S17 ELUCIDATED. `restartPostMergeFinalization` read the task once, immediately after
restarting the engine, and treated "recovery has not finished yet" as "recovery will never
finish" — falling through to `admitAndMerge`. That fallback cannot succeed BY CONSTRUCTION:
staging deliberately replaces the row's step results with a single PENDING code-review row
and its steps with a pending stale step, precisely so the merge-confirmed recovery path is
what finalizes it. So merge admission was correctly refused and the scenario failed with
"post-merge restart parked finalization".
The outcome therefore depended on whether recovery beat one read: green in isolation
(19/19 across 8 runs) and intermittently red under full-lane load. That is a property of how
fast the suite happens to run, not of the product — the same conclusion FN-WF already reached
for S05, recorded in b39d66c00. coding-ideas-v2 surfaced it because its extra in-review
milestone lands the restart in the racy window more often.
`settleRestartFinalization` is a BOUNDED event-loop drain, the shape `settleActiveMerge`
already uses: free when recovery has already finished, and exhausting the budget still falls
through to the fallback, so a genuine hang is never masked. Three consecutive full-lane runs:
90/90, 90/90, 90/90.
NEW GUARD. `workflow-prompt-tool-availability.test.ts` rejects any built-in prompt that
instructs a `toolMode: "readonly"` node to CALL a tool its policy denies. This class has now
cost two defects that read correctly and could not be obeyed: a reviewer told to run
lint/tests/build, and a Documentation milestone told to call four writers it does not have.
Prose review cannot catch it — prompt and policy live in different files and are each
individually correct — so the guard compares them structurally. A bare mention stays legal,
because naming a denied tool is how a prompt states its own limits, and the guard carries a
test proving it rejects the exact offending shape.
Delivery notes and artifacts need no new owner: the executor's system prompt already mandates
both ("you MUST register" visual deliverables, "you MUST save" written deliverables as task
documents), independently of any plan step.
pnpm lint 0 errors, test:gate green, pipeline-smoke 90/90 x3.
caae574146