From 1e882f086966b1b90046fb74ba5fdff62567185b Mon Sep 17 00:00:00 2001
From: "Fredrik Liljegren (Claude Code Claude Opus 5)"
 <fredrik.liljegren@naturalcycles.com>
Date: Tue, 8 Sep 2026 16:44:51 +0200
Subject: [PATCH] feat: the agent names the findings behind an alert, and
 alerted pull requests sit at the top of the inbox
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The preparing agent can now print an ALERT-FINDINGS line beside its ALERT,
naming the inline findings that make the pull request one to look at now — by
the thread ids `diffity agent comment` printed, as 8-character prefixes or full
uuids, spaced or comma-separated. They are kept on the row in a new
`alert_findings` column, and a pull request with an alert is listed under a new
Alerted section above Ready, on the page and in `diffity inbox status`, most
recently prepared first. A posted review still takes the row to Handled, and an
alert notifies from either list.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bwp5QefjsjMFeq6CK6cT6w
---
 README.md                                  |  2 +-
 package-lock.json                          | 12 +--
 packages/api/package.json                  |  2 +-
 packages/cli/package.json                  |  2 +-
 packages/cli/src/commands/inbox.ts         | 21 +++--
 packages/cli/src/inbox/page.ts             | 26 +++++--
 packages/cli/src/inbox/prepare.ts          |  4 +-
 packages/cli/src/inbox/prompt.ts           | 44 ++++++++---
 packages/cli/src/inbox/store.ts            | 32 +++++++-
 packages/cli/src/inbox/tick.ts             |  2 +
 packages/cli/src/inbox/view.ts             | 17 ++--
 packages/cli/tests/inbox-daemon.test.ts    |  2 +-
 packages/cli/tests/inbox-handled.test.ts   | 91 +++++++++++++++++++---
 packages/cli/tests/inbox-open.test.ts      |  2 +-
 packages/cli/tests/inbox-page.test.ts      | 16 ++++
 packages/cli/tests/inbox-prepare.test.ts   |  8 +-
 packages/cli/tests/inbox-reconcile.test.ts |  2 +-
 packages/cli/tests/inbox-store.test.ts     | 40 +++++++++-
 packages/cli/tests/inbox-tick.test.ts      | 44 ++++++++---
 packages/cli/tests/inbox-units.test.ts     | 36 ++++++++-
 packages/git/package.json                  |  2 +-
 packages/github/package.json               |  2 +-
 packages/parser/package.json               |  2 +-
 packages/ui/package.json                   |  2 +-
 24 files changed, 335 insertions(+), 78 deletions(-)

diff --git a/README.md b/README.md
index 3ff0271..19e1701 100644
--- a/README.md
+++ b/README.md
@@ -357,7 +357,7 @@ On first run it writes `~/.diffity/inbox/config.json`:
 | `worktreesDir` | Where each pull request gets its worktree. |
 | `skipTitles` | Regular expressions matched against the title, one per line in the page — `\(payments\)`, `Release$`. A match skips the pull request before any agent runs, and ↑ overrides it; the match is re-decided at every poll, so a retitle brings the pull request back to the queue. For what a regex cannot express, `filter`. Editable from the page's Settings panel. |
 | `filter` | Your own words on what does and doesn't need your attention, handed to the agent — it answers with a skip instead of reviewing when a PR matches (e.g. "Skip payments-focused PRs"). The agent has to load the skill and read the diff to decide, so every skip costs an agent run; `skipTitles` above costs nothing. Editable from the page's Settings panel. |
-| `alertWhen` | Your own words on what needs you *now*. The agent judges each prepared review against them and flags the ones that match; the page notifies for those only — empty means every prepared review. Editable from the page's Settings panel. |
+| `alertWhen` | Your own words on what needs you *now*. The agent judges each prepared review against them and flags the ones that match, naming the findings behind the flag; the flagged ones are listed under **Alerted**, above Ready, and the page notifies for those only — empty means every prepared review. Editable from the page's Settings panel. |
 | `alertPaths` | Globs against the pull request's changed paths, one per line in the page — `packages/shared/src/model/**`, `**/dbref/**`. A changed file matching one marks the review as needing you now, whatever the agent made of `alertWhen`. Editable from the page's Settings panel. |
 | `agent.model` | `--model` for the review agent; `null` leaves its own default. Editable from the page. |
 | `agent.effort` | `--effort`: `low`, `medium`, `high`, `xhigh` or `max`; `null` leaves its own default. Editable from the page. |
diff --git a/package-lock.json b/package-lock.json
index cf63643..100a4a1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8457,7 +8457,7 @@
     },
     "packages/api": {
       "name": "@diffity/api",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "dependencies": {
         "@diffity/parser": "*"
       },
@@ -8468,7 +8468,7 @@
     },
     "packages/cli": {
       "name": "@naturalcycles/diffity",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "license": "MIT",
       "dependencies": {
         "commander": "^14.0.3",
@@ -8492,7 +8492,7 @@
     },
     "packages/git": {
       "name": "@diffity/git",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "devDependencies": {
         "@types/node": "^25.5.0",
         "typescript": "^5.9.3",
@@ -8501,7 +8501,7 @@
     },
     "packages/github": {
       "name": "@diffity/github",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "dependencies": {
         "@diffity/api": "*",
         "@diffity/parser": "*"
@@ -8514,7 +8514,7 @@
     },
     "packages/parser": {
       "name": "@diffity/parser",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "devDependencies": {
         "typescript": "^5.9.3",
         "vitest": "^4.1.0"
@@ -8522,7 +8522,7 @@
     },
     "packages/ui": {
       "name": "@diffity/ui",
-      "version": "0.10.29",
+      "version": "0.10.30",
       "dependencies": {
         "@diffity/api": "*",
         "@diffity/parser": "*",
diff --git a/packages/api/package.json b/packages/api/package.json
index 639dfbd..f338e50 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@diffity/api",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 8fa4dc4..f0834a4 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@naturalcycles/diffity",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "description": "Agent-agnostic, GitHub-style diff viewer and code review tool with a live agent loop",
   "type": "module",
   "bin": {
diff --git a/packages/cli/src/commands/inbox.ts b/packages/cli/src/commands/inbox.ts
index f099e4e..a5c109b 100644
--- a/packages/cli/src/commands/inbox.ts
+++ b/packages/cli/src/commands/inbox.ts
@@ -6,7 +6,7 @@ import { inboxConfigPath, inboxStorePath } from '../inbox/paths.js';
 import { InboxStore, type RunTotals } from '../inbox/store.js';
 import { runDaemon } from '../inbox/daemon.js';
 import { allowFromEnv, mcpGateDecision } from '../inbox/mcp-gate.js';
-import { buildView } from '../inbox/view.js';
+import { buildView, type InboxRow } from '../inbox/view.js';
 import { localHhMm, localWhen, minutesOf, money, tokensLabel } from '../inbox/runs.js';
 
 export function registerInboxCommand(program: Command): void {
@@ -87,16 +87,15 @@ export function registerInboxCommand(program: Command): void {
         return;
       }
 
-      if (view.ready.length === 0 && view.working.length === 0 && view.handled.length === 0
-        && view.other.length === 0 && view.dismissed.length === 0) {
+      if (view.alerted.length === 0 && view.ready.length === 0 && view.working.length === 0
+        && view.handled.length === 0 && view.other.length === 0 && view.dismissed.length === 0) {
         console.log(pc.dim('Nothing in the inbox yet. Run `diffity inbox` to start watching.'));
         spent(view);
         return;
       }
 
