@bevel-software/platform-core-backend 0.13.6 → 0.15.1

package/dist/modules/workflow/workflow.service.js

@@ -21,14 +21,14 @@ import { promises as fs } from 'node:fs';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { isProtectedBranch, DEFAULT_BRANCH } from '@bevel-software/platform-shared';
-import { and, eq } from 'drizzle-orm';
+import { and, eq, or } from 'drizzle-orm';
 import { changeRequests } from '../database/schema.js';
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { sanitizeError } from './sanitize-error.js';
 import { WorkflowHooks } from './workflow-hooks.js';
 import { WorkspaceMutex } from '../kb-fs/mutex.js';
 import { hashEmail } from '../../shared/hash-email.js';
-import { ChangeRequestConflictsError, DuplicateChangeRequestError, RolesYamlPreservationError, PullRebaseConflictError, PushNeedsAgentResolutionError, WorkflowDomainError, WorkflowValidationError, } from '../../shared/domain-errors.js';
+import { ChangeRequestConflictsError, DuplicateChangeRequestError, RolesYamlPreservationError, PullRebaseConflictError, PushNeedsAgentResolutionError, RemoteBranchGoneError, WorkflowDomainError, WorkflowValidationError, } from '../../shared/domain-errors.js';
 import { RECOVERY_BOT_EMAIL, RECOVERY_BOT_NAME } from './recovery-bot.js';
 import { AccessDeniedError } from '../access-model/access-errors.js';
 const execFileAsync = promisify(execFile);
@@ -58,6 +58,28 @@ function isOpenPairViolation(err) {
     const message = fieldOf(err, 'message') ?? fieldOf(cause, 'message');
     return typeof message === 'string' && message.includes(OPEN_PAIR_CONSTRAINT);
 }
+/**
+ * The one sentence a remote-sync conflict is reported with — in the sync
+ * response, on the branch's banner and in the log — so whoever sees any of
+ * the three reads the same thing: which branch, which files, that automatic
+ * recovery is under way, and what to do if it does not clear.
+ */
+export function syncConflictMessage(branch, conflictedPaths) {
+    // Bounded: the same sentence goes to the response, the banner and the log,
+    // and it must be one sentence in all three whatever the conflict's size.
+    // The full path list rides beside it as `conflictedPaths`.
+    const shown = conflictedPaths.slice(0, SYNC_CONFLICT_FILES_NAMED);
+    const more = conflictedPaths.length - shown.length;
+    const files = conflictedPaths.length === 0
+        ? 'some files'
+        : more > 0
+            ? `${shown.join(', ')} and ${more} more file${more === 1 ? '' : 's'}`
+            : shown.join(', ');
+    return (`${branch} is not in sync yet: ${files} changed both in Hexis and on the git host. ` +
+        `Recovery is queued; if this stays, open the files on ${branch} in Hexis, keep what you want, and save.`);
+}
+/** How many conflicted files the sync-conflict sentence names before "and N more". */
+const SYNC_CONFLICT_FILES_NAMED = 3;
 /** Redact the shared GitHub token from any error string before surfacing it. */
 function redactTokens(msg) {
     const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter((t) => !!t && t.length > 0);
@@ -222,7 +244,12 @@ export class WorkflowService {
         return branches;
     }
     createBranch(workspaceId, name, fromBase) {
-        return this.git.createBranch(workspaceId, name, fromBase);
+        // Under the branch's lifecycle lock, like `deleteBranch` and the
+        // retirement of a clone the host deleted: creating a branch is the one
+        // operation that can bring a "gone" branch back, and the retirement's
+        // "still gone on origin?" check is only a guarantee if nothing can
+        // recreate the branch between that check and the delete.
+        return this.branchLifecycle.run(`branch:${name}`, () => this.git.createBranch(workspaceId, name, fromBase));
     }
     /**
      * Serialises everything that decides a branch's fate — opening a change
@@ -234,6 +261,71 @@ export class WorkflowService {
      * one server process owns the workspaces directory.
      */
     branchLifecycle = new WorkspaceMutex();
+    /**
+     * Hold the lifecycle lock of BOTH branches a change request names, so a
+     * check-then-insert spanning them excludes either one being deleted.
