+    # findings and push reviewers back toward inventing a query.
+    f = _impact_finding_with_impacts(_impact_entry("graph"))
+    f["grep_query_used"] = None
+    assert validate_finding(f) == []
+
+
+def test_external_impact_all_graph_with_omitted_grep_query_valid():
+    # Same shape, but the field is absent rather than explicitly null.
+    f = _impact_finding_with_impacts(_impact_entry("graph"))
+    del f["grep_query_used"]
+    assert validate_finding(f) == []
+
+
 def _impact_entry_with_file(file: str) -> dict:
     entry = _impact_entry("graph")
     entry["file"] = file