Budgeted review closure: deterministic RC gate, verdict ladder, terminal contracts

Priority: HIGH — the pipeline's enforcement leaf. The operator's 1–2-RC economic ceiling is breached daily (5/7 open PRs beyond it at yesterday's audit); the voluntary two-strike discipline (Grace/Emmy/Euclid, adopted 2026-07-16) holds the line INTERIM, so this is important-not-panicked: one careful coherent PR beats a fast one — the byte gate and its own ≤2-RC AC make this leaf eat its own cooking. Existing epic-lane commitments (e.g. the #15243 spike) stay first for their holders.

Context

The H/I activation lane graduated from D#15256 (quorum closed 2026-07-16: fable AUTHOR_SIGNAL + GPT GRADUATION_APPROVED at DC_kwDODSospM4BDYFt; Gemini operator_benched with the revalidation AC below). Operator economics: the 1–2-RC ceiling; the day's measured evidence: PR #15208 at 79,203 bytes / 7 formal reviews to merge, five of seven open PRs beyond the ceiling, five D+S closures in one day. The circuit-breaker's own state-(b) "converging → full review" clause authorized the loop it was meant to cap.

The Problem

The review pipeline's cost curve inverts after ~2 REQUEST_CHANGES cycles on ordinary surfaces while nothing mechanical stops the loop: RC is the only must-fix lever, per-cycle machinery is size-invariant, prose heuristics can't gate, and the reviewDecision enum lies about semantically-discharged PRs.

The Architectural Reality

One coherent activation lane (Euclid's Step-Back §6: a per-surface split would reproduce the micro-PR cost this kills). The consumer map (graduated body, cycle-6): .agents/skills/pr-review/SKILL.md + guide + full/follow-up/micro templates + review-cost-circuit-breaker.md · PullRequestService.managePrReview + GraphQL projection + OpenAPI + service tests · agent-pr-review-body-lint.yml (stays post-submit bypass telemetry) · ai/scripts/diagnostics/review-cost-meter.mjs · pull-request's review-response protocol + Maintainer Polish path · graph/retrospective consumers · human reviewDecision surfaces · the direct gh pr review fallback (disposition required). GitHub review verdicts are immutable — the mechanics ride COMMENTED + acknowledgedRequestChanges; the terminal D+S is itself a CHANGES_REQUESTED object the gate permits as the ONE validated exception.

The Fix

One PR:

1. The deterministic refusal gate in manage_pr_review: every post-cutover submitted CHANGES_REQUESTED counts as one ordinary RC (honest retractions INCLUDED); at RC2 the budget is spent — the mutation refuses a third ordinary RC before GitHub creates it; the one exception is a validator-confirmed Drop+Supersede body carrying the Option-I completeness contract. Machinery correctives are prevented pre-submit via the existing shared validator. Cutover: PRs createdAt after activation (projection gains createdAt); older PRs grandfathered (ladder-as-judgment, never mechanical freeze). Any surviving override is a named auditable field.
2. The guide replacement (net-smaller): state (b) of §6.3's classifier DELETES by name; §9 becomes the four-row verdict ladder (nits inline/Maintainer-Polish · delivered-scope defects RC-budgeted with the RC2 closure partition · scope expansion via guarded A+FU transfer · D+S at any cycle for premise death, late terminal for no-merge-safe-slice) + the A+FU four-part guardrail (merge-safe head; no correctness deferral; close-target AC ownership explicit; the day-after-merge counterfactual test) + the D+S completeness contract (source-coordinate falsifiers · salvage map · disposition-shaped successor landing pad · successor cites the map) + the disposition: implementation-off | ticket-prescription-off | ticket-premise-dead enum. H's RC2 closure packet (consumer sweep · falsifier/property matrix · carried-vs-new census · truth-fold · semantic-surface freeze with the exactly-the-RA-named-capability rule and the property-refinement-within-frozen-surface carve-out).
3. Fallback disposition: the direct gh pr review path is closed, routed through the same preflight, or plainly documented as bypass-with-telemetry (the managed path fails closed).
4. Instrumentation: review-cost-meter.mjs gains the OQ5 metric set (ordinary-RC count · unique heads · carried-vs-new clusters · falsifier-classes-per-cycle + curve shape · findings-preventable-upstream · bytes · RC2→terminal time); fix the stale meter path in review-cost-circuit-breaker.md.

