@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-workflow.interface.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE3D,gGAAgG;IAChG,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;;OAIG;IACH,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,CAAC,EAAE,MAAM;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;OAIG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ;IACd,oFAAoF;IACpF,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,EAC9B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM;IACf,yFAAyF;IACzF,UAAU,EAAE,MAAM;IAClB,2EAA2E;IAC3E,WAAW,EAAE,MAAM;IACnB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;OAOG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ;IACd,8DAA8D;IAC9D,KAAK,EAAE,gBAAgB;IACvB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI;IAC3B,iFAAiF;IACjF,UAAU,EAAE,MAAM;IAClB,oFAAoF;IACpF,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B"}
+{"version":3,"file":"review-workflow.interface.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;;GAIG;AACH,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE3D,gGAAgG;IAChG,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;;OAIG;IACH,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,CAAC,EAAE,MAAM;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;;;;;;;;;OAYG;IACH,qBAAqB,CACnB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAAC;IAE1D;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErG;;;;;;;;;;;OAWG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ;IACd,oFAAoF;IACpF,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,EAC9B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM;IACf,yFAAyF;IACzF,UAAU,EAAE,MAAM;IAClB,2EAA2E;IAC3E,WAAW,EAAE,MAAM;IACnB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;OAOG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ;IACd,8DAA8D;IAC9D,KAAK,EAAE,gBAAgB;IACvB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI;IAC3B,iFAAiF;IACjF,UAAU,EAAE,MAAM;IAClB,oFAAoF;IACpF,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B"}

package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts

@@ -4,6 +4,7 @@ import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { GitService } from '../git/git.service.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IReviewWorkflowService, MergeGateInput, MergeGateResult } from './review-workflow.interface.js';
+import { type ApprovalTx } from './approval-lock.js';
 export declare class ReviewWorkflowService implements IReviewWorkflowService {
     private readonly db;
     private readonly accessControl;
@@ -16,11 +17,74 @@ export declare class ReviewWorkflowService implements IReviewWorkflowService {
     deleteComment(commentId: string, prNumber: number, user: AuthUser): Promise<void>;
     getApprovalStates(prNumber: number, files: PullRequestFile[], headSha: string, baseBranch: string, prAuthorIdHash: string | null, workspaceId?: string, viewerEmail?: string): Promise<FileApprovalState[]>;
     approveFile(prNumber: number, path: string, user: AuthUser, files: PullRequestFile[], headSha: string, baseBranch: string, prAuthorIdHash: string | null, workspaceId: string): Promise<FileApprovalState[]>;
+    /**
+     * See the interface. The lock is taken right before the statement it has to
+     * cover, not at the top of the caller's transaction: what it orders is this
+     * rewrite and everything after it, and every millisecond earlier is that
+     * much longer for approvals to queue behind an erasure.
+     */
+    eraseApprover(tx: ApprovalTx, email: string, erased: {
+        email: string;
+        name: string;
+    }): Promise<void>;
+    /**
+     * Pure in `this`: the whole verdict comes out of `evaluateGateParts`, a
+     * module-level function. Call-sites borrow this off the prototype against a
+     * bare object to get the real gate without a service, so keep it that way —
+     * reaching for an instance field here breaks them with a TypeError.
+     */
     evaluateMergeGate(input: MergeGateInput): MergeGateResult;
     mergePr(prNumber: number, user: AuthUser, headSha: string, approvals: FileApprovalState[], state: PullRequestState, prTitle: string, baseBranch: string, workspaceId: string, opts?: {
         bypass?: boolean;
     }): Promise<MergePrResult>;
     cancelPr(prNumber: number, user: AuthUser, state: PullRequestState, authorIdHash: string | null, baseBranch: string, workspaceId: string): Promise<CancelPrResult>;
+    /**
+     * Carry the per-file approvals across a commit that the APPROVERS did not
+     * make — the merge an update-from-target lands on the proposal's branch.
+     *
+     * An approval is pinned to a head sha (that is what makes an author's own
+     * later edit reset it), so a merge commit voided every approval on the
+     * request, including the many files it never touched. Reviewers then had to
+     * re-approve text nobody had changed, which is how automatic updates would
+     * have turned every stale request into a second round of review.
