An agent pull never ships unreviewed: a lapsed review waits for a person, and a crew without a reviewer says so #907

Closes #597

Work in progress: an agent pull never ships by lapse or for want of a reviewer; it waits for a person and says so where a person looks.

🤖 Generated with Claude Code

Closes #597. The owner's rule: the crew survives outages and never re-queues, and nothing waits silently.

What changed

• The landing gate (src/crew/autonomy.ts, reviewed). An agent's pull ships only on an approving review of its head, from the crew's reviewer or a person. With no reviewer on the crew it waits for a person. With a reviewer, a review that does not come back is sent once more (reviewStage, unchanged), then lapses, and the pull still waits. It never ships by lapse. A person's own pull is unchanged: it passes with no reviewer and lands after a lapse, "without a review", as before. Rule 10 holds: the landing is the person who turned autonomy on, as before.
• One rule for where it waits (waitsForPerson, src/crew/review.ts): an agent's green pull with no verdict on its head, not held by a person, whose crew has no reviewer or whose review lapsed, with why and since when. It is read from the tables alone, so a restart forgets nothing.
• What needs you: a new ask kind, review. It says why and since when ("waits for your review: no reviewer on the crew, since …" or "the reviewer did not answer, since …"), with Ship and "Not like this". It is ranked between a red stop and a park, and is in the bulk actions, the feed and the phone notifier like every ask.
• The board: one line per autonomous app: "No reviewer: agent pulls wait for you" (or "agent pulls wait for your review"), with how many wait and since when. Owner facts only.
• Autonomy settings: "No reviewer: agent pulls wait for you." on an autonomous repository whose crew has no reviewer. No crew or autonomy setting is changed by this pull; adding a reviewer is the owner's choice.
• The MCP's now lists each agent pull waiting for your review, with since and why.

Tests, refusals first:

• test/review-gate.test.ts:

- an agent's pull whose review lapses never ships, is not sent a third time, and lands once a person approves - with no reviewer an agent's pull waits and says why, then lands on a person's approval - a person's own pull is unchanged (it still lands after a lapse, and says so) - the fixture now reads the pull back so the author is the forge's own

• test/review-waits.test.ts (new, in GATE):

- a reader is asked and told nothing - with no reviewer the agent's pull holds while a person's own lands - what needs you shows why and since when - the board and the settings say "No reviewer: agent pulls wait for you" - the MCP's now lists it with its age

• test/ledger.test.ts and test/autonomy.test.ts encoded "an agent's green pull lands with no reviewer". Each now has a person approve the green head, and says why.

Verified: typecheck is clean, with current main merged in. The full gate under the lock had three failures. Two were the ledger and autonomy tests above, fixed and passing (36 pass). The third, org-owners ("records each in the outbox"), is a flake on main as well: it compares the order of two event ids made in the same millisecond with random suffixes, and passes on most runs here and on main.

Looks: the board line and the settings sentence are plain text on existing strips; their wording is asserted in review-waits.test.ts. No screenshot was taken.

🤖 Generated with Claude Code