-      section('Ready to review', view.ready.map(row =>
-        `  ${sizeBadge(row)} ${pc.bold(`${row.repo}#${row.number}`)} ${row.title}${row.summary ? pc.dim(`  ${row.summary}`) : ''}${row.alert ? pc.red(`  ⚠ ${row.alert}`) : ''}${row.stale ? pc.yellow('  (stale — new commits)') : ''}`,
-      ));
+      section('Alerted', view.alerted.map(preparedLine));
+      section('Ready to review', view.ready.map(preparedLine));
       section('Queue', view.working.map(row =>
         `  ${pc.dim(row.status.padEnd(9))} ${row.repo}#${row.number} ${row.title} ${pc.dim(row.statusReason ?? '')}`,
       ));
@@ -199,6 +198,16 @@ function section(title: string, lines: string[]): void {
   }
 }
 
+/** A prepared review as one line: its size, what was found, and what was raised about it. */
+function preparedLine(row: InboxRow): string {
+  const findings = row.alertFindings.length;
+  return `  ${sizeBadge(row)} ${pc.bold(`${row.repo}#${row.number}`)} ${row.title}`
+    + `${row.summary ? pc.dim(`  ${row.summary}`) : ''}`
+    + `${row.alert ? pc.red(`  ⚠ ${row.alert}`) : ''}`
+    + `${findings ? pc.red(`  ${findings} finding${findings === 1 ? '' : 's'}`) : ''}`
+    + `${row.stale ? pc.yellow('  (stale — new commits)') : ''}`;
+}
+
 function sizeBadge(row: { additions: number; deletions: number }): string {
   return pc.dim(`+${row.additions}/-${row.deletions}`.padEnd(12));
 }
diff --git a/packages/cli/src/inbox/page.ts b/packages/cli/src/inbox/page.ts
index c7d880c..a13a856 100644
--- a/packages/cli/src/inbox/page.ts
+++ b/packages/cli/src/inbox/page.ts
@@ -113,6 +113,10 @@ export function inboxPage(): string {
   </span>
 </header>
 <main>
+  <section id="alerted-section" hidden>
+    <h2>Alerted</h2>
+    <div id="alerted"></div>
+  </section>
   <section id="ready-section" hidden>
     <h2>Ready to review</h2>
     <div id="ready"></div>
@@ -215,6 +219,12 @@ export function inboxPage(): string {
     return String(at.getHours()).padStart(2, '0') + ':' + String(at.getMinutes()).padStart(2, '0');
   }
 
+  /** How many findings the agent named as the reason for the alert, when it named any. */
+  function findingsLabel(r) {
+    const named = (r.alertFindings || []).length;
+    return named ? named + ' finding' + (named === 1 ? '' : 's') : '';
+  }
+
   /** What the agent runs behind a prepared review came to; the hover has them one by one. */
   function spendLabel(r) {
     return r.spend ? Math.round(r.spend.minutes) + ' min \\u00b7 ' + money(r.spend.costUsd) : '';
@@ -247,8 +257,8 @@ export function inboxPage(): string {
       ciDot(r) +
       '<span class="title"><div><span class="repo">' + esc(r.repo) + '#' + r.number + '</span> ' +
       '<span class="name">' + esc(r.title) + '</span></div>' +
-      metaLine(['by ' + esc(r.author), r.changedFiles + ' file(s)', esc(r.summary || ''), spendLabel(r), times(r)],
-        r.spend ? r.spend.detail : '') + '</span>' +
+      metaLine(['by ' + esc(r.author), r.changedFiles + ' file(s)', esc(r.summary || ''), esc(r.alert || ''),
+        findingsLabel(r), spendLabel(r), times(r)], r.spend ? r.spend.detail : '') + '</span>' +
       (r.alert ? '<span class="badge alert" title="' + esc(r.alert) + '">alert</span>' : '') +
       (r.stale ? '<span class="badge stale">stale</span>' : '') +
       '<span class="open-hint">open \\u2197</span>';
@@ -372,7 +382,7 @@ export function inboxPage(): string {
   }
 
   function announce(view) {
-    const current = new Map(view.ready.map(r => [r.id + '@' + (r.preparedAt || ''), r]));
+    const current = new Map([...view.alerted, ...view.ready].map(r => [r.id + '@' + (r.preparedAt || ''), r]));
     if (known !== null && canNotify()) {
       for (const [key, r] of current) {
         if (known.has(key)) continue;
@@ -483,6 +493,7 @@ export function inboxPage(): string {
       const res = await fetch('/api/inbox', { cache: 'no-store' });
       const view = await res.json();
       announce(view);
+      fill('alerted-section', 'alerted', view.alerted, r => withActions(readyRow(r), r));
       fill('ready-section', 'ready', view.ready, r => withActions(readyRow(r), r));
       fill('working-section', 'working', view.working, r => withActions(workingRow(r), r));
       fill('handled-section', 'handled', view.handled, r => withActions(handledRow(r), r, REPREPARE_TITLE));
@@ -491,9 +502,14 @@ export function inboxPage(): string {
         return withActions(plainRow(r, bad ? 'bad' : 'work', r.status), r);
       });
       fill('dismissed-section', 'dismissed', view.dismissed, r => withActions(plainRow(r, 'work', 'dismissed'), r));
-      const total = view.ready.length + view.working.length + view.handled.length + view.other.length + view.dismissed.length;
+      const total = view.alerted.length + view.ready.length + view.working.length + view.handled.length
+        + view.other.length + view.dismissed.length;
       el('all-empty').hidden = total > 0;
-      el('status').textContent = view.ready.length + ' ready \\u00b7 ' + view.working.length + ' queued';
+      el('status').textContent = [
+        view.alerted.length ? view.alerted.length + ' alerted' : '',
+        view.ready.length + ' ready',
+        view.working.length + ' queued',
+      ].filter(Boolean).join(' \\u00b7 ');
       showReload(view.ticking === true);
       el('foot').textContent = [
         'Updated ' + new Date().toLocaleTimeString() + (view.lastPollAt ? ' \\u00b7 last poll ' + ago(view.lastPollAt) : ''),
diff --git a/packages/cli/src/inbox/prepare.ts b/packages/cli/src/inbox/prepare.ts
index 4c831b3..5494e94 100644
--- a/packages/cli/src/inbox/prepare.ts
+++ b/packages/cli/src/inbox/prepare.ts
@@ -72,7 +72,7 @@ export interface ValidateRun extends RunLog {
 }
 
 export type PrepareResult =
-  | { kind: 'prepared'; headSha: string; bundlePath: string; worktree: string; logPath: string; at: string; summary: string | null; alert: string | null; run: RunLog; validation: Validation; validateRun: ValidateRun | null }
+  | { kind: 'prepared'; headSha: string; bundlePath: string; worktree: string; logPath: string; at: string; summary: string | null; alert: string | null; alertFindings: string[]; run: RunLog; validation: Validation; validateRun: ValidateRun | null }
   | { kind: 'skipped'; reason: string; logPath: string; run: RunLog }
   | { kind: 'failed'; reason: string; failure: PrepareFailure; worktree: string | null; logPath: string | null; run: RunLog; resetsAt?: string | null };
 