+     *
+     * What survives is decided by CONTENT, not by trust: `changedPaths` is
+     * every path whose bytes differ between the two heads, and only a path
+     * absent from it keeps its approval. The original `approvedAt` travels with
+     * the row, because the reviewer approved then, not now. Idempotent under
+     * the unique index, so a retried or concurrent update inserts nothing twice.
+     *
+     * Read and write sit inside one `withApprovalLock` transaction because a
+     * REVOKE landing between them would otherwise be undone: `unapproveFile`
+     * deletes the approver's rows at every head, and a copy taken before that
+     * delete would re-insert the row it just removed, silently restoring an
+     * approval its owner withdrew. Under the lock the two orderings are the only
+     * two possible ones — revoke first, and the select finds nothing to carry;
+     * carry first, and the revoke's delete sees both rows and takes both.
+     *
+     * Returns how many rows were actually WRITTEN (`returning()`, not the size
+     * of the candidate list): on a retry where every row already exists nothing
+     * is written, and the caller re-reads the detail only when that is non-zero.
+     */
+    carryApprovalsForward(prNumber: number, fromHeadSha: string, toHeadSha: string, changedPaths: string[]): Promise<number>;
+    /**
+     * Run one change request's approval write under the lock every writer of
+     * these rows takes (see `approval-lock.ts` for what it orders and why),
+     * inside one transaction that holds it until it commits or rolls back.
+     *
+     * Every approval write this service makes goes through here — carry forward,
+     * approve, revoke — because a write that skipped it would be exactly the one
+     * that interleaves with the others. Account erasure, in another module,
+     * takes the same lock's exclusive form.
+     *
+     * Keep the body SHORT — no git, no network, no access-control read. This
+     * holds a lock and a pooled connection; `approveFile` and `unapproveFile`
+     * deliberately leave their access checks and their detail re-read outside.
+     *
+     * The wait is bounded, and hitting that bound is reported as the retryable
+     * refusal it is: nothing was written.
+     */
+    private withApprovalLock;
     unapproveFile(prNumber: number, path: string, user: AuthUser, files: PullRequestFile[], headSha: string, baseBranch: string, prAuthorIdHash: string | null, workspaceId: string): Promise<FileApprovalState[]>;
 }
 //# sourceMappingURL=review-workflow.service.d.ts.map

package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-workflow.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EAEd,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,EAChB,MAAM,gCAAgC,CAAC;AAyLxC,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,EAAE,EAAE,QAAQ,EACZ,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,UAAU;IAG5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAU1D,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC;IA+CrB,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC;IAuBrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjF,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA2HzB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA8C/B,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe;IAsCnD,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,EAC9B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAC9B,OAAO,CAAC,aAAa,CAAC;IAmJnB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC;IAmEpB,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC;CA0BhC"}
+{"version":3,"file":"review-workflow.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EAEd,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,EAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAqP5B,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,EAAE,EAAE,QAAQ,EACZ,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB,EAClC,GAAG,EAAE,UAAU;IAG5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAU1D,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC;IA+CrB,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC;IAuBrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjF,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA2HzB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA0E/B;;;;;OAKG;IACG,aAAa,CACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe;IAQnD,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,EAC9B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAC9B,OAAO,CAAC,aAAa,CAAC;IAmJnB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC;IAmE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAoClB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAoBxB,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,eAAe,EAAE,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,EAAE,CAAC;CAiChC"}

package/dist/modules/workflow/review-workflow/review-workflow.service.js

@@ -1,17 +1,17 @@
 import { and, asc, eq } from 'drizzle-orm';
-import { changeRequests, prComments, prFileApprovals, prMergeLog } from '../../database/schema.js';
+import { logger } from '../../../shared/logging.js';
+const log = logger('review-workflow');
+import { changeRequests, prComments, prFileApprovals, prMergeLog, users } from '../../database/schema.js';
 import { AccessUnreadableError } from '../../access-model/access-errors.js';
-import { isAccessMdPath } from '../../access-model/access-grammar.js';
 import { ChangeRequestConflictsError, WorkflowDomainError, WorkflowValidationError, } from '../../../shared/domain-errors.js';
-import { hashEmail } from '../../../shared/hash-email.js';
+import { canonicalEmail, hashEmail } from '../../../shared/email-identity.js';
+import { APPROVAL_LOCK_TIMEOUT_MS, isApprovalLockTimeout, takeApprovalLock, takeEveryApprovalLock, } from './approval-lock.js';
 // Merge commit (not squash): change requests can carry many meaningful commits
 // (e.g. a bulk node upload split across files) and the KB's history is the audit
 // trail — squashing would collapse them into one. A merge commit preserves every
 // commit on the branch.
