Collapse two pieces of copy-paste plumbing

[dovvnloading]

Problem

store_code_review_diff took 18 parameters — the widest signature in the repo. Fifteen of them were pure transport: the intent pulled them out of the fetch bundle with .get() one at a time, only for the method to set them straight onto node.state.

start_gitlink_apply had five refusal paths that each repeated the same four lines:

node.pending_request_id = None
self._runs.release(request_id)
on_failure("...")
await bus.publish("scene")
return

Four chances each to forget one, and forgetting either of the first two is not cosmetic — a missed pending_request_id leaves the node permanently busy, a missed release() leaks the registry slot for the rest of the session.

Change

store_code_review_diff takes the bundle whole. pr_url stays a separate argument because it genuinely is not part of the bundle — it is what the user typed, and it survives the fetch that used it being superseded. The intent's call site drops from 17 lines to one. The widest signature in backend/ is now 15 (run_lifecycle.run_single_shot).

The per-field coercion moves with it into a small _bundle_int. The bundle is built from a GitHub API response, so every numeric field in it is external input; diff_fetch.py already coerces on the way in, and this is the second line of the same defence for a bundle arriving by any other route. Verified:

pr_number="twelve" -> 0    changed_files=-5 -> 0
additions="lots"   -> 0    files=[{...},"junk"] -> the junk row dropped

The five gitlink refusal paths share one _abandon(). Its await sits on the abandon path only, so the atomic check-and-freeze section keeps its zero-await guarantee — the comparisons there still run with no suspension point between them; _abandon only runs once one of them has already decided to give up. The two remaining bare cleanups in that file are the task-completion finally blocks, a different concern, correctly using the guarded if node.pending_request_id == request_id form.

Test plan

• 12 existing store_code_review_diff call sites updated. They were already unpacking a dict (**{k: v for k, v in _bundle().items()}), so they got shorter too.
• Full suite: 3212 passed, 19 skipped. ruff and mypy clean.

Note for the record: the _bundle_int helper first landed between the @dataclass decorator and SceneDocument, breaking the module on import — the same line-heuristic mistake as the previous change. Caught by test collection and relocated above the decorator.

🤖 Generated with Claude Code