+     *
+     * ATOMICALLY, via `runAll` — not `run(a, () => run(b, …))`. Taking the keys
+     * one at a time leaves a gap between them in which a delete of the second
+     * branch can start, pass its "is any open request using this?" check
+     * (the row does not exist yet) and finish, so the request lands pointing at
+     * a branch that was removed while it was being opened. That is the same
+     * failure this PR is about, reintroduced one level down — and it would have
+     * been a REGRESSION on the source branch, which the previous single-key
+     * lock held for the whole sequence.
+     *
+     * Reserving the set in one step also removes the deadlock question that
+     * sequential acquisition raises: two requests may legally be open in
+     * opposite directions (`A -> B` and `B -> A`), and nothing is ever held
+     * while waiting for the other key.
+     *
+     * A PROTECTED target's key is NOT reserved. No path in the system can
+     * delete a protected branch (`git.deleteBranch` throws
+     * `ProtectedBranchError` before any lock, `retireMergedSourceBranch`
+     * returns early on one), so the key would exclude nothing. It would only
+     * cost: nearly every request targets the protected default branch, so one
+     * shared key there would serialize every open on the hottest path for the
+     * duration of a fetch + merge + push + diff. The source needs no such
+     * carve-out; `openChangeRequest` refuses protected sources before locking.
+     */
+    runOnBranchPair(source, target, fn) {
+        const keys = [`branch:${source}`];
+        if (!isProtectedBranch(target))
+            keys.push(`branch:${target}`);
+        return this.branchLifecycle.runAll(keys, fn);
+    }
+    /**
+     * The open change requests that deleting `branch` would strand — every one
+     * that NAMES it, at EITHER end.
+     *
+     * Both ends, not just the source. A change request is a proposal to move
+     * commits FROM one branch INTO another and it needs both to exist: the
+     * detail read resolves the target BEFORE the source, so a request whose
+     * target has been deleted cannot be read, declined, or deleted either. It
+     * is also the worse half to lose — a stranded source is closed by the boot
+     * sweep, while a stranded target used to survive every restart, because
+     * every guard here asked only "is this branch anybody's SOURCE?".
+     *
+     * That question is what let a merge retire a branch a second, still-open
+     * request was pointing INTO: the pair `X -> B` (merged, B retired) and
+     * `Y -> X` (open, now unusable forever).
+     *
+     * Returns the first such request's number and which end of it names the
+     * branch, or null when the branch is free. The end matters to the caller's
+     * error message: "withdraw your request" is only actionable when the asker
+     * owns the request, and a request proposing INTO the branch is someone
+     * else's.
+     */
+    async openChangeRequestOn(branch) {
+        const [row] = await this.db
+            .select({ number: changeRequests.number, sourceBranch: changeRequests.sourceBranch })
+            .from(changeRequests)
+            .where(and(or(eq(changeRequests.sourceBranch, branch), eq(changeRequests.targetBranch, branch)), eq(changeRequests.state, 'open')))
+            .limit(1);
+        if (!row)
+            return null;
+        return { number: row.number, end: row.sourceBranch === branch ? 'source' : 'target' };
+    }
     async deleteBranch(workspaceId, name, user, opts) {
         return this.branchLifecycle.run(`branch:${name}`, async () => {
             // A branch backing an OPEN change request is load-bearing: deleting it
@@ -243,13 +335,18 @@ export class WorkflowService {
             // its own open-request check under this same lock, and the legacy
             // `onlyIfNoRemote` prune only fires when origin no longer has the ref.
             if (!opts?.systemCleanup && !opts?.onlyIfNoRemote) {
-                const open = await this.db
-                    .select({ number: changeRequests.number })
-                    .from(changeRequests)
-                    .where(and(eq(changeRequests.sourceBranch, name), eq(changeRequests.state, 'open')))
-                    .limit(1);
-                if (open.length > 0) {
-                    throw new WorkflowValidationError(`Branch "${name}" has an open change request (#${open[0].number}) — withdraw or decline it before deleting the branch.`);
+                const open = await this.openChangeRequestOn(name);
+                if (open !== null) {
+                    // Two different situations, two different actors. A request FROM
+                    // this branch is the deleter's own to withdraw; a request INTO it
+                    // belongs to someone else, and telling the branch owner to
+                    // "withdraw" it points them at a verb they cannot use.
+                    throw new WorkflowValidationError(open.end === 'source'
+                        ? `Branch "${name}" has an open change request (#${open.number}). ` +
+                            `Withdraw or decline it before deleting the branch.`
+                        : `Open change request #${open.number} proposes changes into "${name}". ` +
+                            `Its author can withdraw it, or an admin can decline it; ` +
+                            `after that the branch can be deleted.`);
                 }
             }
             await this.deleteBranchUnlocked(workspaceId, name, user, opts);
@@ -291,9 +388,40 @@ export class WorkflowService {
     refreshRemotes(workspaceId) {
         return this.git.fetch(workspaceId);
     }
+    /**
+     * `git pull` on a workspace, plus the one announcement a pull owes the rest
+     * of the process.