 const MERGE_METHOD = 'merge';
 const EVERYONE_CANONICAL = 'everyone';
-/** Repo-relative path of the access-config file the resolver gates as Admin-only. */
-const ROLES_YAML = 'roles.yaml';
 function redactTokens(msg) {
     const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter((t) => !!t && t.length > 0);
     return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
@@ -22,6 +22,17 @@ class CommentAuthError extends WorkflowDomainError {
         this.name = 'CommentAuthError';
     }
 }
+/**
+ * Another approval write on this same request is holding the lock and did not
+ * let go. Retryable BY THE CALLER, and said in words a business user can act
+ * on: nothing was written, and trying again is the whole fix.
+ */
+class ApprovalBusyError extends WorkflowDomainError {
+    constructor() {
+        super('This change request is being updated right now — try that again in a moment.', 503, { kind: 'approval-write-busy', retryable: true });
+        this.name = 'ApprovalBusyError';
+    }
+}
 class MergeBlockedError extends WorkflowDomainError {
     constructor(reasons) {
         super(`Merge gate rejected: ${reasons.join('; ') || 'unknown'}`, 422, {
@@ -47,6 +58,23 @@ class ApprovalAuthError extends WorkflowDomainError {
         this.name = 'ApprovalAuthError';
     }
 }
+/**
+ * The account this approval would be recorded in the name of is gone — erased
+ * between the request being authenticated and its write reaching the table.
+ *
+ * 401 and not 403: the same answer `requireUser` gives a token whose account
+ * no longer exists, which is what the NEXT request from this caller will get.
+ * Signing in again makes a fresh account at the same address, and approvals
+ * made then are that new person's.
+ */
+class ApprovalAccountGoneError extends WorkflowDomainError {
+    constructor() {
+        super('This account no longer exists — sign in again to approve.', 401, {
+            kind: 'approval-account-erased',
+        });
+        this.name = 'ApprovalAccountGoneError';
+    }
+}
 class BypassAuthError extends WorkflowDomainError {
     constructor() {
         super("Only admins can merge with bypass. You need write access to roles.yaml on the base branch to skip approval warnings.", 403);
@@ -99,31 +127,19 @@ function assertValidUuid(value, fieldName) {
     }
 }
 /**
- * The access-config files the resolver treats as Admin-only to write
- * (`roles.yaml` decides admin membership; any `access.md` decides per-path
- * grants). These are NOT `.md` KB nodes but ARE the most security-critical
- * files in the repo, so the approval gate must bind them too — without this a
- * `roles.yaml`-only change request rides into a protected branch with no
- * approval and no admin check, letting its author self-promote to Admin.
- * Mirrors the resolver's own `relativePath === 'roles.yaml' || isAccessMdPath`
- * special-cases (access-control.service.ts). Paths are repo-relative, the same
- * form GitHub reports a PR's changed files in.
- */
-function isAccessConfigPath(p) {
-    return p === ROLES_YAML || isAccessMdPath(p);
-}
-/**
- * Approval enforcement binds markdown KB nodes AND the access-config files
- * (`roles.yaml`, `access.md`) that have someone eligible to approve them per
- * the access tree. Files with no eligible approvers, and other non-md files,
- * are outside the gate — they neither warn nor block. Shared between the gate
- * and any call-site that needs the "does this participate in approvals"
- * question answered consistently.
+ * Approval enforcement binds every touched file that has someone eligible to
+ * approve it per the access tree — Markdown notes, the access-config files
+ * (`roles.yaml`, `access.md`), extensionless and binary files alike. The
+ * extension plays no part: a `report.pdf` or a `Makefile` in an owned folder
+ * is as much its owners' decision as a note beside it, and an extension check
+ * let a request touching only such files merge with no approval at all. Files
+ * with no eligible approvers are outside the gate — nobody could approve them,
+ * so counting them would deadlock the request. Shared between the gate and
+ * any call-site that needs the "does this participate in approvals" question
+ * answered consistently.
