ci: tighten auto-review prompt + add accepted-trade-offs list

.github/workflows/claude-review.yml

@@ -42,17 +42,34 @@ jobs:
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
 
-            Review this pull request in the context of the full codebase and CLAUDE.md,
-            focusing on:
-            - Correctness bugs and logic errors
-            - Security implications
-            - Broken edge cases and regressions
-
-            The PR branch is already checked out in the working directory.
-
-            Use `gh pr comment` for a short top-level summary.
-            Use `mcp__github_inline_comment__create_inline_comment` (with `confirmed: true`)
-            to flag specific issues on the exact lines.
-            Only post GitHub comments - don't submit review text as messages.
+            You are reviewing a pull request for "The Long Night," a small hobby
+            Halloween-party game (Flask + Firebase, two containers on a Raspberry Pi).
+            Read CLAUDE.md FIRST: it documents the architecture AND the deliberate
+            trade-offs this repo has already accepted, including a "Review scope —
+            accepted trade-offs" list. Anything CLAUDE.md marks intentional is settled —
+            never re-flag it, and never try to "correct" CLAUDE.md about a decision it
+            documents.
+
+            SCOPE: review ONLY what THIS PR's diff changes. Do not audit pre-existing
+            code, dependencies, or design decisions the PR does not touch. If the diff
+            did not introduce or directly worsen a problem, do not raise it.
+
+            BAR: post a finding only when you are confident it is a real correctness bug,
+            security hole, or regression introduced by this PR. No style nits, no
+            "consider…" suggestions, no praise, no speculative hardening. When in doubt,
+            stay silent. Most PRs should get ZERO inline comments — that is a success.
+
+            Tag each inline finding 🔴 (must-fix: bug/security) or 🟠 (should-fix:
+            logic/edge case). Nothing below that bar is worth a comment.
+
+            SUMMARY: keep it to 4 lines max, and UPDATE your previous summary in place
+            instead of posting a new comment each run:
+              gh pr comment ${{ github.event.pull_request.number }} --edit-last --create-if-none --body "…"
+            If there are no 🔴/🟠 findings, the entire summary is the single line:
+            "No blocking issues."
+
+            Post inline findings with mcp__github_inline_comment__create_inline_comment
+            (confirmed: true) on the exact lines. Only post GitHub comments — do not emit
+            review text as chat messages.
           claude_args: |
             --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

CLAUDE.md

@@ -184,6 +184,16 @@ anymore (GPUH now deploys only GBot).
   workflow makes a PR fail its own review — the action's **backend** rejects a PR whose workflow
   differs from `master`'s (`401 Workflow validation failed`, not a GitHub-side rule) — so merge
   workflow changes on their own first.
+- **Review scope — accepted trade-offs (the auto-reviewer must NOT re-flag these):** the
+  Flask/werkzeug built-in server in prod (behind the Cloudflare tunnel), in-memory
+  server-side sessions, the self-signed web cert, camelCase Python function names, mutable
+  GitHub Action version tags (`@vN` rather than SHA-pinned — so upstream fixes are picked up
+  automatically), and the `401 Workflow validation failed` self-review failure on
+  workflow-editing PRs (real and by
+  design — see above). These are settled; a review that raises them is noise, not a finding.
+  **Append a line here whenever a future review flags something we decide to accept** — this
+  list is how the reviewer "learns" what to ignore (the prompt in `claude-review.yml` points
+  at it).
 - **Deploy (Pi):** `scripts/deploy-watcher.sh`, started at boot from `/etc/rc.local` via
   `scripts/start.sh`, polls GHCR every `DEPLOY_POLL_INTERVAL`s (default 120) and — when a new image
   digest appears — runs `scripts/deploy.sh`: `git fetch` + `git checkout -f master` +