✨ fix(reviewer-lane): true creation-time ordering + structured re-escalation hand-off (#5617 items 3–4) - #5682

Summary

Two of the four follow-ups deferred from the #5480 reviewer-lane delivery. Both are small, independent, and self-contained; neither changes who is allowed to do what.

• The reviewer was working the wrong PRs first. Its work list says "oldest first" and is capped at three PRs per kick, but the rows had no age information at all — they were sorted by repo name, then PR number. On a hive with more than one repo that means an old escalated PR in a late-alphabet repo can sit behind newer ones forever. The PR's real creation time was already being fetched; it just was not being written into the file the list is built from. Now it is.
• A human inheriting a twice-failed PR was told nothing about the first attempt. The reviewer lane gets exactly one pass per PR: once it has repaired one, that PR is excluded from its work list permanently, so when the PR goes red again the escalation comment is the last thing the machinery will ever say about it. That comment was the same generic body a first escalation gets — the only thing marking it as a hand-off was the label set. It now says a reviewer already had its pass, which commit it left behind, and that nothing automated is coming next.

Item 1 (G2 pending-wipe) shipped in #5634. Item 2 (the reviewer-lane.md kick template) is not claimed here — see below.

Fix

Item 4 — true creation-time ordering

formatReviewerWorkList ordered on (repo, number) because ci-failing.json carried no creation time. PR numbers are monotonic only within a repo, so that key sorted by repo name first. Combined with the reviewerMaxPRsPerKick cap this is a starvation bug, not a cosmetic one: a month-old escalated PR in zeta/service sits behind three newer ones in alpha/console on every kick, forever, and the reviewer never reaches it.

github.PullRequest.CreatedAt was already populated at enumeration and simply never threaded through. writeMergeEligible now records it; the work list orders on it and renders it as an opened: line, so the reviewer can verify the ordering itself — the kick's INVARIANTS forbid gh pr list.

Rows with no creation time (a ci-failing.json written by an older hub, or a forge that omitted the field) sort last and keep the old proxy among themselves. An unproven age must not jump ahead of a measured one, and this makes the change a no-op on a stale artifact rather than a reshuffle.

Item 3 — structured hand-off note

The hub never observes a reviewer verdict directly: it is a label edit, usually a direct gh pr edit. The single moment it can see one is Sweep's reviewer-verdict reconciliation (#5511, gap G1) — so the record is taken there.

• Entry gains ReviewerPassedSHA / ReviewerPassedAt, stamped by that reconciliation and deliberately surviving the ledger reset the same reconciliation performs. Keyed on the SHA, so a repeat reconciliation cannot walk the timestamp forward and misdate the hand-off. Cleared only with the entry itself — a PR that goes green has converged and starts a fresh story.
• Store.ReviewerPass exposes it; runEscalationSweep uses it to pick HandoffCommentBody over CommentBody.

The note gives the head commit the reviewer left, when the PR returned to the automated lane, that the attempt count is measured from that verdict (the ledger restarts there), and that no further automated pass is coming. It points at the reviewer's own audited record — the Reviewer adjudication: relay comment attributed agent_pr_reviewed, plus the advisory bead — rather than restating it: the hub never saw the reviewer's reasoning, so summarising it would be invention. The ntfy page is retitled on this path only.

First escalations are byte-for-byte unchanged, and a partial record (SHA or timestamp missing) omits the field rather than rendering an empty backtick pair or 0001-01-01.

Cluster claimed (files/functions)

• src/pkg/scheduler/reviewer_lane.go — formatReviewerWorkList ordering key + opened: row.
• src/cmd/hive/main.go — writeMergeEligible's failingPR.CreatedAt; runEscalationSweep's comment/notify selection.
• src/pkg/escalation/escalation.go — Entry reviewer-pass fields, Sweep stamping, Store.ReviewerPass, ReviewerHandoff + HandoffCommentBody (CommentBody keeps its signature and behavior).
• src/docs/adr/0010-escalation-circuit-breaker.md, CHANGELOG.md.
• Tests: 2 ledger/body tests (pkg/escalation), 2 ordering tests (pkg/scheduler), 1 end-to-end sweep test (cmd/hive).

Disjoint from the open hold-gated PRs. The nearest neighbour is #5670, which also edits runEscalationSweep — it adds a lifecycleRecorder parameter and a recordBlocked call between MarkEscalated and logger.Info. This PR touches the comment construction above that and the notifier block below it, and leaves logger.Info alone specifically so the two do not collide. Whichever lands second should merge cleanly; if not, the resolution is to keep both.

Validation

• go build ./..., go vet ./cmd/hive/ ./pkg/escalation/ ./pkg/scheduler/, and gofmt -l clean on every touched file.
• go test ./cmd/hive/ ./pkg/escalation/ ./pkg/scheduler/ passes.
• Both new behaviors were mutation-checked: reverting the ordering key and short-circuiting the hand-off selection each make the corresponding new test fail, so neither passes vacuously.
• The first commit was checked out and built/tested on its own, so the series is bisectable.
• No formal-model change: the ledger records a new field but Sweep's state machine and transitions are untouched, so src/formal/escalation is unaffected.

Not claimed

Item 2 (embedded reviewer-lane.md kick template) is deliberately left for a separate PR. It is a change to the kick resolution chain rather than to the lane's data, and the rendered template has to reproduce the ~25 safety strings pinned by TestBuildReviewerMessage_ContractAtL5 — including the hard ACMM dormancy gate, which must stay in Go so an operator-editable template cannot switch the lane on below L5. That deserves its own review, not a rider on this one.

Related issues

Refs #5617 (items 3 and 4 of 4 — does not close the tracker)

Testing

• cd src && go build ./...
• cd src && go test ./... — ran the three affected packages (./cmd/hive/, ./pkg/escalation/, ./pkg/scheduler/); all pass.

— hive: backend=claude model=claude-opus-5