@@ -192,7 +192,7 @@ export async function preparePr(snapshot: PrSnapshot, config: InboxConfig, deps:
     return {
       kind: 'prepared', headSha: head, bundlePath, worktree: dest, logPath, at: deps.now(),
       summary: withValidation(summarizeBundleFile(bundlePath), validation), alert: verdict.alert,
-      run, validation, validateRun,
+      alertFindings: verdict.alertFindings, run, validation, validateRun,
     };
   } catch (err) {
     return { kind: 'failed', failure: 'agent', reason: err instanceof Error ? err.message : String(err), worktree: dest, logPath, run };
diff --git a/packages/cli/src/inbox/prompt.ts b/packages/cli/src/inbox/prompt.ts
index 7f65c1c..811dc08 100644
--- a/packages/cli/src/inbox/prompt.ts
+++ b/packages/cli/src/inbox/prompt.ts
@@ -82,8 +82,12 @@ export function composePrompt(ctx: PromptContext): string {
       '',
       indent(alertWhen.trim()),
       '',
-      'If it does, print exactly one line, before the final line below:',
+      'If it does, print this line, before the final line below:',
       '  ALERT: <short reason>',
+      'and, when particular findings are the reason, a second line naming them:',
+      '  ALERT-FINDINGS: <thread id> <thread id> \u2026',
+      'The ids are the ones `diffity agent comment` printed ("Created thread cf15e689"), separated',
+      'by spaces; name the findings the author should see now.',
       'If it does not, print nothing about it.',
       '',
     );
@@ -128,10 +132,10 @@ function checkName(name: string): string {
 
 /**
  * What the agent's run amounted to, read from the last verdict line it printed; a prepared review
- * carries the alert the agent raised on the way, if any.
+ * carries the alert the agent raised on the way, if any, and the findings it named as the reason.
  */
 export type Verdict =
-  | { kind: 'prepared'; alert: string | null }
+  | { kind: 'prepared'; alert: string | null; alertFindings: string[] }
   | { kind: 'skipped'; reason: string }
   | { kind: 'none' };
 
@@ -141,7 +145,8 @@ export function verdictOf(stdout: string): Verdict {
   for (let i = lines.length - 1; i >= 0; i--) {
     const line = lines[i];
     if (line === 'PREPARED') {
-      return { kind: 'prepared', alert: alertBefore(lines, i) };
+      const { alert, findings } = alertBefore(lines, i);
+      return { kind: 'prepared', alert, alertFindings: findings };
     }
     const skip = /^SKIP:\s*(.*)$/.exec(line);
     if (skip) {
@@ -151,15 +156,34 @@ export function verdictOf(stdout: string): Verdict {
   return { kind: 'none' };
 }
 
-/** The agent's ALERT line, if it printed one on the way to PREPARED; the last one counts. */
-function alertBefore(lines: string[], preparedAt: number): string | null {
+/**
+ * The agent's ALERT line, if it printed one on the way to PREPARED, and the findings its
+ * ALERT-FINDINGS line named as the reason; the last of each counts, in whichever order they were
+ * printed. Findings without an alert say nothing the reviewer asked to hear about, so they go with it.
+ */
+function alertBefore(lines: string[], preparedAt: number): { alert: string | null; findings: string[] } {
+  let alert: string | null = null;
+  let findings: string[] | null = null;
   for (let i = preparedAt - 1; i >= 0; i--) {
-    const alert = /^ALERT:\s*(.*)$/.exec(lines[i]);
-    if (alert) {
-      return alert[1].trim() || 'no reason given';
+    const named = /^ALERT-FINDINGS:\s*(.*)$/.exec(lines[i]);
+    if (named) {
+      findings ??= threadIdsOf(named[1]);
+      continue;
+    }
+    const raised = /^ALERT:\s*(.*)$/.exec(lines[i]);
+    if (raised) {
+      alert ??= raised[1].trim() || 'no reason given';
     }
   }
-  return null;
+  return { alert, findings: alert === null ? [] : findings ?? [] };
+}
+
+/** A thread id as `diffity agent comment` prints it, or the full uuid behind it. */
+const THREAD_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})?$/;
+
+/** The thread ids on an ALERT-FINDINGS line; anything that is not one is not a finding to look up. */
+function threadIdsOf(text: string): string[] {
+  return [...new Set(text.toLowerCase().split(/[\s,]+/).filter(token => THREAD_ID.test(token)))];
 }
 
 function indent(text: string): string {
diff --git a/packages/cli/src/inbox/store.ts b/packages/cli/src/inbox/store.ts
index 02ee803..8ca8812 100644
--- a/packages/cli/src/inbox/store.ts
+++ b/packages/cli/src/inbox/store.ts
@@ -54,6 +54,8 @@ export interface InboxPr {
   preparedAt: string | null;
   summary: string | null;
   alert: string | null;
+  /** The threads the agent named as the reason for the alert; empty when it named none. */
+  alertFindings: string[];
   bundlePath: string | null;
   worktreePath: string | null;
   logPath: string | null;
@@ -71,6 +73,8 @@ export interface Prepared {
   summary: string | null;
   /** Why the agent judged this one to need the reviewer now, when it did. */
   alert: string | null;
+  /** The threads it named as the reason, by id; an alert on the reviewer's own paths names none. */
+  alertFindings: string[];
 }
 
 /** A review diffity posted to the forge: the head it was posted against, and what it said. */
@@ -233,6 +237,7 @@ export class InboxStore {
         bumped_at TEXT,
         summary TEXT,
         alert TEXT,
+        alert_findings TEXT,
         ci_state TEXT
       )
     `);
@@ -270,7 +275,7 @@ export class InboxStore {
     this.db.exec('CREATE INDEX IF NOT EXISTS inbox_handled_pr_at ON inbox_handled (pr_id, at)');
     this.db.exec('CREATE TABLE IF NOT EXISTS inbox_state (key TEXT PRIMARY KEY, value TEXT)');
     // A table from an earlier build gains the columns it lacks; a fresh one already has them.
-    for (const column of ['attempts INTEGER NOT NULL DEFAULT 0', 'created_at TEXT', 'updated_at TEXT', 'bumped_at TEXT', 'summary TEXT', 'alert TEXT', 'ci_state TEXT']) {
+    for (const column of ['attempts INTEGER NOT NULL DEFAULT 0', 'created_at TEXT', 'updated_at TEXT', 'bumped_at TEXT', 'summary TEXT', 'alert TEXT', 'alert_findings TEXT', 'ci_state TEXT']) {
       try {
         this.db.exec(`ALTER TABLE inbox_prs ADD COLUMN ${column}`);
       } catch (err) {
@@ -357,9 +362,12 @@ export class InboxStore {
     this.db.prepare(`
       UPDATE inbox_prs
       SET status = 'prepared', status_reason = NULL, prepared_head_sha = ?, prepared_at = ?,
-          bundle_path = ?, worktree_path = ?, log_path = ?, summary = ?, alert = ?
+          bundle_path = ?, worktree_path = ?, log_path = ?, summary = ?, alert = ?, alert_findings = ?
       WHERE id = ?
-    `).run(prepared.headSha, prepared.at, prepared.bundlePath, prepared.worktreePath, prepared.logPath, prepared.summary, prepared.alert, id);
+    `).run(
+      prepared.headSha, prepared.at, prepared.bundlePath, prepared.worktreePath, prepared.logPath,
+      prepared.summary, prepared.alert, JSON.stringify(prepared.alertFindings), id,
+    );
   }
 
