rosotacom-dev 2.5.dev26__tar.gz → 2.5.dev27__tar.gz

rosotacom_dev-2.5.dev27/.github/actions/setup-just/action.yml

@@ -0,0 +1,34 @@
+name: Set up just
+description: >
+  Install a pinned just release, verified by checksum.
+
+  Nineteen jobs used to reach it with `apt-get update && apt-get install -y
+  just`, and almost all of that step's 9-15s was the index refresh — in every
+  job, including all thirteen e2e slices, where it sat on the merge gate's
+  critical path. A release tarball is ~2s.
+
+  It also stops the CI toolchain drifting: apt gave whatever noble currently
+  ships (1.21.0 at the time of writing), which changes without anything here
+  saying so.
+
+runs:
+  using: composite
+  steps:
+    - name: Install just
+      shell: bash
+      run: |
+        set -euo pipefail
+        JUST_VERSION="1.58.0"
+        CHECKSUM="4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d"
+        URL="https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+        # Unpacked outside the checkout: a stray tarball in the working tree is
+        # a thing every later step has to not trip over.
+        workdir="$(mktemp -d)"
+        # --fail, or a transient HTTP error body is saved as the tarball and
+        # reported as a checksum mismatch, which reads like a tampered release.
+        curl -sSLf --retry 3 --retry-all-errors -o "$workdir/just.tar.gz" "$URL"
+        echo "${CHECKSUM}  $workdir/just.tar.gz" | sha256sum --check
+        tar -xzf "$workdir/just.tar.gz" -C "$workdir" just
+        sudo mv "$workdir/just" /usr/local/bin/just
+        rm -rf "$workdir"
+        just --version

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/benchmark-calibrate.yml

@@ -44,9 +44,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -87,10 +85,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup
@@ -132,9 +135,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/benchmark-gate.yml

@@ -50,9 +50,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -87,10 +85,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup
@@ -142,9 +145,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/dev-release.yml

@@ -71,9 +71,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/image-scan.yml

@@ -33,9 +33,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/nightly-e2e.yml

@@ -51,10 +51,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup
@@ -98,10 +103,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/pr-lightweight.yml

@@ -29,9 +29,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/pr-merge-gate.yml

@@ -71,9 +71,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -102,9 +100,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -152,9 +148,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -162,35 +156,46 @@ jobs:
       - name: Validate package
         run: just package
 
-  preflight-success:
-    name: preflight-success
+  quick-gate:
+    # Everything `e2e` waits for that is not the image, and deliberately no
+    # more. It exists to answer one question — is the tree obviously broken,
+    # such that thirteen slices would burn seventy runner-minutes to say so.
+    #
+    # It replaced a `needs: preflight-success` edge that made e2e wait for the
+    # whole five-version matrix. That barrier cost 2.15 min of every gate run
+    # and had fired once in sixty runs, on `workflow-lint`, which takes 0.12
+    # min; the 2.0 min of `merge-lightweight` that set its height has never
+    # stopped an e2e round, and its expensive part is `test-nondocker-cov`
+    # (38s of 45s), which is a test suite rather than a tripwire.
+    #
+    # `lint` and `typecheck` are 4s together. The rest of this job is the fixed
+    # cost every job pays, which is also what `image` pays — so sizing the
+    # tripwire this way makes it free: e2e could not start before `image`
+    # finished anyway. Nothing merges on a weaker check than before, because
+    # `ci-success` still requires every preflight job.
+    name: quick-gate
     runs-on: ubuntu-latest
-    needs: [workflow-lint, dependency-review, build-lint, merge-lightweight, package]
-    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     steps:
-      - name: Check preflight jobs
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Set up local environment
+        run: just setup
+
+      - name: Is the tree obviously broken
         run: |
-          if [[ "${{ needs.workflow-lint.result }}" != "success" ]]; then
-            echo "workflow-lint failed: ${{ needs.workflow-lint.result }}"
-            exit 1
-          fi
-          if [[ "${{ github.event_name }}" == "pull_request" && "${{ needs.dependency-review.result }}" != "success" ]]; then
-            echo "dependency-review failed: ${{ needs.dependency-review.result }}"
-            exit 1
-          fi
-          if [[ "${{ needs.build-lint.result }}" != "success" ]]; then
-            echo "build-lint failed: ${{ needs.build-lint.result }}"
-            exit 1
-          fi
-          if [[ "${{ needs.merge-lightweight.result }}" != "success" ]]; then
-            echo "merge-lightweight failed: ${{ needs.merge-lightweight.result }}"
-            exit 1
-          fi
-          if [[ "${{ needs.package.result }}" != "success" ]]; then
-            echo "package failed: ${{ needs.package.result }}"
-            exit 1
-          fi
-          echo "All preflight checks passed"
+          just lint
+          just typecheck
 
