Replication package: Decomposing pull-request cycle time into owner-attributed states (eight open-source repositories, 2025-09 to 2026-09)

Anonymized replication package for a pre-registered study of pull-request cycle time decomposed into owner-attributed states (author, reviewers, platform, process) on eight GitHub repositories that enforce review. Contents: the analysis code at commit e2ba8e1 (Apache-2.0), per-repository hypothesis-test results with bootstrap intervals, sensitivity analyses, the study protocol with its changelog of deviations, the limitations catalogue, validation notes, a reproduction guide, and a per-pull-request dataset (19,040 PRs) with state intervals, overlay counts, change-complexity measures, post-merge outcomes and unmerged classes. Actor logins are replaced by salted, truncated HMAC identifiers; no titles, bodies, comments, commit messages, file names or raw API payloads are included. Raw GitHub payloads can be re-fetched with the included collection script. Author identity is withheld for double-anonymous review and will be added in a later version. Version 2 (2026-09-26) corrects the study population: 691 merged pull requests targeting a non-default branch (release and backport targets) had remained in the population with a cycle time of zero although the protocol lists them as an exclusion. They are now excluded and counted; the results, dataset and code are re-run accordingly, and the version-1 results are kept under results/v1/ for comparison. The protocol changelog (§8, entry 2026-09-22) describes the fix.