+     *
+     * A pull rewrites a working tree without going through the write routes or
+     * the commit pipeline, so it emits neither of the signals those produce —
+     * and the catalogs that scan the DEFAULT branch's tree (skills, tool
+     * manuals, the plugin index) are keyed to exactly that tree. Every path that
+     * pulls the default workspace therefore has to say so, or those catalogs
+     * keep serving the pre-pull scan for the rest of their TTL: a merge landing
+     * an approved skill, the recovery ladder after a non-fast-forward push, and
+     * a user's update-from-remote alike. Routing every pull through here makes
+     * that ONE mechanism — "the default branch's tree changed" — instead of a
+     * separate special case per event. (The remote sync, `syncWorkspaceFromRemote`,
+     * pulls directly: it owes the same announcement to every branch and per
+     * file, and makes it from the same `treeChanged` verdict.)
+     *
+     * Announced only after the pull RESOLVES, and only when it CHANGED the
+     * tree's content: a pull that threw left the tree as it was, and so did an
+     * "already up to date" pull or one that landed only content-identical
+     * commits — dropping every catalog and making every attached browser
+     * refetch its file tree for a change that did not happen buys a re-scan
+     * and nothing else. The pull itself reports the change, since it is the
+     * only code that can observe it under the workspace mutex.
+     */
+    async pullWorkspace(workspaceId) {
+        const { treeChanged } = await this.git.pull(workspaceId);
+        if (treeChanged && branchForWorkspaceId(workspaceId) === DEFAULT_BRANCH) {
+            this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: DEFAULT_BRANCH });
+        }
+    }
     async updateFromRemote(workspaceId, user) {
         try {
-            await this.git.pull(workspaceId);
+            await this.pullWorkspace(workspaceId);
         }
         catch (err) {
             if (err instanceof PullRebaseConflictError) {
@@ -302,6 +430,158 @@ export class WorkflowService {
             throw err;
         }
     }
+    async retireRemoteGoneClone(workspaceId) {
+        const branch = branchForWorkspaceId(workspaceId);
+        const id = workspaceIdForBranch(branch);
+        // The lock `createBranch` and `deleteBranch` take: no Hexis operation can
+        // bring this branch back into being while the clone is examined and
+        // removed. The sync's own hold on the clone ended when its outcome was
+        // returned, so the branch is asked about AGAIN here rather than trusted
+        // from then — a recreate that landed in between keeps its clone. A clone
+        // being bootstrapped right now is left alone too: it can only be cloning
+        // a branch that exists, so the retirement is already moot. What remains
+        // is a recreate pushed from OUTSIDE Hexis in the milliseconds between the
+        // origin check and the delete, with a bootstrap starting in that same
+        // window; the next sync of that branch clones it fresh.
+        return this.branchLifecycle.run(`branch:${branch}`, async () => {
+            if (!(await this.workspaceService.hasBootstrappedWorkspace(id)))
+                return false;
+            if (this.workspaceService.isBootstrapInFlight(branch))
+                return false;
+            if (await this.git.remoteBranchExists(branch, branch))
+                return false;
+            await this.workspaceService.deleteWorkspace(id);
+            // Whatever a sync still owed that clone is owed to nothing now.
+            this.owedAnnouncements.delete(id);
+            return true;
+        });
+    }
+    /**
+     * Cap on per-path `file-changed` events one sync announces for a branch.
+     * Past it the tree event alone carries the news — a bulk import that
+     * rewrote hundreds of files would otherwise fan hundreds of events out to
+     * every open browser to say what one refresh says.
+     */
+    static SYNC_FILE_EVENT_CAP = 200;
+    /**
+     * Announcements a sync still OWES, per workspace: a pull landed but the
+     * events for it could not be sent. The pull is not redone on retry — HEAD
+     * has not moved since — so the announcement cannot be re-derived from sha
+     * movement; it is remembered here and delivered by the next sync of that
+     * workspace, merged with whatever that sync finds.