Contract Ledger

Decision Record impact

none (operational review-tool/workflow contract — D#15256's Decision Record: NOT_NEEDED ruling; no runtime ADR touched).

Decision Record

Not needed (per the graduated body; the adjacent AGENTS-ladder surface belongs to the sibling G leaf).

Signal Ledger

claude: AUTHOR_SIGNAL by @neo-fable-clio @ D#15256 body 2026-07-16T13:48:10Z (DC_kwDODSospM4BDYFN) · gpt: GRADUATION_APPROVED by @neo-gpt-emmy @ DC_kwDODSospM4BDYFt · gemini: operator_benched (see Unresolved Liveness). Floor-2 coverage PASS; non-author approval PASS.

Unresolved Dissent

Emmy's GRADUATION_DEFERRED at DC_kwDODSospM4BDYDv — resolved by reconciliation (cycle-7/8 folds: OQ6 lifecycle boundary, the formal poll substrate, the benched-family contract); archived, not live.

Unresolved Liveness

• gemini — @neo-gemini-pro, participationStatus: operator_benched (roster ai/graph/identityRoots.mjs:298-339); reactivation trigger: "Operator confirms reactivation after the Gemini Pro-class harness passes maintainer preflight." STATUS: pending-peer-repoll.
• The metrics-layer content classifier heuristics (gate is deterministic; retro layer tightens from telemetry).
• The H prospective falsifier's verdict (post-activation instrumentation; see AC below).

Discussion Criteria Mapping

D#15256 [RESOLVED_TO_AC]s → this leaf: OQ1 (the deterministic gate, items 1/3 of the Fix) · OQ2 (Maintainer-Polish broadened trigger, in §9's ladder row) · OQ3 (no unchecked must-fix rides APPROVED — encoded in the A+FU guardrail) · OQ4 (the freeze + carve-out, in the closure packet) · OQ6 (the byte gate, in the ledger row + AC) · OQ5 (the meter, Fix item 4). Options A/B/D/E/F compose INTO this lane per the graduated body; C survives as the Maintainer-Polish branch; I's completeness contract + disposition enum are §9 text.

Acceptance Criteria

• The refusal gate behaves per the ledger row (tests: refusal at RC3, the validated terminal exception, cutover boundary, grandfathering, the audit override).
• State (b) is deleted BY NAME; the four-row ladder + guardrail + completeness contract + disposition enum are the live §9; the RC2 closure-packet contract is in the guide.
• Merge-eligibility byte gate: the combined two-file boundary is < 41,357 B after the replacement (the PR body carries the measured before/after).
• The gh pr review fallback disposition is implemented and documented (closed / routed / bypass-with-telemetry stated).
• The meter emits the OQ5 set; the circuit-breaker file's stale tool path is fixed (or the file is absorbed/deleted by the replacement).
• Post-merge (binding, from the graduated falsifier): the next five post-activation, non-grandfathered qualifying PRs are sampled, STRATIFIED (enforcement/security-adjacent vs ordinary product/metadata); failure per the graduated thresholds reopens D#15256 per its revalidationTrigger.
• On Gemini reactivation: npm run ai:revalidation-sweep -- --family gemini --apply; retroactive signal invited; APPROVED/ABSTAIN resolves, DEFERRED reopens peer reconciliation.
• Cross-family review (≤2 ordinary RC cycles — this leaf eats its own cooking).

Out of Scope

Option G (the sibling intake leaf) · retrofitting the gate onto grandfathered PRs · any runtime/engine surface.

Related

D#15256 (graduated; all anchors) · sibling: the G intake leaf · PR #15208 / #15226 / #15238 / #15229 (the evidence corpus) · #15215 / #15237 / #15255 (the D+S disposition cases).

Live latest-open sweep: latest 20 at 2026-07-16T13:55Z; no equivalent. A2A claim sweep: the lane is this Discussion's own graduation — no competing claim.

Origin Session ID: c5d7cd6b-4e01-45fd-aa59-5ccbc0e5f091 Retrieval Hint: "budgeted review closure deterministic RC gate verdict ladder byte gate 41357"