   /**
@@ -493,6 +501,7 @@ interface Row {
   bumped_at: string | null;
   summary: string | null;
   alert: string | null;
+  alert_findings: string | null;
   ci_state: string | null;
 }
 
@@ -523,6 +532,7 @@ function rowToPr(row: Row): InboxPr {
     preparedAt: row.prepared_at,
     summary: row.summary,
     alert: row.alert,
+    alertFindings: parseAlertFindings(row.alert_findings),
     bundlePath: row.bundle_path,
     worktreePath: row.worktree_path,
     logPath: row.log_path,
@@ -588,6 +598,22 @@ function normaliseCiState(value: string | null): CiState | null {
   return value !== null && CI_STATES.includes(value) ? (value as CiState) : null;
 }
 
+/**
+ * The thread ids behind an alert, as the column keeps them. A row from before the column existed
+ * has none, and so does one whose value is not a list of ids.
+ */
+function parseAlertFindings(value: string | null): string[] {
+  if (value === null) {
+    return [];
+  }
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((id): id is string => typeof id === 'string') : [];
+  } catch {
+    return [];
+  }
+}
+
 /** A mark from a build that posted other kinds of review still reads as something the reviewer said. */
 function normaliseEvent(value: string): ReviewEvent {
   return (REVIEW_EVENTS as readonly string[]).includes(value) ? (value as ReviewEvent) : 'COMMENT';
diff --git a/packages/cli/src/inbox/tick.ts b/packages/cli/src/inbox/tick.ts
index bac52e1..dbecc99 100644
--- a/packages/cli/src/inbox/tick.ts
+++ b/packages/cli/src/inbox/tick.ts
@@ -267,6 +267,8 @@ async function prepareOne(store: InboxStore, snapshot: PrSnapshot, deps: TickDep
         summary: result.summary,
         // The agent's judgement first; the reviewer's own paths stand in when it raised nothing.
         alert: result.alert ?? alertForPaths(snapshot.files, deps.alertPaths),
+        // Only the agent names findings, so a path alert stands on its own with none.
+        alertFindings: result.alertFindings,
       });
       deps.log(`prepared ${id}`);
       if (result.validateRun?.note) {
diff --git a/packages/cli/src/inbox/view.ts b/packages/cli/src/inbox/view.ts
index 7aa2507..19d852c 100644
--- a/packages/cli/src/inbox/view.ts
+++ b/packages/cli/src/inbox/view.ts
@@ -36,6 +36,8 @@ export interface InboxRow {
   summary: string | null;
   /** The agent's reason this one needs the reviewer now, when it raised one. */
   alert: string | null;
+  /** The findings it named as that reason, by thread id; empty when it named none. */
+  alertFindings: string[];
   openUrl: string | null;
   /** Where a POST dismisses it; null while it is being prepared, and once it is retired. */
   dismissUrl: string | null;
@@ -49,7 +51,9 @@ export interface InboxRow {
 }
 
 export interface InboxView {
-  /** Ready to open, smallest first — what the reviewer acts on. */
+  /** Prepared with an alert on it, most recently prepared first — what the reviewer sees first. */
+  alerted: InboxRow[];
+  /** Ready to open with nothing raised about them, smallest first. */
   ready: InboxRow[];
   /** Being prepared or waiting to be. */
   working: InboxRow[];
@@ -70,14 +74,16 @@ export function buildView(store: InboxStore, openBase: string, now: string): Inb
   const rows = store.all().map(pr => toRow(pr, openBase, store));
   const handled = rows.filter(isHandled).sort(byAttention);
   const handledIds = new Set(handled.map(row => row.id));
-  const ready = rows.filter(row => (row.status === 'prepared' || row.status === 'stale') && !handledIds.has(row.id))
-    .sort((a, b) => diffSize(a) - diffSize(b));
+  const openable = rows.filter(row => (row.status === 'prepared' || row.status === 'stale') && !handledIds.has(row.id));
+  const alerted = openable.filter(row => row.alert !== null)
+    .sort((a, b) => (b.preparedAt ?? '').localeCompare(a.preparedAt ?? ''));
+  const ready = openable.filter(row => row.alert === null).sort((a, b) => diffSize(a) - diffSize(b));
   const working = rows.filter(row => row.status === 'queued' || row.status === 'preparing')
     .sort((a, b) => Number(b.bumped) - Number(a.bumped));
   const dismissed = rows.filter(row => row.status === 'dismissed');
-  const other = rows.filter(row => !ready.includes(row) && !working.includes(row) && !dismissed.includes(row)
+  const other = rows.filter(row => !openable.includes(row) && !working.includes(row) && !dismissed.includes(row)
     && !handledIds.has(row.id) && !isRetired(row.status));
-  return { ready, working, handled, other, dismissed, generatedAt: now, runs: runWindows(store, now), pausedUntil: store.pausedUntil(now) };
+  return { alerted, ready, working, handled, other, dismissed, generatedAt: now, runs: runWindows(store, now), pausedUntil: store.pausedUntil(now) };
 }
 
 type HandledRow = InboxRow & { handled: NonNullable<InboxRow['handled']> };
@@ -143,6 +149,7 @@ function toRow(pr: InboxPr, openBase: string, store: InboxStore): InboxRow {
     preparedAt: pr.preparedAt,
     summary: pr.summary,
     alert: pr.alert,
+    alertFindings: pr.alertFindings,
     openUrl: openable ? `${openBase}/open/${encodeURIComponent(pr.id)}` : null,
     dismissUrl: pr.status === 'preparing' || pr.status === 'dismissed' || isRetired(pr.status) ? null : `${openBase}/dismiss/${encodeURIComponent(pr.id)}`,
     prepareUrl: bumpable && pr.bumpedAt === null ? `${openBase}/prepare/${encodeURIComponent(pr.id)}` : null,
diff --git a/packages/cli/tests/inbox-daemon.test.ts b/packages/cli/tests/inbox-daemon.test.ts
index e73c0d4..eca41e7 100644
--- a/packages/cli/tests/inbox-daemon.test.ts
+++ b/packages/cli/tests/inbox-daemon.test.ts
@@ -38,7 +38,7 @@ function snapshot(number: number, additions: number): PrSnapshot {
 function preparedResult(snapshot: PrSnapshot): PrepareResult {
   return {
     kind: 'prepared', headSha: snapshot.headSha, bundlePath: '/b.json', worktree: '/wt', logPath: '/l.log',
-    at: 'now', summary: '1 P2', alert: null, validation: 'not-needed', validateRun: null,
+    at: 'now', summary: '1 P2', alert: null, alertFindings: [], validation: 'not-needed', validateRun: null,
     run: { startedAt: 'now', endedAt: 'now', stats: null },
   };
 }
diff --git a/packages/cli/tests/inbox-handled.test.ts b/packages/cli/tests/inbox-handled.test.ts
index 0cc4164..800836b 100644
--- a/packages/cli/tests/inbox-handled.test.ts
+++ b/packages/cli/tests/inbox-handled.test.ts
@@ -173,7 +173,7 @@ describe('the handled list', () => {
     store.observe(snapshot(), true, 'now');
     store.markPrepared('o/r#1', {
       headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l',
-      at: '2026-09-08T09:00:00.000Z', summary: '1 P2', alert: null,
+      at: '2026-09-08T09:00:00.000Z', summary: '1 P2', alert: null, alertFindings: [],
     });
 
     expect(buildView(store, 'http://localhost:5390', 'now').ready.map(row => row.id)).toEqual(['o/r#1']);
@@ -191,7 +191,7 @@ describe('the handled list', () => {
     store.recordHandled(mark({ at: '2026-09-08T09:00:00.000Z' }));
     store.markPrepared('o/r#1', {
       headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l',
-      at: '2026-09-08T10:00:00.000Z', summary: '1 P2', alert: null,
+      at: '2026-09-08T10:00:00.000Z', summary: '1 P2', alert: null, alertFindings: [],
     });
 
     const view = buildView(store, 'http://localhost:5390', 'now');
@@ -212,27 +212,98 @@ describe('the handled list', () => {
   });
 });
 