   image:
     # Publish the images the e2e suite builds, once per set of build inputs,
@@ -208,8 +213,9 @@ jobs:
     # is stale" is not a state this can reach — which is the objection #226
     # raised against caching the image inline.
     #
-    # Runs beside preflight rather than after it: on a hit it inspects two
-    # manifests and stops, so it is never on the critical path.
+    # Runs beside the preflight jobs rather than after them: on a hit it
+    # inspects two manifests and stops. It is what sets when `e2e` can
+    # start, which is why `quick-gate` is sized to finish inside it.
     name: image
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -231,9 +237,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -300,8 +304,8 @@ jobs:
     name: e2e-${{ matrix.slice }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
-    needs: [preflight-success, image]
-    if: always() && !cancelled() && needs.preflight-success.result == 'success' && needs.image.result == 'success'
+    needs: [quick-gate, image]
+    if: always() && !cancelled() && needs.quick-gate.result == 'success' && needs.image.result == 'success'
     permissions:
       contents: read
       packages: read
@@ -322,10 +326,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup
@@ -364,7 +373,7 @@ jobs:
       - build-lint
       - merge-lightweight
       - package
-      - preflight-success
+      - quick-gate
       - image
       - e2e
     if: always() && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
@@ -392,8 +401,8 @@ jobs:
             echo "package failed or was skipped: ${{ needs.package.result }}"
             exit 1
           fi
-          if [[ "${{ needs.preflight-success.result }}" != "success" ]]; then
-            echo "preflight-success failed or was skipped: ${{ needs.preflight-success.result }}"
+          if [[ "${{ needs.quick-gate.result }}" != "success" ]]; then
+            echo "quick-gate failed or was skipped: ${{ needs.quick-gate.result }}"
             exit 1
           fi
           if [[ "${{ needs.image.result }}" != "success" ]]; then

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/.github/workflows/release.yml

@@ -35,9 +35,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -67,9 +65,7 @@ jobs:
           cache: pip
 
       - name: Install just
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just
+        uses: ./.github/actions/setup-just
 
       - name: Set up local environment
         run: just setup
@@ -139,10 +135,15 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install just and tmux
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y just tmux
+      - name: Install just
+        uses: ./.github/actions/setup-just
+
+      - name: Ensure tmux
+        # Preinstalled on the GitHub-hosted image, so this is a probe
+        # rather than an install — but the dependency is named, so a
+        # runner image that drops it fails here instead of inside a
+        # session.
+        run: command -v tmux >/dev/null || { sudo apt-get update && sudo apt-get install -y tmux; }
 
       - name: Set up local environment
         run: just setup

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev26
+Version: 2.5.dev27
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/docs/ci.md

@@ -48,6 +48,31 @@ The merge gate runs workflow lint, dependency/security review, runtime/build ass
 Python 3.10–3.14 are supported for the host CLI; Python 3.12 is the reference
 interpreter for packaging and Docker E2E jobs.
 