  */
 function isGateRelevant(a) {
-    const hasEligible = a.eligibleApprovers.roles.length > 0 || a.eligibleApprovers.users.length > 0;
-    const lower = a.path.toLowerCase();
-    return hasEligible && (lower.endsWith('.md') || isAccessConfigPath(a.path));
+    return a.eligibleApprovers.roles.length > 0 || a.eligibleApprovers.users.length > 0;
 }
 /** Human-friendly label for the eligible-approver set, used in gate warnings. */
 function eligibleLabel(a) {
@@ -137,6 +153,46 @@ function eligibleLabel(a) {
     }
     return parts.join('; ') || 'someone with write access';
 }
+/**
+ * The gate split by what can override it: `hardReasons` (closed, merged, no
+ * files) refuse every merge; `warnings` (missing approvals) refuse too, but
+ * an admin may merge past them with the bypass flag.
+ */
+function evaluateGateParts(input) {
+    const reasons = [];
+    const warnings = [];
+    if (input.state === 'merged') {
+        reasons.push('This pull request has already been merged.');
+    }
+    else if (input.state === 'closed') {
+        reasons.push('This pull request is closed.');
+    }
+    // Empty approvals = empty files array = nothing to approve. That's not
+    // mergeable either — a PR that touches no files shouldn't be opened in
+    // the first place, let alone merged.
+    if (input.approvals.length === 0 && input.state === 'open') {
+        reasons.push('This pull request has no file changes to approve.');
+    }
+    // Ownership enforcement binds every file with an eligible approver,
+    // whatever its extension; files nobody can approve are silent. For the
+    // gate-relevant files, "owner hasn't approved the current head" is a
+    // missing approval — it blocks, and only an admin bypass merges past it.
+    for (const a of input.approvals) {
+        if (!isGateRelevant(a))
+            continue;
+        if (a.isApproved)
+            continue;
+        const hasStale = a.approvedBy.some((e) => e.isStale);
+        const label = eligibleLabel(a);
+        if (hasStale) {
+            warnings.push(`${label} need to re-approve ${a.path} after the latest push.`);
+        }
+        else {
+            warnings.push(`Waiting on approval for ${a.path} from ${label}.`);
+        }
+    }
+    return { hardReasons: reasons, warnings };
+}
 function assertValidPath(p) {
     if (p === undefined || p === null)
         return;
@@ -213,7 +269,7 @@ export class ReviewWorkflowService {
             .insert(prComments)
             .values({
             prNumber,
-            authorEmail: user.email.trim().toLowerCase(),
+            authorEmail: canonicalEmail(user.email),
             authorName: user.name,
             path: input.path ?? null,
             line: input.line ?? null,
@@ -237,7 +293,7 @@ export class ReviewWorkflowService {
             .limit(1);
         if (existing.length === 0)
             throw new CommentAuthError('not-found');
-        if (existing[0].authorEmail !== user.email.trim().toLowerCase()) {
+        if (existing[0].authorEmail !== canonicalEmail(user.email)) {
             throw new CommentAuthError('forbidden');
         }
         const [row] = await this.db
@@ -257,7 +313,7 @@ export class ReviewWorkflowService {
             .limit(1);
         if (existing.length === 0)
             throw new CommentAuthError('not-found');
-        if (existing[0].authorEmail !== user.email.trim().toLowerCase()) {
+        if (existing[0].authorEmail !== canonicalEmail(user.email)) {
             throw new CommentAuthError('forbidden');
         }
         await this.db
@@ -285,19 +341,22 @@ export class ReviewWorkflowService {
         // the caller is unauthenticated. The frontend can still surface the
         // eligible roles/users list; it just won't render an Approve button.