-describe('diffity inbox status', () => {
-  it('prints a Handled section with what was said about each one', async () => {
-    process.env.DIFFITY_DATA_DIR = join(dir, 'data');
-    const store = new InboxStore(inboxStorePath());
-    store.observe(snapshot({ headSha: 'bbb' }), false, 'now');
-    store.recordHandled(mark({ headSha: 'aaa' }));
-    store.setStatus('o/r#1', 'handled', 'new commits since you approved');
+describe('the alerted list', () => {
+  /** A prepared review, with whatever the agent raised about it. */
+  function preparedRow(
+    store: InboxStore,
+    over: Partial<PrSnapshot>,
+    prepared: { at: string; alert?: string; alertFindings?: string[] },
+  ): void {
+    const snap = snapshot(over);
+    store.observe(snap, true, 'now');
+    store.markPrepared(`o/r#${snap.number}`, {
+      headSha: snap.headSha, bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: prepared.at,
+      summary: '1 P1', alert: prepared.alert ?? null, alertFindings: prepared.alertFindings ?? [],
+    });
+  }
+
+  it('lists the alerted ones most recently prepared first, leaving the rest ready', () => {
+    const store = new InboxStore(':memory:');
+    preparedRow(store, { number: 1, additions: 1, deletions: 0 }, { at: '2026-09-08T09:00:00.000Z', alert: 'touches auth', alertFindings: ['cf15e689'] });
+    preparedRow(store, { number: 2 }, { at: '2026-09-08T10:00:00.000Z' });
+    preparedRow(store, { number: 3, additions: 900, deletions: 0 }, { at: '2026-09-08T11:00:00.000Z', alert: 'a P1 in payments' });
+
+    const view = buildView(store, 'http://localhost:5390', 'now');
+    // The largest of the three, and the newest: size orders the ready list, not this one.
+    expect(view.alerted.map(row => [row.number, row.alertFindings])).toEqual([[3, []], [1, ['cf15e689']]]);
+    expect(view.ready.map(row => row.number)).toEqual([2]);
+    expect(view.other).toEqual([]);
     store.close();
+  });
 
+  it('keeps a stale alerted review listed, and lets a posted one go to handled', () => {
+    const store = new InboxStore(':memory:');
+    preparedRow(store, {}, { at: '2026-09-08T09:00:00.000Z', alert: 'touches auth' });
+    store.observe(snapshot({ headSha: 'bbb' }), true, 'now');
+
+    const pushed = buildView(store, 'http://localhost:5390', 'now');
+    expect(pushed.alerted.map(row => [row.id, row.stale])).toEqual([['o/r#1', true]]);
+
+    store.recordHandled(mark({ at: '2026-09-08T10:00:00.000Z' }));
+    const posted = buildView(store, 'http://localhost:5390', 'now');
+    expect(posted.alerted).toEqual([]);
+    expect(posted.ready).toEqual([]);
+    expect(posted.handled.map(row => row.id)).toEqual(['o/r#1']);
+    store.close();
+  });
+});
+
+describe('diffity inbox status', () => {
+  /** Everything the command printed, as one string. */
+  async function statusOutput(): Promise<string> {
     const lines: string[] = [];
     const log = vi.spyOn(console, 'log').mockImplementation((message: unknown) => { lines.push(String(message)); });
     const program = new Command();
     registerInboxCommand(program);
     await program.parseAsync(['node', 'diffity', 'inbox', 'status']);
     log.mockRestore();
+    return lines.join('\n');
+  }
+
+  it('prints a Handled section with what was said about each one', async () => {
+    process.env.DIFFITY_DATA_DIR = join(dir, 'data');
+    const store = new InboxStore(inboxStorePath());
+    store.observe(snapshot({ headSha: 'bbb' }), false, 'now');
+    store.recordHandled(mark({ headSha: 'aaa' }));
+    store.setStatus('o/r#1', 'handled', 'new commits since you approved');
+    store.close();
 
-    const printed = lines.join('\n');
+    const printed = await statusOutput();
     expect(printed).toContain('Handled');
     expect(printed).toContain('updated');
     expect(printed).toContain('r#1 A change');
     expect(printed).toContain('new commits since you approved');
     expect(printed).not.toContain('Nothing in the inbox yet');
   });
+
+  it('prints an Alerted section above Ready, with the reason and the findings named', async () => {
+    process.env.DIFFITY_DATA_DIR = join(dir, 'data');
+    const store = new InboxStore(inboxStorePath());
+    for (const number of [1, 2]) {
+      store.observe(snapshot({ number, title: number === 1 ? 'Touch auth' : 'A tidy-up' }), true, 'now');
+      store.markPrepared(`o/r#${number}`, {
+        headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1',
+        alert: number === 1 ? 'touches auth' : null, alertFindings: number === 1 ? ['cf15e689', '7b2a10c4'] : [],
+      });
+    }
+    store.close();
+
+    const printed = await statusOutput();
+    expect(printed).toContain('Alerted');
+    expect(printed).toContain('touches auth');
+    expect(printed).toContain('2 findings');
+    expect(printed.indexOf('Alerted')).toBeLessThan(printed.indexOf('Ready to review'));
+    // The one nothing was raised about is still listed, below.
+    expect(printed).toContain('A tidy-up');
+  });
 });
diff --git a/packages/cli/tests/inbox-open.test.ts b/packages/cli/tests/inbox-open.test.ts
index fd3f6eb..cd4199e 100644
--- a/packages/cli/tests/inbox-open.test.ts
+++ b/packages/cli/tests/inbox-open.test.ts
@@ -38,7 +38,7 @@ function snapshot(): PrSnapshot {
 function preparedStore(): InboxStore {
   const store = new InboxStore(':memory:');
   store.observe(snapshot(), true, 'now');
-  store.markPrepared('o/r#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null });
+  store.markPrepared('o/r#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null, alertFindings: [] });
   return store;
 }
 
