feat(queue): Piece D, reviews as issue comments, raw per-seat token helper (row 12, #1508)

queue move ID in-review posts the review request as a Gitea comment and
review record reads verdicts back, so reviews stop being files in
docs/plans/reviews/. On a comment round, in-review to waiting-on-jason
now needs every listed reviewer's approval for the current round, the
same as in-review to done (Filbert r1 C1). scripts/gitea-api.sh reads
the raw per-seat token files (lead decisions 37 to 39): config built and
checked before curl starts, export attribute cleared, fixed base URL.
test-queue.sh skips its live checks outside the canonical root.

Darkwing authored. Filbert approved D r2 (cf1d3fd0) after r1 (a2dc2302)
and corrected the plan (293747cd). Rocko reviewed the helper (e896192f,
2096b0a3), and Sage's lead check passed under decision 38. Manifest
b402fb38, 19 files.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/filbert/work/queue-as-data-plan-2026-09-26.md

@@ -1467,7 +1467,7 @@ cooperative trust model (J2).
 | in-progress→briefed (`release`) | claimant, or privileged | clears `claim` |
 | in-progress→in-review | claimant | once D is built, for a row with `reviewers`, this move is the review request, and it takes `--candidate` (8.9). Before D, or with no reviewers, it opens the round with `request: none` |
 | in-review→in-progress | owner, or privileged | changes requested (Sage) |
-| in-review→waiting-on-jason | owner, or privileged | — |
+| in-review→waiting-on-jason | owner, or privileged | with D built, on a comment round: refused while any attempt is unresolved, and it needs the approving receipts of every listed reviewer for that round, the same checks as in-review→done (8.9). Before D, or on a round with `request: none`: no condition |
 | waiting-on-jason→done | `jason`; or `sage` with `--evidence` citing Jason's approval | the evidence reference is logged |
 | in-review→done | the row's `gateOwner`, or privileged | refused when `gateOwner` is `jason` (that path runs through waiting-on-jason). `--evidence` must name the current round and its candidate digest: with D built, the approving receipts of every listed reviewer for that round (8.9); before D, a comment id together with the round's candidate digest, which must match. Logged (J5) |
 | any non-terminal→blocked | owner, or privileged | reason required; records `previousState`; blocked→blocked refused (update the reason with `note`) |
@@ -1688,6 +1688,10 @@ The CLI may print the issue URL and the marker as a hint. It never decides.
 **Receipts.** `review record` is accepted from a listed reviewer, for the
 current round, citing the comment id and the candidate digest that was
 approved. A mismatch refuses. Every round is kept in `review.rounds[]`.
+On a comment round, the receipts gate both moves out of in-review toward
+done: in-review→done, and in-review→waiting-on-jason, which is the route
+for a Jason-gated row. Each needs an approval from every listed reviewer
+and no unresolved attempt.
 
 **Tests** use a fake transport:
 - a kill:
@@ -2402,3 +2406,8 @@ The round-2 modifications:
   - the guard checked as active on every invocation, including a
     `git hook run` canary (G2), checked in a scratch repository;
   - the lead's expected login is `jarvis`. 8.19 maps the findings.
+- 2026-09-27: correction from Filbert's Piece D review round 1 (C1),
+  ruled by Sage. The transition table let in-review→waiting-on-jason pass
+  with no reviewer approvals, so a Jason-gated row could close without its
+  reviewers. That move now carries the in-review→done checks on a comment
+  round; the table and 8.9's receipts paragraph say so.