         let viewerCanApproveByPath = new Map();
+        let eligibilityResolved = false;
         if (workspaceId) {
             await this.workspaceService.ensureRemotesFetched(workspaceId).catch(() => undefined);
             try {
                 const resolved = await this.accessControl.eligibleWritersForPathsAtRef(workspaceId, baseRef, paths);
-                if (resolved)
+                if (resolved) {
                     eligibilityByPath = resolved;
+                    eligibilityResolved = true;
+                }
             }
             catch (err) {
                 // An unreadable tree is not "no eligible writers": that answer would
                 // drop every file out of the merge gate. Fail closed instead.
                 if (err instanceof AccessUnreadableError)
                     throw err;
-                console.warn(`[review-workflow] eligibleWritersForPathsAtRef failed for PR #${prNumber} (base=${baseBranch}):`, err);
+                log.warn(`eligibleWritersForPathsAtRef failed for PR #${prNumber} (base=${baseBranch}):`, { err });
             }
             if (viewerEmail) {
                 try {
@@ -308,7 +367,7 @@ export class ReviewWorkflowService {
                 catch (err) {
                     if (err instanceof AccessUnreadableError)
                         throw err;
-                    console.warn(`[review-workflow] canWriteBatchAtRef failed for PR #${prNumber} viewer=${viewerEmail}:`, err);
+                    log.warn(`canWriteBatchAtRef failed for PR #${prNumber} viewer=${viewerEmail}:`, { err });
                 }
             }
         }
@@ -351,13 +410,15 @@ export class ReviewWorkflowService {
                         ? !excludedEmails.has(approverEmail)
                         : eligible.emails.has(approverEmail);
                 });
-            return {
+            const state = {
                 path: file.path,
                 eligibleApprovers: { roles: eligible.roles, users: eligible.users },
                 approvedBy,
+                eligibilityResolved,
                 isApproved: hasEligibleApproval,
                 viewerCanApprove: viewerCanApproveByPath.get(file.path) === true,
             };
+            return { ...state, inMergeGate: isGateRelevant(state) };
         });
     }
     async approveFile(prNumber, path, user, files, headSha, baseBranch, prAuthorIdHash, workspaceId) {
@@ -381,59 +442,78 @@ export class ReviewWorkflowService {
             throw new ApprovalAuthError('no-eligible-approvers');
         if (!canApprove)
             throw new ApprovalAuthError('not-eligible');
-        const callerEmail = user.email.trim().toLowerCase();
+        const callerEmail = canonicalEmail(user.email);
         // Unique index on (prNumber, path, approverEmail, headSha) makes this
         // idempotent — `onConflictDoNothing` turns a double-click into a no-op.
-        await this.db
-            .insert(prFileApprovals)
-            .values({
-            prNumber,
-            path,
-            approverEmail: callerEmail,
-            approverName: user.name,
-            headSha,
-        })
-            .onConflictDoNothing();
+        //
+        // Under the same per-request lock the carry-forward takes: an approval
+        // that landed between that copy's select and its insert would be pinned to
+        // the head the update was replacing and silently dropped from the request
+        // it was made on. Serialized, the approval either precedes the copy and is
+        // carried with the rest, or follows it and is honestly an approval of a
+        // head that has already moved — which the dialog then shows as stale.
+        await this.withApprovalLock(prNumber, async (tx) => {
+            // Is there still an account to record this in the name of?
+            //
+            // The route proved there was before the access read above, and that read
+            // fetches remotes — seconds, on a cold clone. An erasure that commits in
+            // that window has already rewritten every row this person's address was
+            // on, so an insert landing after it would put the address back, on a row
+            // created after the last trace of them was supposed to be gone. The lock
+            // makes the two orderings the only two: erased first and this finds
+            // nothing and refuses; approved first and the erasure's own rewrite —
+            // which waits for this transaction — takes the new row with the rest.
+            //
+            // By id, not by address: a NEW account signed in at the same address
+            // since is a different person, and this caller is not them.