+     */
+    owedAnnouncements = new Map();
+    async syncWorkspaceFromRemote(workspaceId) {
+        const branch = branchForWorkspaceId(workspaceId);
+        const id = workspaceIdForBranch(branch);
+        // Two spellings of one workspace id are in circulation — the encoded
+        // directory name (`ali%2Fx`, what the clone listing yields) and the
+        // Express-decoded form (`ali/x`, what every HTTP route hands the git
+        // layer) — and the git layer's mutex keys on the raw string. Speaking the
+        // routes' spelling to git is what puts a webhook's rebase in the same
+        // queue as the author's concurrent save on a slashed branch; the event
+        // bus gets the encoded form, which every SSE consumer canonicalises.
+        const gitId = branch;
+        // Every failure below is an OUTCOME, never a throw: the caller runs this
+        // over many clones, and one broken clone must not abort the others.
+        let pulled;
+        try {
+            pulled = await this.git.syncFromRemote(gitId);
+        }
+        catch (err) {
+            if (err instanceof RemoteBranchGoneError) {
+                // Not a failure: the host deleted the branch, so there is nothing to
+                // sync and the caller retires the stale clone. No banner — nobody is
+                // editing a branch that no longer exists. An announcement still owed
+                // for that clone dies with it: a branch recreated under the same name
+                // is a different tree, and replaying the old paths against it would
+                // announce changes that never happened there.
+                this.owedAnnouncements.delete(id);
+                console.log(`[sync] branch "${branch}" no longer exists on the host`);
+                return { branch, outcome: 'remote-gone' };
+            }
+            if (err instanceof PullRebaseConflictError) {
+                // Same path as `updateFromRemote`: the rebase was aborted inside
+                // the pull (the clone is exactly what it was) and the divergence goes
+                // to the retry → recovery-agent → escalate ladder, attributed to the
+                // recovery bot since no person triggered this. It is still reported
+                // as a conflict because it is not resolved at request time — the
+                // caller's retry, or the ladder, settles it; the banner clears on the
+                // next clean pull or push.
+                await this.queuePullConflictRecovery(gitId, err);
+                const message = syncConflictMessage(branch, err.conflictedPaths);
+                console.warn(`[sync] ${message}`);
+                this.noteGitSyncFailed(gitId, branch, err, { paths: err.conflictedPaths, message });
+                return { branch, outcome: 'conflict', conflictedPaths: err.conflictedPaths, error: message };
+            }
+            const message = sanitizeError(err);
+            console.warn(`[sync] pull failed for branch "${branch}": ${message}`);
+            this.noteGitSyncFailed(gitId, branch, err);
+            return { branch, outcome: 'error', error: message };
+        }
+        // A clean pull is proof origin is reachable and this clone rebases onto
+        // it — the condition a `git-sync-failed` banner on this branch was
+        // waiting for, whether a sync or a push raised it.
+        this.noteGitSyncOk(gitId, branch);
+        const { before, after, treeChanged, changedPaths } = pulled;
+        // What this branch reports about ITS clone is decided by the pull alone:
+        // `updated` when HEAD moved, `up-to-date` otherwise.
+        const outcome = after === null || after === before
+            ? { branch, outcome: 'up-to-date', to: after ?? '' }
+            : { branch, outcome: 'updated', from: before, to: after };
+        // What it ANNOUNCES is what has changed since the last announcement that
+        // was actually delivered: this pull's content change, if any, plus one an
+        // earlier sync landed but could not send. The announcement keys on the
+        // pull's verdict about CONTENT — commits that left the tree identical are
+        // nothing for a browser to refetch or a catalog to drop.
+        const owed = this.owedAnnouncements.get(id);
+        if (!treeChanged && !owed)
+            return outcome;
+        const announce = {
+            after: after ?? owed?.after ?? '',
+            changedPaths: [...new Set([...(owed?.changedPaths ?? []), ...changedPaths])],
+        };
+        try {
+            // Announce the new tree. The tree event alone already refreshes every
+            // open file explorer and, on the default branch, drops the skill / tool /
+            // plugin catalogues (`catalog-cache-invalidation.ts`); the CR list
+            // caches the touched paths it resolved against the old tree, so drop
+            // that too.
+            this.prs.invalidateListCache();
+            this.events?.emit({ kind: 'fs-tree-changed', workspaceId: id, branch });
+            // Per-file events so an open tab on a file the host rewrote refetches
+            // instead of showing stale bytes until its next tree refresh. The paths
+            // were observed under the same hold as the pull, so they are exactly
+            // this sync's — never a save that landed alongside. Capped: a bulk
+            // import would otherwise fan hundreds of events out to say what one
+            // refresh says.