diff --git a/packages/cli/tests/inbox-page.test.ts b/packages/cli/tests/inbox-page.test.ts
index c3f61e1..4c26091 100644
--- a/packages/cli/tests/inbox-page.test.ts
+++ b/packages/cli/tests/inbox-page.test.ts
@@ -139,4 +139,20 @@ describe('the inbox page', () => {
     // An inbox holding nothing but handled rows is not an empty one.
     expect(script).toContain('view.handled.length');
   });
+
+  it('lists the alerted pull requests above ready, with the reason and how many findings it names', () => {
+    const html = inboxPage();
+    expect(html).toContain('<h2>Alerted</h2>');
+    expect(html).toContain('id="alerted"');
+    expect(html.indexOf('id="alerted-section"')).toBeLessThan(html.indexOf('id="ready-section"'));
+    const script = pageScript();
+    // The same card as a ready row, with the alert and the count on its meta line.
+    expect(script).toContain("fill('alerted-section', 'alerted', view.alerted, r => withActions(readyRow(r), r))");
+    expect(script).toContain("esc(r.alert || ''),\n        findingsLabel(r)");
+    expect(script).toContain("named + ' finding' + (named === 1 ? '' : 's')");
+    // An alert notifies from whichever of the two lists it is in, and counts towards the header.
+    expect(script).toContain('[...view.alerted, ...view.ready]');
+    expect(script).toContain("view.alerted.length + ' alerted'");
+    expect(script).toContain('const total = view.alerted.length + view.ready.length');
+  });
 });
diff --git a/packages/cli/tests/inbox-prepare.test.ts b/packages/cli/tests/inbox-prepare.test.ts
index da80fde..2997a4a 100644
--- a/packages/cli/tests/inbox-prepare.test.ts
+++ b/packages/cli/tests/inbox-prepare.test.ts
@@ -395,7 +395,7 @@ describe('the inbox JSON server', () => {
   it('answers /api/inbox with the current view', async () => {
     const store = new InboxStore(':memory:');
     store.observe({ ...snapshot(), headSha: 'aaa' }, true, 'now');
-    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null });
+    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null, alertFindings: [] });
     const noOpenDeps = { baseRefOf: () => 'x', ensureServer: () => Promise.resolve(1), importBundle: () => {} };
     const server = startInboxServer(store, { ...config(), port: 0 }, () => {}, noOpenDeps);
     await new Promise(resolve => server.on('listening', resolve));
@@ -418,7 +418,7 @@ describe('the inbox JSON server', () => {
   it('shapes a prepared row as ready and openable', () => {
     const store = new InboxStore(':memory:');
     store.observe({ ...snapshot(), headSha: 'aaa' }, true, 'now');
-    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null });
+    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: null, alert: null, alertFindings: [] });
     const view = buildView(store, 'http://localhost:5390', 'now');
     expect(view.ready[0].openUrl).toBe('http://localhost:5390/open/o%2Fdemo%234');
     expect(view.ready[0].stale).toBe(false);
@@ -428,7 +428,7 @@ describe('the inbox JSON server', () => {
   it('carries what the agent spent on a prepared review, and the pause, to the page', async () => {
     const store = new InboxStore(':memory:');
     store.observe({ ...snapshot(), headSha: 'aaa' }, true, 'now');
-    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: null });
+    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: null, alertFindings: [] });
     store.recordRun({
       prId: 'o/demo#4', headSha: 'aaa', phase: 'prepare', model: 'claude-x',
       startedAt: new Date().toISOString(), endedAt: new Date().toISOString(), durationMs: 480_000,
@@ -458,7 +458,7 @@ describe('the inbox JSON server', () => {
   it('lists the checking pass beside the drafting one on the card\'s hover', async () => {
     const store = new InboxStore(':memory:');
     store.observe({ ...snapshot(), headSha: 'aaa' }, true, 'now');
-    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: null });
+    store.markPrepared('o/demo#4', { headSha: 'aaa', bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: null, alertFindings: [] });
     const base = {
       prId: 'o/demo#4', headSha: 'aaa', inputTokens: 10, cacheReadTokens: 0, cacheWriteTokens: 0, note: null,
     };
diff --git a/packages/cli/tests/inbox-reconcile.test.ts b/packages/cli/tests/inbox-reconcile.test.ts
index b5b130a..843dc33 100644
--- a/packages/cli/tests/inbox-reconcile.test.ts
+++ b/packages/cli/tests/inbox-reconcile.test.ts
@@ -16,7 +16,7 @@ function existing(over: Partial<InboxPr> = {}): InboxPr {
   return {
     id: 'o/r#1', owner: 'o', repo: 'r', number: 1, title: 'A change', url: 'https://github.com/o/r/pull/1',
     author: 'alice', isDraft: false, headSha: 'aaa', baseRef: 'main', additions: 10, deletions: 2, changedFiles: 3,
-    ciState: null, createdAt: null, updatedAt: null, bumpedAt: null, summary: null, alert: null, requested: true, status: 'prepared', statusReason: null, attempts: 0, preparedHeadSha: 'aaa', preparedAt: '2026-09-02T09:00:00Z',
+    ciState: null, createdAt: null, updatedAt: null, bumpedAt: null, summary: null, alert: null, alertFindings: [], requested: true, status: 'prepared', statusReason: null, attempts: 0, preparedHeadSha: 'aaa', preparedAt: '2026-09-02T09:00:00Z',
     bundlePath: '/b.json', worktreePath: '/wt', logPath: '/l.log', firstSeenAt: 'x', lastSeenAt: 'y', ...over,
   };
 }
diff --git a/packages/cli/tests/inbox-store.test.ts b/packages/cli/tests/inbox-store.test.ts
index 7c78271..11337c8 100644
--- a/packages/cli/tests/inbox-store.test.ts
+++ b/packages/cli/tests/inbox-store.test.ts
@@ -110,15 +110,53 @@ describe('InboxStore migration', () => {
   it('opens a fresh database and round-trips a prepared row', () => {
     const store = new InboxStore(path);
     store.observe(snapshot(), true, 'now');
-    store.markPrepared('o/r#1', { headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: 'touches auth' });
+    store.markPrepared('o/r#1', { headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: 'touches auth', alertFindings: ['cf15e689', '7b2a10c4'] });
     const pr = store.get('o/r#1')!;
     expect(pr.status).toBe('prepared');
     expect(pr.preparedHeadSha).toBe('aaa');
     expect(pr.attempts).toBe(0);
     expect(pr.summary).toBe('1 P1');
     expect(pr.alert).toBe('touches auth');
+    expect(pr.alertFindings).toEqual(['cf15e689', '7b2a10c4']);
     store.close();
   });
+
+  it('takes the findings behind an alert on a table that predates the column', () => {
+    const seed = new DatabaseSync(path);
+    seed.exec(`CREATE TABLE inbox_prs (
+      id TEXT PRIMARY KEY, owner TEXT NOT NULL, repo TEXT NOT NULL, number INTEGER NOT NULL,
+      title TEXT NOT NULL, url TEXT NOT NULL, author TEXT NOT NULL, is_draft INTEGER NOT NULL,
+      head_sha TEXT NOT NULL, base_ref TEXT NOT NULL, additions INTEGER NOT NULL, deletions INTEGER NOT NULL,
+      changed_files INTEGER NOT NULL, requested INTEGER NOT NULL, status TEXT NOT NULL, status_reason TEXT,
+      attempts INTEGER NOT NULL DEFAULT 0, prepared_head_sha TEXT, prepared_at TEXT, bundle_path TEXT,
+      worktree_path TEXT, log_path TEXT, first_seen_at TEXT NOT NULL, last_seen_at TEXT NOT NULL,
+      summary TEXT, alert TEXT)`);
+    seed.exec(`INSERT INTO inbox_prs (id, owner, repo, number, title, url, author, is_draft, head_sha, base_ref,
+      additions, deletions, changed_files, requested, status, first_seen_at, last_seen_at, alert)
+      VALUES ('o/r#1', 'o', 'r', 1, 'T', 'u', 'alice', 0, 'aaa', 'main', 1, 0, 1, 1, 'prepared', 'x', 'y', 'touches auth')`);
+    seed.close();
+
+    const store = new InboxStore(path);
+    expect(store.get('o/r#1')!.alertFindings).toEqual([]);
+    store.markPrepared('o/r#1', { headSha: 'aaa', bundlePath: '/b', worktreePath: '/wt', logPath: '/l', at: 'now', summary: '1 P1', alert: 'touches auth', alertFindings: ['cf15e689'] });
+    expect(store.get('o/r#1')!.alertFindings).toEqual(['cf15e689']);
+    store.close();
+  });
+
+  it('reads a findings column that does not name a list of ids as naming none', () => {
+    const store = new InboxStore(path);
+    store.observe(snapshot(), true, 'now');
+    store.close();
+
+    for (const [written, expected] of [['not json', []], ['{"a":1}', []], ['["cf15e689", 3]', ['cf15e689']]] as const) {
+      const raw = new DatabaseSync(path);
+      raw.prepare('UPDATE inbox_prs SET alert_findings = ? WHERE id = ?').run(written, 'o/r#1');
+      raw.close();
+      const reopened = new InboxStore(path);
+      expect(reopened.get('o/r#1')!.alertFindings).toEqual(expected);
+      reopened.close();
+    }
+  });
 });
 