+            const [account] = await tx
+                .select({ id: users.id })
+                .from(users)
+                .where(eq(users.id, user.id))
+                .limit(1);
+            if (!account)
+                throw new ApprovalAccountGoneError();
+            await tx
+                .insert(prFileApprovals)
+                .values({
+                prNumber,
+                path,
+                approverEmail: callerEmail,
+                approverName: user.name,
+                headSha,
+            })
+                .onConflictDoNothing();
+        });
         // WITH the caller as viewer: these approvals go straight back to the UI
         // that just clicked, and omitting the viewer computed every
         // `viewerCanApprove` as false — one approval made the apply button and
         // every remaining approve control vanish until a fresh detail fetch.
         return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId, user.email);
     }
+    /**
+     * See the interface. The lock is taken right before the statement it has to
+     * cover, not at the top of the caller's transaction: what it orders is this
+     * rewrite and everything after it, and every millisecond earlier is that
+     * much longer for approvals to queue behind an erasure.
+     */
+    async eraseApprover(tx, email, erased) {
+        await takeEveryApprovalLock(tx);
+        await tx
+            .update(prFileApprovals)
+            .set({ approverEmail: erased.email, approverName: erased.name })
+            .where(eq(prFileApprovals.approverEmail, email));
+    }
+    /**
+     * Pure in `this`: the whole verdict comes out of `evaluateGateParts`, a
+     * module-level function. Call-sites borrow this off the prototype against a
+     * bare object to get the real gate without a service, so keep it that way —
+     * reaching for an instance field here breaks them with a TypeError.
+     */
     evaluateMergeGate(input) {
-        const reasons = [];
-        const warnings = [];
-        if (input.state === 'merged') {
-            reasons.push('This pull request has already been merged.');
-        }
-        else if (input.state === 'closed') {
-            reasons.push('This pull request is closed.');
-        }
-        // Empty approvals = empty files array = nothing to approve. That's not
-        // mergeable either — a PR that touches no files shouldn't be opened in
-        // the first place, let alone merged.
-        if (input.approvals.length === 0 && input.state === 'open') {
-            reasons.push('This pull request has no file changes to approve.');
-        }
-        // Ownership enforcement only binds markdown KB nodes. Non-md files (TS,
-        // JSON, images, etc.) and ownerless md files are silent — they neither
-        // warn nor block. For the remaining gate-relevant files, "owner hasn't
-        // approved the current head" is surfaced as a *warning* the caller can
-        // bypass explicitly, not a hard block.
-        for (const a of input.approvals) {
-            if (!isGateRelevant(a))
-                continue;
-            if (a.isApproved)
-                continue;
-            const hasStale = a.approvedBy.some((e) => e.isStale);
-            const label = eligibleLabel(a);
-            if (hasStale) {
-                warnings.push(`${label} need to re-approve ${a.path} after the latest push.`);
-            }
-            else {
-                warnings.push(`Waiting on approval for ${a.path} from ${label}.`);
-            }
-        }
+        // A missing approval is both: a blocking reason (the request is not
+        // mergeable while it remains) and a warning (the admin bypass names it).
+        const { hardReasons, warnings } = evaluateGateParts(input);
+        const reasons = [...hardReasons, ...warnings];
         return { mergeable: reasons.length === 0, reasons, warnings };
     }
     async mergePr(prNumber, user, headSha, approvals, state, prTitle, baseBranch, workspaceId, opts = {}) {
@@ -445,12 +525,12 @@ export class ReviewWorkflowService {
         if (!workspaceId)
             throw new WorkflowValidationError('workspace id is required');
         // Server-side re-validation — never trust the frontend's cached gate.
-        // Hard blocks always refuse. Soft warnings refuse unless the caller opted
-        // into bypass; with bypass, the bypassed warnings get inlined in the merge
-        // commit body so git history captures the decision.
-        const gate = this.evaluateMergeGate({ prNumber, state, approvals });
-        if (!gate.mergeable)
-            throw new MergeBlockedError(gate.reasons);
+        // Hard blocks always refuse. Missing approvals refuse unless the caller
+        // opted into bypass; with bypass, the bypassed warnings get inlined in the
+        // merge commit body so git history captures the decision.