+            if (announce.changedPaths.length <= WorkflowService.SYNC_FILE_EVENT_CAP) {
+                for (const p of announce.changedPaths) {
+                    this.events?.emit({
+                        kind: 'file-changed',
+                        workspaceId: id,
+                        branch,
+                        path: `${this.kbDirName}/${p}`,
+                        newSha: announce.after,
+                        byUserId: 'system',
+                        byUserName: 'Git sync',
+                    });
+                }
+            }
+        }
+        catch (err) {
+            // The pull landed, so origin is fine and no banner is raised — but the
+            // caller must hear that this branch's announcement did not happen, and
+            // the announcement stays owed: the retry the error invites will not
+            // move HEAD again, so it must find the debt here rather than in the shas.
+            this.owedAnnouncements.set(id, announce);
+            const message = sanitizeError(err);
+            console.warn(`[sync] pulled "${branch}" but could not announce it: ${message}`);
+            return { branch, outcome: 'error', error: message };
+        }
+        this.owedAnnouncements.delete(id);
+        return outcome;
+    }
     /**
      * A pull hit a rebase conflict — the workspace carries local commits that
      * conflict with origin, a state that never resolves on its own (every
@@ -549,7 +829,7 @@ export class WorkflowService {
                 let recoveryError = null;
                 if (looksLikeNonFastForward) {
                     try {
-                        await this.git.pull(workspaceId);
+                        await this.pullWorkspace(workspaceId);
                         await this.git.push(workspaceId, user);
                         recovered = true;
                         this.noteGitSyncOk(workspaceId, branch);
@@ -760,7 +1040,29 @@ export class WorkflowService {
      * machinery is unaffected — all this adds is that someone finds out, rather
      * than the deployment looking healthy while nothing reaches the remote.
      */
-    noteGitSyncFailed(workspaceId, branch, err) {
+    noteGitSyncFailed(workspaceId, branch, err, 
+    /**
+     * The files a person must reconcile, and the sentence we composed about
+     * them. That sentence is ours (branch name + repo paths, no git stderr),
+     * so it goes out verbatim — the same string the sync response and the
+     * log carry — rather than through the sanitiser, whose 200-character
+     * clip would make the banner disagree with them. Callers that already
+     * hold the sentence pass it; otherwise it is derived below.
+     */
+    explicitConflict) {
+        // A rebase conflict is a conflict whichever path ran into it. The remote
+        // sync names its files on purpose; the push-recovery paths (autosave, the
+        // lock release, the queued retries) raise the same banner with the raw
+        // error — and the banner keeps the LATEST failure per branch, so a retry
+        // landing after the sync would replace the conflict variant, with the
+        // files as links, by the generic "check the server logs" one. Seen on
+        // staging: the sync's 409 named the file, the worker's retry a moment
+        // later took the links away. Derive the paths from the error itself so
+        // every path agrees.
+        const conflict = explicitConflict ??
+            (err instanceof PullRebaseConflictError
+                ? { paths: err.conflictedPaths, message: syncConflictMessage(branch, err.conflictedPaths) }
+                : undefined);
         // Same canonicalization as `noteGitSyncOk` — the pair must agree on keys.
         const id = branchForWorkspaceId(workspaceId);
         this.gitSyncFailing.add(id);
@@ -770,7 +1072,8 @@ export class WorkflowService {
             branch,
             // Git stderr can quote a credentialed URL; the banner is user-facing and
             // the string also lands in client logs, so sanitize before it leaves.
-            reason: sanitizeError(err),
+            reason: conflict ? conflict.message : sanitizeError(err),
+            ...(conflict ? { conflictedPaths: conflict.paths } : {}),
         });
     }
     /**
@@ -819,7 +1122,7 @@ export class WorkflowService {
             let recoveryError = null;
             if (looksLikeNonFastForward) {
                 try {
-                    await this.git.pull(workspaceId);
+                    await this.pullWorkspace(workspaceId);
                     await this.git.push(workspaceId, user, opts);
                     recovered = true;
                     this.noteGitSyncOk(workspaceId, branch);
@@ -1019,12 +1322,17 @@ export class WorkflowService {
             throw new WorkflowValidationError(`Cannot open a change request *from* a protected branch ("${input.sourceBranch}").`, { kind: 'source-is-protected', sourceBranch: input.sourceBranch });
         }
         // The whole open sequence — uniqueness check through row insert — runs
-        // under the source branch's lifecycle lock. `retireMergedSourceBranch`
-        // takes the same lock around its own check-then-delete, so a merge
-        // cleanup can never race into the multi-second gap between this
-        // method's "no open request" answer and its row landing, and delete the
-        // branch out from under a request being opened.
