fix(gate): lead-review hold 30min -> 10min, and the re-nag exclusion sized to it (DIVE-4420)

[5dive-bot]

DIVE-4420 — the lead-review hold is 10 minutes, not 30

lodar, Telegram 2026-09-13 08:05Z, on DIVE-4365's hold: "30 minutes seems way to long tho".

What changed

• _GATE_LEAD_REVIEW_HOLD_SECS 1800 → 600 (src/task/notify.sh).
• The sweep's DIVE-4365 exclusion '-31 minutes' → '-11 minutes' (src/cmd_heartbeat.sh) — the hold plus the same 60s margin the 840-not-900 sizing takes one layer down.
• Both comment blocks that named 30 minutes, and the one asserting the ceiling is "longer than either type window", corrected.
• changelog.d/DIVE-4365.md amended in place (unshipped) rather than contradicted by a second bullet about the same behaviour.

Why 10, and why the exclusion moved with it

The hold buys the lead one dispatch to look at the row. A non-fresh seat is re-dispatched every 15 minutes; the second and third windows bought re-reads of a row already read, paid for by the person waiting. Tightening the exclusion is what makes a gate whose hold child died with its box re-nag at the sweep's normal 15 minutes instead of 31 — the net sits just past the hold, not three windows past it.

At 600s the exclusion is slack: the sweep's own 15-minute never-pinged clock already clears the hold by 300s, so that is what keeps the buttoned ping ahead of the re-nag today. The clause is kept, and kept in step, because it is the only thing that re-orders the two contacts if the hold is ever raised back — and it is graded structurally, so a raise on one side reds.

The one behaviour narrowing, taken deliberately

At 1800 this ceiling was the longest of the three windows and replaced them. At 600 it is the shortest, so a manual/secret tier-2 gate's withdraw-before-ping window is now 600s, not 840s. The ask was a shorter wait before the phone rings, and a withdrawal window cannot outlast the wait it sits inside. gate_undo_window_unit's manual/secret arms are tier-1 fixtures by design (DIVE-4365 note at the top of that file), so they still grade the 840 type ceiling and are unaffected. The two urgency skips are unchanged; nothing here can stop a gate.

Grading

gate_lead_review_routing_unit part 2 keeps its structural grep in step with the tightened literal, and gains two arms: one reading the sweep's never-pinged clock out of the source and asserting hold + 60 <= that (the relation that is actually load-bearing at this size), and a bare pin at 600 so a later raise reds rather than slides — every other arm is a relation and stays green at 1800.

Local, on this branch's tree:

harness	result
gate_lead_review_routing_unit	27 passed, 0 failed
heartbeat_gate_renag_unit	21 passed, 0 failed
gate_undo_window_unit	49 passed, 0 failed
gate_notify_log_observable_unit	6 passed, 0 failed
heartbeat_gate_escalate_unit	11 passed, 0 failed

heartbeat_gate_renag_unit's early-gate fixture (DIVE-10, -30 minutes age) has gate_pinged_at SET, so the never-pinged exclusion never applied to it at either size — checked, not assumed.

Ship: this is unshipped DIVE-4365 code. If it lands before today's hotfix-lane cut it rides with it; otherwise the next patch. Do not hold the cut for it.

🤖 Generated with Claude Code