Anthropic is removing the 5-hour limit in stages (from 2026-10-31), and
an account without it reports the weekly window alone. Until now the pool
took such an account for an unprobed seat: always eligible, ranked after
every other, never held to the weekly cutoff, with no cap on its passes.
- The burst window is the 5-hour one, else the weekly one
(Seats::BurstWindow). An account whose burst window is the weekly one is
ranked by it and admitted under the 95 % cutoff with the passes in
flight projected on it, at the measured share per pass (0.04 at xhigh,
0.125 otherwise; REVIEW_GATES_LENS_COST_7D_PCT), and waits for the weekly
reset when over it.
- Every OAuth account and the local login takes at most 128 passes at once,
every driver's counted (REVIEW_GATES_OAUTH_CONCURRENCY): every run
measured with 149 or more in flight on one account drew usage-limit
rejections, none of the 119 with 139 or fewer.
- A 'concurrents' rejection pauses the seat for 20 s or its retry-after,
not until a window's reset (a seat sat two hours at 10 % on one).
- Board entries, the folded foreign record and the board's view carry
cost7d, so the drivers see each other's weekly load.
- `seats` and the log table say `no limit` in such an account's 5-hour
column; the board's others-line names its weekly projection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An independent check of every behaviour AGENTS.md was to describe:
- `--units ,` and `--only ,` skipped their empty items and so had no
filter left: a typo started a run of every unit. They are usage errors
now (exit 3).
- Two fixes the plan lists were missing: a dry run now clears the prompts
a dry run before it left in the dir they share (the report counted
them), and `config` reports an absolute functional.mcp.command that is
no program here - /usr/bin/npx inside the Flatpak, whose /usr is the
Sdk's.
- A patch that is not UTF-8 stops `run` at preflight (exit 3), as the
plan has it; it exited 1.
- An exception no command caught aborted the process (134), e.g. a home
that holds no lenses: it ends with its message and exit 1. An error
escaping `run` or `freeze` now also clears the signal handler's run and
sweeps what is left below the subreaper.
- `config -h` printed "unrecognized arguments" (exit 3): it prints the
usage, exit 0.
- An API seat's .claude.json is linked into place, so a second writer
never replaces the first's file and what claude wrote to it since.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Found compiling the environment-variable table for AGENTS.md:
- A REVIEW_GATES_MEM_RESERVE_MB that is no number threw
std::invalid_argument, which nothing caught: the process aborted where
it should end with a ValueError, exit 1. nan and inf were an unchecked
cast. They raise ValueError / OverflowError now; a value past int64
saturates.
- An env file that is not UTF-8: `run` ended with exit 1 where its
preflight should stop it (exit 3), and `seats` parsed the raw bytes. Both
read it as strict UTF-8 text now.
- A broker address with a port past 65535 was cut to 16 bits; it is an
OverflowError now, uncaught (exit 1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Its subreaper status makes a daemon a git call started its child; at
exit it goes, as freeze's do. Never a process the run did not start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Runs test drives this binary as crafter-review on a scratch repository,
with a /bin/sh claude that answers every pass from its system file and
prompt: a dry run; a run SIGKILLed in its last gate (every pass goes with
it through its supervisor); the next run resuming the first gate from the
checkpoint, salvaging the killed run's outputs and buying only the pass that
never answered; a run with nothing left to buy; a FIX FIRST with
--no-reuse --no-salvage; a stop by the stop file and by SIGTERM, each
leaving no process behind; a stale stop file dropped by the run that claims
its dir; a stop between gates.
Two fixes it led to:
- A stop that lands while a gate's pool is set up is no longer lost: the
stop is checked under the same lock that publishes the pool.
- A run never takes the number of a dump on record. Past a killed run that
left no dump, a later run that bought nothing could have its number
taken again and its dump written over.
Drivers gains the --no-reuse store check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StoreRules (23 checks), StacksMemory (24) and ReviewFixes (19), each a
test of its own.
Run and SlotsPlan now have seams that start as the real ones: appReady,
probe, query, bypassesRls, migrationsAtHead, migrationsDrift, treeDrift,
promptFor, runPass, resumable, instrumentPreflight, and a Machine for
SlotsPlan. MigrationsAtHead is split out of MigrationsDrift for it; the
HEAD side is still worked out once per tree and base.
The Postgres stand-in and the raw broker call move to tests/Common, shared
by PgWire and ReviewFixes. ReviewFixes runs this binary as `sql`, and a
real server that resets every connection makes the startup message either
fail to go out or never get its answer - a DbError either way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run: gate 0 (the artifact, the trees, the inventory, the run lock, the
scratch dir, dispositions, reuse state, resume, reads per round, seats,
the board), the stack and migration preflights, the prompts, reuse of
whole and block verdicts, salvage, a gate on the pool, checkpoints, the
dump, the dry-run report and the unit-state store; slots_plan and
app_ready beside it. The CLI parses run's 28 options, types and choices
included.
A full run takes its lifetime lock beside the board before it joins it.
A signal - or the stop file `crafter-review stop` writes, looked at
every 2 s - stops the run once gate 0 is through, and the stop stays in
force for the gates after; before that it ends the process with its
descendants.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