 describe('the run log', () => {
diff --git a/packages/cli/tests/inbox-tick.test.ts b/packages/cli/tests/inbox-tick.test.ts
index 90ad9b8..56d943b 100644
--- a/packages/cli/tests/inbox-tick.test.ts
+++ b/packages/cli/tests/inbox-tick.test.ts
@@ -87,7 +87,8 @@ beforeEach(() => {
   prepareResult = (snap) => ({
     kind: 'prepared', headSha: snap.headSha, bundlePath: `/b/${snap.number}.json`,
     worktree: `/wt/${snap.number}`, logPath: `/l/${snap.number}.log`, at: '2026-09-02T12:00:00.000Z',
-    summary: '1 P2', alert: snap.number === 2 ? 'touches auth' : null, run: run(),
+    summary: '1 P2', alert: snap.number === 2 ? 'touches auth' : null,
+    alertFindings: snap.number === 2 ? ['cf15e689', '7b2a10c4'] : [], run: run(),
     validation: 'not-needed', validateRun: null,
   });
 });
@@ -155,15 +156,29 @@ describe('runTick', () => {
     expect(pr.worktreePath).toBeNull();
   });
 
-  it('sorts the ready list smallest first for the surface, carrying summary and alert', async () => {
+  it('sorts the ready list smallest first for the surface, carrying the summary', async () => {
     forge.set(snapshot({ number: 1, additions: 200, deletions: 100 }));
-    forge.set(snapshot({ number: 2, additions: 3, deletions: 1 }));
+    forge.set(snapshot({ number: 3, additions: 3, deletions: 1 }));
     await runTick(store, deps());
 
     const view = buildView(store, 'http://localhost:5390', '2026-09-02T12:00:00.000Z');
-    expect(view.ready.map(row => row.number)).toEqual([2, 1]);
-    expect(view.ready.map(row => [row.summary, row.alert])).toEqual([['1 P2', 'touches auth'], ['1 P2', null]]);
-    expect(view.ready[0].openUrl).toBe('http://localhost:5390/open/o%2Fr%232');
+    expect(view.ready.map(row => row.number)).toEqual([3, 1]);
+    expect(view.ready.map(row => [row.summary, row.alert])).toEqual([['1 P2', null], ['1 P2', null]]);
+    expect(view.ready[0].openUrl).toBe('http://localhost:5390/open/o%2Fr%233');
+  });
+
+  it('lists the one the agent alerted on above the rest, with the findings it named', async () => {
+    forge.set(snapshot({ number: 1, additions: 3, deletions: 1 }));
+    forge.set(snapshot({ number: 2, additions: 200, deletions: 100 }));
+    await runTick(store, deps());
+
+    const view = buildView(store, 'http://localhost:5390', '2026-09-02T12:00:00.000Z');
+    // Number 2 is the one the fake agent alerts on, and its size does not put it behind number 1.
+    expect(view.alerted.map(row => [row.number, row.alert, row.alertFindings]))
+      .toEqual([[2, 'touches auth', ['cf15e689', '7b2a10c4']]]);
+    expect(view.ready.map(row => row.number)).toEqual([1]);
+    expect(view.other).toEqual([]);
+    expect(view.alerted[0].openUrl).toBe('http://localhost:5390/open/o%2Fr%232');
   });
 
   it('alerts on the reviewer\'s own paths when the agent raised nothing, and defers to it when it did', async () => {
@@ -176,6 +191,9 @@ describe('runTick', () => {
     // Number 2 is the one the fake agent alerts on: its own words stand.
     expect(store.get('o/r#2')!.alert).toBe('touches auth');
     expect(store.get('o/r#3')!.alert).toBeNull();
+    // Only the agent names findings: the path alert has the reviewer's own rule behind it and none.
+    expect(store.get('o/r#1')!.alertFindings).toEqual([]);
+    expect(store.get('o/r#2')!.alertFindings).toEqual(['cf15e689', '7b2a10c4']);
   });
 
   it('carries what CI said about each head to the surface', async () => {
@@ -185,7 +203,7 @@ describe('runTick', () => {
     await runTick(store, deps());
 
     const view = buildView(store, 'http://localhost:5390', '2026-09-02T12:00:00.000Z');
-    expect(new Map(view.ready.map(row => [row.number, row.ciState])))
+    expect(new Map([...view.alerted, ...view.ready].map(row => [row.number, row.ciState])))
       .toEqual(new Map([[1, 'passing'], [2, 'running'], [3, 'none']]));
   });
 
@@ -305,7 +323,9 @@ describe('runTick', () => {
     expect(prepared).toEqual(['o/r#2']);
 
