Publish truthful compact review summaries

ARCHITECTURE.md

@@ -190,6 +190,11 @@ additions (violations are `kind: contentPolicy`). Content policy is on by defaul
    against code logic, an identifier, or structured data is not itself validated, but
    the prompt instructs against it and it is expected to be rare and low-confidence.
 7. Forge summaries do not duplicate inline findings or expose model/provider details.
+   GitHub inline counts require observed comment IDs: the create-review body makes no
+   inline-delivery claim, then an idempotent summary update adds the reconciled count.
+   Exhausted update retries leave that claim absent without invalidating the receipt.
+   Oversized summaries degrade to a bounded marker-bearing body instead of preventing
+   valid inline comments from being published.
    Operational-only failures skip the PR review and use generic linked check text.
 8. `humanEscalation` blocks by kind at confidence 0.30 or above. It represents an
    irreducible owner decision, not uncertainty about a concrete defect. Admin overrides

docs/automation.md

@@ -47,4 +47,4 @@ Pass comment text through `POSTIL_COMMENT` in automation because command-line ar
 
 Hosted workers can set `POSTIL_USAGE_RECEIPT_PATH` to a worker-owned path. A successful response writes a mode-`0600` version 2 JSON receipt before forge delivery. Every provider attempt includes its role, phase, operation-wide call ordinal, transport attempt, token counts, accounting-completeness flag, cost source, canonical provider-reported decimal cost when present, and rounded micro-dollar display value. The caller owns receipt deletion. Receipt consumers must accept the additional `costProviderDecimal` field before deploying this CLI.
 
-Hosted reviews can set `POSTIL_PUBLICATION_RECEIPT_PATH` to a worker-owned path. Review publication writes a mode-`0600` version 1 JSON receipt atomically. Each entry carries the stable finding ID when present, marks legacy fallback identities, and records its initial publication outcome. GitHub receipts include review and inline-comment identities when available and record rejected inline placement before the summary-only fallback. Reconciled retries return the existing review identities without posting a duplicate. The caller owns receipt deletion.
+Hosted reviews can set `POSTIL_PUBLICATION_RECEIPT_PATH` to a worker-owned path. Review publication writes a mode-`0600` version 1 JSON receipt atomically. Each entry carries the stable finding ID when present, marks legacy fallback identities, and records its initial publication outcome. GitHub receipts include review and inline-comment identities when available and record rejected inline placement before the summary-only fallback. The GitHub create-review body makes no inline-delivery claim; an idempotent review-summary update adds only the count backed by observed comment IDs, while exhausted update retries leave the claim absent and preserve the receipt. Reconciled retries return the existing review identities without posting a duplicate. The caller owns receipt deletion.