-        return this.branchLifecycle.run(`branch:${input.sourceBranch}`, async () => {
+        // under the lifecycle lock of BOTH branches. `retireMergedSourceBranch`
+        // and `deleteBranch` take the lock of the branch they are removing around
+        // their own check-then-delete, so a cleanup can never race into the
+        // multi-second gap between this method's "no open request" answer and its
+        // row landing, and delete a branch out from under a request being opened.
+        //
+        // BOTH, because that gap is symmetric: a request is unusable if EITHER of
+        // its branches is retired inside the window, and holding only the source
+        // left a `Y -> X` request open to X being deleted under it — the very
+        // failure the widened guards exist to prevent.
+        return this.runOnBranchPair(input.sourceBranch, input.targetBranch, async () => {
             // Uniqueness rule — A→B blocks A→B (the spec is explicit that B→A in
             // parallel is still allowed). `listOpenPrs` is cached for 30s so we
             // force-fresh to catch a CR that opened just now.
@@ -1236,7 +1544,7 @@ export class WorkflowService {
         // refs, but the restore commits from the working tree — a stale tree
         // would push non-fast-forward and fail loudly anyway; this just makes
         // that rare.
-        await this.git.pull(ws.id).catch(() => undefined);
+        await this.pullWorkspace(ws.id).catch(() => undefined);
         // The verb acts on the request as it is NOW — never a cached file list.
         const paths = await this.git.changedPathsForPr(ws.id, baseBranch, headBranch);
         if (!paths.includes(repoRelPath)) {
@@ -1292,9 +1600,47 @@ export class WorkflowService {
         if (summary.state === 'merged') {
             throw new WorkflowDomainError('This change request has already been applied.', 422);
         }
-        const ws = await this.workspaceService.getOrCreateForBranch(summary.base);
-        await this.workspaceService.ensureRemotesFetched(ws.id).catch(() => undefined);
-        const isAdmin = await this.accessControl.canWriteAtRef(ws.id, `origin/${summary.base}`, user.email, 'roles.yaml');
+        // Which `roles.yaml` authorizes this? The base branch's, exactly as every
+        // other admin check here. When the base branch itself is gone, this
+        // bootstrap (or the at-ref check below) fails; that failure is NOT proven
+        // absence, so it never re-keys authorization to some other branch. It
+        // kicks the deleted-branch sweep instead: the one mechanism that proves a
+        // branch is missing (fresh fetch, then a set lookup) and closes every
+        // request stranded by it, this one included. This call still fails; by
+        // the next attempt the sweep has either closed the row (nothing left to
+        // delete) or shown the base alive, meaning the failure was transient and
+        // a retry can succeed.
+        let ws;
+        let isAdmin;
+        try {
+            ws = await this.workspaceService.getOrCreateForBranch(summary.base);
+            // STRICT: the admin check below reads roles.yaml at `origin/<base>`,
+            // and on a swallowed fetch failure that ref is whatever the clone last
+            // saw — a user whose rights were since revoked would still pass
+            // against the stale tree. Authorization never runs against refs of
+            // unknown age.
+            try {
+                await this.workspaceService.ensureRemotesFetched(ws.id, { strict: true });
+            }
+            catch {
+                throw new WorkflowDomainError(`Could not verify the base branch "${summary.base}" — origin was unreachable. Retry in a moment.`, 409);
+            }
+            isAdmin = await this.accessControl.canWriteAtRef(ws.id, `origin/${summary.base}`, user.email, 'roles.yaml');
+        }
+        catch (err) {
+            this.kickDeletedBranchSweep();
+            throw err;
+        }
+        // null is "the ref did not resolve", not "denied" — and saying "only an
+        // admin can do this" to an admin whose base branch is merely unfetchable
+        // sent people chasing their role instead of the branch. Kick the sweep
+        // (it proves absence itself, with a strict fetch, and closes the
+        // stranded rows) and fail with the honest condition; by the next
+        // attempt the sweep has either closed the row or shown the base alive.