     const view = buildView(store, 'http://localhost:5390', '2026-09-02T12:00:00.000Z');
-    expect(view.ready.map(row => row.number)).toEqual([2]);
+    // Number 2 is the one the fake agent alerts on, so it is listed above the rest.
+    expect(view.alerted.map(row => row.number)).toEqual([2]);
+    expect(view.ready).toEqual([]);
     expect(view.other).toEqual([]);
     // Listed as dismissed, with a way back and no second dismiss.
     expect(view.dismissed.map(row => [row.number, row.prepareUrl, row.dismissUrl]))
@@ -429,7 +449,7 @@ describe('runTick', () => {
     const logged: string[] = [];
     prepareResult = snap => ({
       kind: 'prepared', headSha: snap.headSha, bundlePath: '/b.json', worktree: '/wt', logPath: '/l.log',
-      at: '2026-09-02T12:00:00.000Z', summary: '1 P1', alert: null, run: run(),
+      at: '2026-09-02T12:00:00.000Z', summary: '1 P1', alert: null, alertFindings: [], run: run(),
       validation: 'validated',
       validateRun: {
         startedAt: '2026-09-02T12:00:00.000Z', endedAt: '2026-09-02T12:03:00.000Z',
@@ -452,7 +472,7 @@ describe('runTick', () => {
     const logged: string[] = [];
     prepareResult = snap => ({
       kind: 'prepared', headSha: snap.headSha, bundlePath: '/b.json', worktree: '/wt', logPath: '/l.log',
-      at: '2026-09-02T12:00:00.000Z', summary: '1 P1 \u00b7 unchecked', alert: null, run: run(),
+      at: '2026-09-02T12:00:00.000Z', summary: '1 P1 \u00b7 unchecked', alert: null, alertFindings: [], run: run(),
       validation: 'unchecked',
       validateRun: {
         startedAt: '2026-09-02T12:00:00.000Z', endedAt: '2026-09-02T12:15:00.000Z', stats: null,
@@ -472,7 +492,7 @@ describe('runTick', () => {
     forge.set(snapshot());
     prepareResult = snap => ({
       kind: 'prepared', headSha: snap.headSha, bundlePath: '/b.json', worktree: '/wt', logPath: '/l.log',
-      at: '2026-09-02T12:00:00.000Z', summary: null, alert: null, run: run({ stats: null }),
+      at: '2026-09-02T12:00:00.000Z', summary: null, alert: null, alertFindings: [], run: run({ stats: null }),
       validation: 'not-needed', validateRun: null,
     });
     await runTick(store, deps());
@@ -741,7 +761,7 @@ describe('a posted review', () => {
     prepareResult = snap => ({
       kind: 'prepared', headSha: snap.headSha, bundlePath: '/b/1.json', worktree: '/wt/1',
       logPath: '/l/1.log', at: '2026-09-02T13:05:00.000Z', summary: '1 P2', alert: null,
-      run: run(), validation: 'not-needed', validateRun: null,
+      alertFindings: [], run: run(), validation: 'not-needed', validateRun: null,
     });
     await prepareBumped(store, deps(), 'o/r#1');
     expect(prepared).toEqual(['o/r#1']);
diff --git a/packages/cli/tests/inbox-units.test.ts b/packages/cli/tests/inbox-units.test.ts
index f2e2a20..28f4c0a 100644
--- a/packages/cli/tests/inbox-units.test.ts
+++ b/packages/cli/tests/inbox-units.test.ts
@@ -243,12 +243,16 @@ describe('composePrompt alerts', () => {
     checks: [], files: [],
   };
 
-  it('asks for an ALERT line only when the reviewer said what matters', () => {
+  it('asks for an ALERT line, and the findings behind it, only when the reviewer said what matters', () => {
     const quiet = composePrompt({ snapshot, worktreePath: '/wt', port: 5555, filter: '', alertWhen: '', mcpAllow: [] });
     expect(quiet).not.toContain('ALERT:');
+    expect(quiet).not.toContain('ALERT-FINDINGS');
     const loud = composePrompt({ snapshot, worktreePath: '/wt', port: 5555, filter: '', alertWhen: 'there is a P1', mcpAllow: [] });
     expect(loud).toContain('  there is a P1');
     expect(loud).toContain('ALERT: <short reason>');
+    expect(loud).toContain('ALERT-FINDINGS: <thread id> <thread id>');
+    // The ids to name are the ones the agent has already been given, once per finding it left.
+    expect(loud).toContain('Created thread cf15e689');
     expect(loud.trim().endsWith('PREPARED')).toBe(true);
   });
 });
@@ -333,20 +337,44 @@ describe('parseSettingsPatch', () => {
 
 describe('verdictOf', () => {
   it('reads PREPARED, SKIP with a reason, and neither', () => {
-    expect(verdictOf('working...\nPREPARED\n')).toEqual({ kind: 'prepared', alert: null });
-    expect(verdictOf('working...\nALERT: touches auth\nPREPARED\n')).toEqual({ kind: 'prepared', alert: 'touches auth' });
+    expect(verdictOf('working...\nPREPARED\n')).toEqual({ kind: 'prepared', alert: null, alertFindings: [] });
+    expect(verdictOf('working...\nALERT: touches auth\nPREPARED\n')).toEqual({ kind: 'prepared', alert: 'touches auth', alertFindings: [] });
     expect(verdictOf('ALERT: early\nSKIP: payments PR\n')).toEqual({ kind: 'skipped', reason: 'payments PR' });
     expect(verdictOf('looking\nSKIP: payments PR\n')).toEqual({ kind: 'skipped', reason: 'payments PR' });
     expect(verdictOf('done thinking\n')).toEqual({ kind: 'none' });
   });
 
   it('takes the last verdict, so echoed instructions do not pre-empt the real one', () => {
-    expect(verdictOf('I will print SKIP: x or PREPARED.\nreviewing\nPREPARED')).toEqual({ kind: 'prepared', alert: null });
+    expect(verdictOf('I will print SKIP: x or PREPARED.\nreviewing\nPREPARED')).toEqual({ kind: 'prepared', alert: null, alertFindings: [] });
   });
 
   it('defaults a reasonless skip rather than reading an empty reason', () => {
     expect(verdictOf('SKIP:')).toEqual({ kind: 'skipped', reason: 'no reason given' });
   });
+
+  it('reads the findings behind an alert, as printed ids or full uuids, spaced or comma-separated', () => {
+    expect(verdictOf('ALERT: a P1 in payments\nALERT-FINDINGS: cf15e689 7b2a10c4\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'a P1 in payments', alertFindings: ['cf15e689', '7b2a10c4'] });
+    expect(verdictOf('ALERT: x\nALERT-FINDINGS: cf15e689-1c3d-4a1f-8b21-0123456789ab, 7b2a10c4\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'x', alertFindings: ['cf15e689-1c3d-4a1f-8b21-0123456789ab', '7b2a10c4'] });
+    // The line can come before the reason it belongs to.
+    expect(verdictOf('ALERT-FINDINGS: cf15e689\nALERT: x\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'x', alertFindings: ['cf15e689'] });
+  });
+
+  it('names each finding once, whatever case it was printed in, and nothing that is not an id', () => {
+    expect(verdictOf('ALERT: x\nALERT-FINDINGS: CF15E689 cf15e689 the-P1 cf15, 7b2a10c4\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'x', alertFindings: ['cf15e689', '7b2a10c4'] });
+    expect(verdictOf('ALERT: x\nALERT-FINDINGS:\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'x', alertFindings: [] });
+  });
+
+  it('ignores findings nobody raised an alert for, and takes the last of each line', () => {
+    expect(verdictOf('ALERT-FINDINGS: cf15e689\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: null, alertFindings: [] });
+    expect(verdictOf('ALERT: first\nALERT-FINDINGS: aaaaaaaa\nALERT: second\nALERT-FINDINGS: bbbbbbbb\nPREPARED'))
+      .toEqual({ kind: 'prepared', alert: 'second', alertFindings: ['bbbbbbbb'] });
+  });
 });
 
 describe('the forge parsers', () => {
diff --git a/packages/git/package.json b/packages/git/package.json
index 1b99e40..fecbfd7 100644
--- a/packages/git/package.json
+++ b/packages/git/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@diffity/git",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",
diff --git a/packages/github/package.json b/packages/github/package.json
index 4bf8822..74318cb 100644
--- a/packages/github/package.json
+++ b/packages/github/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@diffity/github",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",
diff --git a/packages/parser/package.json b/packages/parser/package.json
index 7cffdaf..7d1d6f5 100644
--- a/packages/parser/package.json
+++ b/packages/parser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@diffity/parser",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 87d7404..79c2466 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@diffity/ui",
-  "version": "0.10.29",
+  "version": "0.10.30",
   "type": "module",
   "private": true,
   "scripts": {