+### What the e2e slices wait for
+
+Every job in the gate starts at once — there is no runner contention — so the
+only thing that decides when the thirteen slices start is their `needs`. They
+wait for exactly two jobs:
+
+- **`image`**, because a slice adopts the published image rather than building
+  it, so it cannot start before that image is known to exist. On a hit this is
+  two manifest inspections, and it is what sets the floor.
+- **`quick-gate`**, `just lint && just typecheck` on one interpreter: the
+  cheapest signal that the tree is not obviously broken, so thirteen runners do
+  not spend seventy minutes discovering a syntax error. Four seconds of work,
+  sized to finish inside `image` and therefore free.
+
+They used to wait for `preflight-success`, which meant the whole five-version
+`merge-lightweight` matrix, and that cost **2.15 min of every gate run**.
+Measured against the sixty runs before #248, it had stopped an e2e round once,
+on `workflow-lint` — 0.12 min of the 2.15. Nothing about what may merge
+changed: `ci-success` still requires `workflow-lint`, `build-lint`,
+`merge-lightweight`, `package`, `quick-gate`, `image`, and `e2e`, and it is the
+only required check in branch protection.
+
+`tests/contract/test_workflow_contracts.py::test_e2e_waits_only_for_the_cheap_gate_and_the_image`
+keeps the barrier from growing back.
+
 ```bash
 just lint-workflows
 just lint-build
@@ -159,26 +184,35 @@ with a usage error, and a test owned twice fails
 
 The costs are warm pytest `call` durations — medians over seven merge-gate runs
 of 2026-08-11/12. On top of them each job pays a fixed
-`RUNNER_SETUP_SECONDS + IMAGE_BUILD_SECONDS` (2m05s: 55s of runner setup, then
+`RUNNER_SETUP_SECONDS + IMAGE_BUILD_SECONDS` (1m19s: 46s outside the tests, then
 the project image obtained inside whichever test runs first). Because that
 constant is per job and not per test, balancing warm costs balances wall clock.
 
 `IMAGE_BUILD_SECONDS` models the merge gate, where that image is pulled rather
 than built (see above); the release and nightly lanes still build and pay the
-older 154s. One slice does not currently reproduce its recorded split: `media`
-spends about 24s more than its two costs predict, and it is the critical path,
-so it is the first thing to remeasure.
+older 154s. It has now been re-measured twice, because both changes that made
+it smaller were changes to what a job moves rather than to what it runs: 154 →
+70 when #236 replaced the build with a pull, and 70 → 33 when #245 rebased the
+image on `ros-base` and the published project image went 1640 MB → 957 MB.
+Runs 31681061779 and 31687149587 ran the same partition either side of that, so
+the paired per-slice difference measures it directly: median −37.4s over all
+thirteen.
 
 ### How many slices
 
 `floor_seconds()` is `fixed + slowest single test` — the fastest any partition
 of this suite could be, because one job has to run that test and pays the fixed
-cost like every other. It is currently **6m32s**, of which 1m10s is the image
-(7m56s before #236 published it instead of rebuilding it per job).
-
-Thirteen slices sit at 7m14s, 1.11x the floor. That is the point of choosing N
-from the numbers rather than from taste: six balanced slices were 13m37s,
-twelve reach the floor, and past twelve every extra job is pure cost. The
+cost like every other. It is currently **5m47s**, of which 33s is the image
+(7m56s before #236 published it instead of rebuilding it per job, 6m32s before
+#245 shrank it).
+
+Thirteen slices sit at 6m26s, **1.12x** the floor. That is the point of choosing
+N from the numbers rather than from taste: six balanced slices were 13m37s,
+twelve reach the floor, and past twelve every extra job is pure cost. Note that
+1.12x is now a partition problem rather than a count problem — thirteen slices
+*can* reach 1.00x, and the current assignment does not, because `occupancy-grid`
+holds two 150s tests. The fixed cost falling twice is what exposed it: the same
+partition was 1.11x of a floor that was a minute and a half higher. The
 contract test asserts distance to the floor rather than the spread between
 slices — spread is compressed toward 1.0 by the fixed cost as N grows, so it
 keeps reading fine while the gate stops improving.

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/src/rosotacom_dev.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev26
+Version: 2.5.dev27
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/src/rosotacom_dev.egg-info/SOURCES.txt

@@ -31,6 +31,7 @@ terminology.md
 .github/ISSUE_TEMPLATE/repository-diagnosis.md
 .github/ISSUE_TEMPLATE/test-ci-audit.md
 .github/ISSUE_TEMPLATE/work-item.md
+.github/actions/setup-just/action.yml
 .github/workflows/benchmark-calibrate.yml
 .github/workflows/benchmark-gate.yml
 .github/workflows/dev-release.yml