+        if (isAdmin === null) {
+            this.kickDeletedBranchSweep();
+            throw new WorkflowDomainError(`The base branch "${summary.base}" could not be resolved — it may have been deleted, or origin was unreachable. A background check is running; retry in a moment.`, 409);
+        }
         if (isAdmin !== true) {
             throw new WorkflowDomainError('Only an admin can delete a change request.', 403);
         }
@@ -1364,17 +1710,23 @@ export class WorkflowService {
         return true;
     }
     /**
-     * Close every open change request whose source branch no longer exists.
+     * Close every open change request either of whose branches no longer exists.
      *
-     * A change request is a proposal to merge a branch. When that branch is
-     * gone — deleted after a manual merge, pruned as abandoned, or left behind
-     * by a feature that has itself been removed — the request cannot be read,
-     * reviewed, applied or declined. It is not a pending decision, it is a
-     * tombstone, and it costs more than tidiness: `listOpenPrs` resolves each
-     * open request's changed paths, so every one of these throws
+     * A change request is a proposal to merge one branch into another, so it
+     * needs BOTH. When either is gone — deleted after a manual merge, pruned as
+     * abandoned, or left behind by a feature that has itself been removed — the
+     * request cannot be read, reviewed, applied or declined. It is not a pending
+     * decision, it is a tombstone, and it costs more than tidiness: `listOpenPrs`
+     * resolves each open request's changed paths, so every one of these throws
      * `unknown branch` on every poll, filling the log and slowing the list it
      * appears in.
      *
+     * The TARGET half is the one that used to be missed, and it was the worse
+     * half: a missing source could only ever arrive by a path that also closed
+     * the request, while a request whose target had been retired under it was
+     * unreadable, undeclinable, undeletable — and invisible here, so it survived
+     * every restart.
+     *
      * CLOSED, NOT DELETED. The row is evidence — who proposed what, when, and
      * that it was never applied — and it is the only remaining trace once the
      * branch is gone. Closing takes it out of every open list (which is the
@@ -1383,7 +1735,7 @@ export class WorkflowService {
      * operation in the workflow that destroys history without a human asking.
      *
      * ONE fetch, then a set lookup. The freshness matters more than the cost:
-     * `changedPathsForPr` fails when the branch is missing from THAT
+     * `changedPathsForPr` fails when a branch is missing from THAT
      * workspace's refs, which is not the same thing as missing from origin —
      * a clone that never fetched a branch someone else created reports exactly
      * the same error. Closing on that signal would eat live requests. So the
@@ -1399,7 +1751,11 @@ export class WorkflowService {
      */
     async closeChangeRequestsWithDeletedBranches() {
         const open = await this.db
-            .select({ number: changeRequests.number, sourceBranch: changeRequests.sourceBranch })
+            .select({
+            number: changeRequests.number,
+            sourceBranch: changeRequests.sourceBranch,
+            targetBranch: changeRequests.targetBranch,
+        })
             .from(changeRequests)
             .where(eq(changeRequests.state, 'open'));
         if (open.length === 0)
@@ -1408,6 +1764,11 @@ export class WorkflowService {
         try {
             const branches = await this.git.listBranches(workspaceIdForBranch(DEFAULT_BRANCH), {
                 freshFetch: true,
+                // The list is used to PROVE absence, and the listing's normal
+                // degrade-to-stale behaviour would report every branch created since
+                // the last good fetch as missing — closing live requests. Strict:
+                // a failed fetch throws into the catch below, which closes nothing.
+                strictFetch: true,
             });
             live = new Set(branches.map((b) => b.name));
         }
@@ -1423,7 +1784,15 @@ export class WorkflowService {
         }
         let closed = 0;
         for (const cr of open) {
-            if (live.has(cr.sourceBranch))
+            // Either end being gone makes the request unusable — the detail read
+            // resolves the target first, so a missing target fails it just as hard
+            // as a missing source, and no other path ever closes those.
+            const missing = !live.has(cr.sourceBranch)
+                ? cr.sourceBranch
+                : !live.has(cr.targetBranch)
+                    ? cr.targetBranch
+                    : null;
+            if (!missing)
                 continue;
             const now = new Date();
             // Guarded on `state = 'open'`, so a merge or withdraw racing this call
@@ -1437,11 +1806,40 @@ export class WorkflowService {
                 continue;
             this.prs.invalidateDetailCache(cr.number);
             this.events?.emit({ kind: 'change-request-rejected', number: cr.number });
-            console.log(`[cr] closed change request #${cr.number}: source branch "${cr.sourceBranch}" no longer exists`);
+            console.log(`[cr] closed change request #${cr.number}: branch "${missing}" no longer exists`);
             closed++;
         }
         return closed;
     }
+    /**
+     * The sweep above, on demand. Boot runs it once (`create-core-server`),
+     * which clears requests stranded BEFORE the process started; a branch that
+     * goes missing mid-uptime would otherwise keep its requests broken until
+     * the next restart. Verbs that hit a failure which MIGHT mean a missing
+     * branch kick it here.
