[IanHollow]

Summary

Package-source notifications currently repeat immutable metadata and status reads. A six-package notification phase exceeds the repository token's standard REST quota before queue validation.

validate actual producer and attempt
  read fresh source PR/ref/status snapshot
  inspect all source heads on completion
  defer healthy partial producers
  validate current native runs, jobs and source contract
  publish results with fresh batch leases and paced writes
  admit only current successful heads

Complete callbacks recover other ready source heads when concurrency replaces an older pending callback. Existing queue completion callbacks retain their dispatch payload. Notification dispatch now uses one REST request. Callers with package-source reconciliation must allow 15 minutes for a paced six-head sweep.

Evidence

• Before, the measured six-source notification phase used 1,128 REST requests before 60 notification dispatches.
• After, the same actual-main fixture uses 372 REST requests including those dispatches. The complete six-source and six-merge queue fixture uses 831 requests, or 930 with the separate 99-request source-inspection allowance. This automation-layer model excludes updater publication and native validation tools' API calls, plus bounded waits/retries. Six native candidates run serially; these calls need not share one hour. The current single-package update remains the production proof.
• All 192 Python tests pass, including actual callback Bash, immutable producer validation, rerun invalidation, real failed-job links, missing and running producers, malformed/truncated projections, fork PR exclusion and write pacing.
• Live read-only GraphQL smoke validates six distinct real source heads. The readiness query costs one GraphQL point. The authoritative required-check policy command remains in place.
• Required hosted Nix, workflow/security validation and normal merge-queue checks are still pending.

Merge danger

Door: two-way. Consumers can restore the previous reviewed release pin.

Blast radius: shared. New result publication and admission retain the actual 16-job source contract, immutable workflow comparison, current producer attempt, source head and protected-default-branch ancestry. Release-builder and repository-checks pins remain independent.