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/src/rosotacom_dev.egg-info/scm_file_list.json

@@ -12,6 +12,7 @@
     ".github/ISSUE_TEMPLATE/test-ci-audit.md",
     ".github/ISSUE_TEMPLATE/work-item.md",
     ".github/PULL_REQUEST_TEMPLATE.md",
+    ".github/actions/setup-just/action.yml",
     ".github/dependabot.yml",
     ".github/workflows/benchmark-calibrate.yml",
     ".github/workflows/benchmark-gate.yml",

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/src/rosotacom_dev.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
   "tag": "2.4",
-  "distance": 26,
-  "node": "g78896a3820ecc07358d123fd0b0df6710b2d15fe",
+  "distance": 27,
+  "node": "g2b6ad70dddad15e9187b7876f4f32b01236cedd8",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-13"

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/tests/contract/test_security_maintenance_config.py

@@ -92,7 +92,7 @@ def test_merge_gate_requires_new_ci_jobs_and_no_masking() -> None:
         "build-lint",
         "merge-lightweight",
         "package",
-        "preflight-success",
+        "quick-gate",
         "image",
         "e2e",
     }
@@ -101,9 +101,9 @@ def test_merge_gate_requires_new_ci_jobs_and_no_masking() -> None:
     # Both gates the e2e slices wait on have to be green before any slice runs,
     # and the `if` has to say so job by job: `needs` alone does not stop a
     # dependency's failure from reaching a job that runs with `always()`.
-    assert set(jobs["e2e"]["needs"]) == {"preflight-success", "image"}
+    assert set(jobs["e2e"]["needs"]) == {"quick-gate", "image"}
     assert jobs["e2e"]["if"] == (
-        "always() && !cancelled() && needs.preflight-success.result == 'success' && needs.image.result == 'success'"
+        "always() && !cancelled() && needs.quick-gate.result == 'success' && needs.image.result == 'success'"
     )
 
     # Every needed job's result must be turned into an exit code by hand,

{rosotacom_dev-2.5.dev26 → rosotacom_dev-2.5.dev27}/tests/contract/test_workflow_contracts.py

@@ -414,3 +414,57 @@ def test_an_unowned_e2e_test_fails_every_slice_job() -> None:
 
     assert "test_a_test_nobody_assigned" in str(excinfo.value)
     assert "E2E_SLICES" in str(excinfo.value)
+
+
+def test_every_workflow_installs_just_the_same_pinned_way() -> None:
+    """`apt-get update` cost 9-15s in nineteen jobs to install one binary.
+
+    It was also the only unpinned tool in CI: apt gave whatever noble shipped
+    that week, so the `just` the gate ran changed without any commit saying so.
+    Both are fixed by the shared action, and both come back the moment one
+    workflow reintroduces the apt line — which is what this asserts.
+    """
+    offenders = [
+        path.name
+        for path in sorted(WORKFLOWS_DIR.glob("*.yml"))
+        if "install -y just" in path.read_text(encoding="utf-8")
+    ]
+    assert not offenders, "these workflows install just from apt instead of ./.github/actions/setup-just: " + ", ".join(
+        offenders
+    )
+
+    action = PACKAGE_ROOT / ".github" / "actions" / "setup-just" / "action.yml"
+    assert action.is_file(), "the shared setup-just action every workflow refers to does not exist"
+    body = action.read_text(encoding="utf-8")
+    assert "sha256sum --check" in body, "setup-just must verify the release it downloads"
+
+
+def test_e2e_waits_only_for_the_cheap_gate_and_the_image() -> None:
+    """The barrier `e2e` waits on has to stay cheaper than the image it also
+    waits on, or it starts costing wall clock again.
+
+    `needs: preflight-success` made every gate run wait 2.15 min for the
+    five-version `merge-lightweight` matrix. It had stopped an e2e round once
+    in sixty runs — on `workflow-lint`, which takes 0.12 min. `ci-success`
+    still requires every preflight job, so this is a change to when thirteen
+    runners start, not to what may merge.
+    """
+    workflow = yaml.safe_load((WORKFLOWS_DIR / "pr-merge-gate.yml").read_text(encoding="utf-8"))
+    jobs = workflow["jobs"]
+
+    assert set(jobs["e2e"]["needs"]) == {"quick-gate", "image"}, (
+        f"e2e must wait for the cheap tripwire and the image, and nothing else: {jobs['e2e']['needs']}"
+    )
+
+    quick_gate_work = "\n".join(_workflow_run_blocks(jobs["quick-gate"]))
+    expensive = [
+        recipe for recipe in ("test-nondocker-cov", "test", "docs", "package") if f"just {recipe}" in quick_gate_work
+    ]
+    assert not expensive, "quick-gate exists to be cheaper than the image job, so it must not run: " + ", ".join(
+        expensive
+    )
+
+    # And the jobs it stopped gating are still required to merge.
+    ci_success = jobs["ci-success"]
+    for name in ("workflow-lint", "build-lint", "merge-lightweight", "package"):
+        assert name in ci_success["needs"], f"{name} no longer gates the merge at all"