+     *
+     * Detached, because the kicking verb is already surfacing its own error
+     * and must not hold its response on a fetch. Coalesced, because the kick
+     * sites are user actions that cluster when something is stranded (retry,
+     * decline, delete) and one sweep answers all of them. The sweep proves
+     * absence itself and fails safe by closing nothing, so a spurious kick
+     * costs one fetch and never closes a live request.
+     */
+    sweepKick = null;
+    kickDeletedBranchSweep() {
+        if (this.sweepKick)
+            return;
+        this.sweepKick = this.closeChangeRequestsWithDeletedBranches()
+            .then((n) => {
+            if (n > 0) {
+                console.log(`[cr] on-demand sweep closed ${n} stranded change request${n === 1 ? '' : 's'}`);
+            }
+        })
+            .catch((err) => console.warn('[cr] on-demand deleted-branch sweep failed:', err))
+            .finally(() => {
+            this.sweepKick = null;
+        });
+    }
     /**
      * Reject (close-without-merging) a change request. Per PLAN.md spec, the
      * authorized set is:
@@ -1467,15 +1865,27 @@ export class WorkflowService {
             // The path list comes from the PR detail — fetch fresh so the rule
             // applies against the current head (a stale list would let a user
             // reject a CR whose files they no longer all own).
-            const detail = await this.prs.getPrDetail(number, {
-                fresh: true,
-                workspaceId,
-                viewerEmail: user.email,
-                // Only `files[].path` is read below; a patch per file would be one
-                // git subprocess each, generated for nothing, on every reject by a
-                // non-author.
-                patches: false,
-            });
+            let detail;
+            try {
+                detail = await this.prs.getPrDetail(number, {
+                    fresh: true,
+                    workspaceId,
+                    viewerEmail: user.email,
+                    // Only `files[].path` is read below; a patch per file would be one
+                    // git subprocess each, generated for nothing, on every reject by a
+                    // non-author.
+                    patches: false,
+                });
+            }
+            catch (err) {
+                // The detail read resolves both branch tips (`resolvePrShas`), so a
+                // request one of whose branches is gone fails HERE, on the verb that
+                // exists to get rid of it. Kick the sweep (which proves the absence
+                // and closes the stranded rows) and surface the failure; see
+                // `kickDeletedBranchSweep`.
+                this.kickDeletedBranchSweep();
+                throw err;
+            }
             const paths = detail?.files.map((f) => f.path) ?? [];
             if (paths.length > 0) {
                 const writeMap = await this.accessControl.canWriteBatchAtRef(workspaceId, `origin/${baseBranch}`, user.email, paths);
@@ -1563,7 +1973,7 @@ export class WorkflowService {
         try {
             const targetWorkspace = await this.workspaceService.getOrCreateForBranch(baseBranch);
             targetWorkspaceId = targetWorkspace.id;
-            await this.git.pull(targetWorkspace.id);
+            await this.pullWorkspace(targetWorkspace.id);
         }
         catch (err) {
             // Still best-effort for the merge response (the merge already landed
@@ -1617,12 +2027,12 @@ export class WorkflowService {
             // until retirement finishes (and fails loudly on the missing branch,
             // retryable, instead of losing the branch mid-open).
             await this.branchLifecycle.run(`branch:${sourceBranch}`, async () => {
-                const stillOpen = await this.db
-                    .select({ number: changeRequests.number })
-                    .from(changeRequests)
-                    .where(and(eq(changeRequests.sourceBranch, sourceBranch), eq(changeRequests.state, 'open')))
-                    .limit(1);
-                if (stillOpen.length > 0)
+                // EITHER end (see `openChangeRequestOn`). The request being merged is
+                // already `merged` by now, so it never matches itself; anything left
+                // is a live request that still needs this branch — including one
+                // proposing INTO it, which the source-only question used to miss.
+                const stillOpen = await this.openChangeRequestOn(sourceBranch);
+                if (stillOpen !== null)
                     return;
                 const targetWs = await this.workspaceService.getOrCreateForBranch(baseBranch);
                 // The remote-tracking ref must be current, or deleteBranch's