feat(review): reuse completed findings across pushes via --reuse-from

[nitishagar]

Summary

Adds an opt-in --reuse-from <file> flag to ocr review that takes a previous run's JSON output as a reuse source: items whose content fingerprint matches a completed item in that source are reused (previous comments carried over, recorded in coverage.reused and review_item_reused events) instead of re-reviewed, so review-gate loops stop re-reviewing byte-identical files on every push.

Fixes #854 (implementing the --reuse-from half the issue narrowed to on 2026-08-20; the relax-ValidateOptions half was explicitly dropped there and --resume semantics are untouched by this PR).

Background

--resume already implements fingerprint reuse (sha256(mode \0 oldPath \0 newPath \0 diffText)), but it is strict crash recovery: the resumed session's --from/--to must match exactly and the session store must exist locally. In a PR gate loop the head moves every push and CI runners are ephemeral, so resume can never apply — every round re-reviews the full range (the issue measures 19 gate rounds at ~2M tokens each, the majority on byte-identical files).

How it works

• The loader (cmd/opencodereview/reuse_from.go) reads the previous run's --format json output — the manifest (coverage fingerprints + repository identity) and the flat comment list, both already published by every run — and synthesizes a ResumeState for the existing reuse engine in applyResume.
• Fingerprint match is the safety story: the fingerprint embeds mode and both path spellings plus the full diff text, so any change to a file (including base drift after a rebase) invalidates the match and forces a fresh review. A moved --to is therefore fine — untouched files keep byte-identical diffs.
• Trust boundary: a source whose recorded repository identity (sha256 of the canonical remote) differs from the current repo is rejected; mode mismatches can never match structurally.
• Degradation, not failure: a missing, unreadable, malformed, wrong-schema, or different-repo source produces an [ocr] WARNING and today's full review — never a hard error.
• --resume keeps its strict semantics (ValidateOptions/ValidateResume never fire on the reuse path); --reuse-from is mutually exclusive with --resume and --preview.
• Reused items never reach the LLM (pinned by a prompt-spy test); the run prints [ocr] Reuse <id>: reusing N file(s), reviewing M file(s) and resume.resumed_from carries the reuse:<run_id> source in JSON output.

A CI workflow can wire this by uploading the result JSON of each run and passing it to the next push's review — the reference GitHub Action flow already uploads that artifact.

Testing

make check, make test (race), and make coverage (91.0% ≥ 90) green. New tests cover the loader gate matrix (unreadable/invalid JSON/nil manifest/schema mismatch/wrong repo/empty-vs-empty identity), the moved---to headline scenario (unchanged file reused with its comments, changed file reviewed fresh), mode-mismatch structural exclusion, all-reused (dispatched == 0), mutual exclusions, and an end-to-end wiring test (mutation-verified: deleting the wiring fails the test) asserting zero LLM calls for a fully-reused run and warning+full-review for a degraded source. loadReuseState, sameRepositoryIdentity, and applyResume at 100% line coverage.

[github-actions]

✅ OpenCodeReview: Review complete: 0 finding(s) across 4 selected item(s).