# PR 23671 reviews at d0186cbb21 (one round, fresh context, read-only)
## Reviewer A: claude-sonnet-5-5. VERDICT: MERGE
- The lock order is acyclic: the reservation is always outermost, then the worktree lease, then the Git lease. Storage cleanup, the terminal manager and GitWorkflow never take a reservation.
- Release on fail, interrupt and defect: `ensuring` wraps both reserve and the body. A waiter interrupted while parked never added its reservation, so its release does nothing. No wakeups are lost, because the Deferred is swapped before it is completed.
- Latency: worktrees default to `<baseDir>/worktrees`, outside the project root. Parked starts each hold an effect-worker slot (concurrency 4) until the restore ends. The plain lease already behaved this way.
- Starvation of a restore by a stream of overlapping turn starts is theoretical. A single-process server makes in-memory state sufficient.
- Nits:
  - `contains` duplicates the helper in CheckpointRestoreSafety.ts.
  - The reservation cwd is read before `start` re-reads the thread.
  - Project-root starts make one extra `getById` call.
## Reviewer B: claude-opus-5-5. VERDICT: MERGE
- There is no self-deadlock. `execute` never calls `start`, and the outbox never runs two effects at once for one thread (EffectOutbox.ts:333-347).
- Release and wakeup are correct, the same as reviewer A found. The herd effect is fine at this scale.
- Minor: up to 3 newly created project-root threads parked behind a project-checkout restore can fill the 4-slot effect worker during a long provider rollback. Narrow (isolation check rejects pre-existing overlaps), no deadlock.
- Minor: starvation, as in reviewer A. `realPath` resolves before the wait, so a symlink created during the wait is not seen; that is very unlikely. Any non-NotFound error falls back to the literal path, which is what main does.
- Single-process only, which fits one server per T3 home.
- An older issue not from this PR: a worktree equal to the project root takes the same lease key in `withCheckoutLease`.