+        const gate = evaluateGateParts({ prNumber, state, approvals });
+        if (gate.hardReasons.length > 0)
+            throw new MergeBlockedError(gate.hardReasons);
         if (gate.warnings.length > 0 && !opts.bypass) {
             throw new MergeBlockedError(gate.warnings);
         }
@@ -486,7 +566,7 @@ export class ReviewWorkflowService {
                     : 'This change request is closed.',
             ]);
         }
-        const triggeredByEmail = user.email.trim().toLowerCase();
+        const triggeredByEmail = canonicalEmail(user.email);
         const [logRow] = await this.db
             .insert(prMergeLog)
             .values({
@@ -630,18 +710,117 @@ export class ReviewWorkflowService {
             cancelledAt: now.toISOString(),
         };
     }
+    /**
+     * Carry the per-file approvals across a commit that the APPROVERS did not
+     * make — the merge an update-from-target lands on the proposal's branch.
+     *
+     * An approval is pinned to a head sha (that is what makes an author's own
+     * later edit reset it), so a merge commit voided every approval on the
+     * request, including the many files it never touched. Reviewers then had to
+     * re-approve text nobody had changed, which is how automatic updates would
+     * have turned every stale request into a second round of review.
+     *
+     * What survives is decided by CONTENT, not by trust: `changedPaths` is
+     * every path whose bytes differ between the two heads, and only a path
+     * absent from it keeps its approval. The original `approvedAt` travels with
+     * the row, because the reviewer approved then, not now. Idempotent under
+     * the unique index, so a retried or concurrent update inserts nothing twice.
+     *
+     * Read and write sit inside one `withApprovalLock` transaction because a
+     * REVOKE landing between them would otherwise be undone: `unapproveFile`
+     * deletes the approver's rows at every head, and a copy taken before that
+     * delete would re-insert the row it just removed, silently restoring an
+     * approval its owner withdrew. Under the lock the two orderings are the only
+     * two possible ones — revoke first, and the select finds nothing to carry;
+     * carry first, and the revoke's delete sees both rows and takes both.
+     *
+     * Returns how many rows were actually WRITTEN (`returning()`, not the size
+     * of the candidate list): on a retry where every row already exists nothing
+     * is written, and the caller re-reads the detail only when that is non-zero.
+     */
+    async carryApprovalsForward(prNumber, fromHeadSha, toHeadSha, changedPaths) {
+        assertValidPrNumber(prNumber);
+        if (!fromHeadSha || !toHeadSha) {
+            throw new WorkflowValidationError('both head shas are required');
+        }
+        if (fromHeadSha === toHeadSha)
+            return 0;
+        const written = await this.withApprovalLock(prNumber, async (tx) => {
+            const rows = await tx
+                .select()
+                .from(prFileApprovals)
+                .where(and(eq(prFileApprovals.prNumber, prNumber), eq(prFileApprovals.headSha, fromHeadSha)));
+            const touched = new Set(changedPaths);
+            const carried = rows
+                .filter((r) => !touched.has(r.path))
+                .map((r) => ({
+                prNumber,
+                path: r.path,
+                approverEmail: r.approverEmail,
+                approverName: r.approverName,
+                headSha: toHeadSha,
+                approvedAt: r.approvedAt,
+            }));
+            if (carried.length === 0)
+                return [];
+            return tx.insert(prFileApprovals).values(carried).onConflictDoNothing().returning();
+        });
+        if (written.length === 0)
+            return 0;
+        log.info(`carried ${written.length} approval(s) forward on PR #${prNumber} from ${fromHeadSha} to ${toHeadSha}`);
+        return written.length;
+    }
+    /**
+     * Run one change request's approval write under the lock every writer of
+     * these rows takes (see `approval-lock.ts` for what it orders and why),
+     * inside one transaction that holds it until it commits or rolls back.
+     *
+     * Every approval write this service makes goes through here — carry forward,
+     * approve, revoke — because a write that skipped it would be exactly the one
+     * that interleaves with the others. Account erasure, in another module,
+     * takes the same lock's exclusive form.
+     *
+     * Keep the body SHORT — no git, no network, no access-control read. This
+     * holds a lock and a pooled connection; `approveFile` and `unapproveFile`
+     * deliberately leave their access checks and their detail re-read outside.
+     *
+     * The wait is bounded, and hitting that bound is reported as the retryable
+     * refusal it is: nothing was written.
+     */
+    async withApprovalLock(prNumber, fn) {
+        try {
+            return await this.db.transaction(async (tx) => {
+                await takeApprovalLock(tx, prNumber);
+                return fn(tx);
+            });
+        }
+        catch (err) {
+            if (isApprovalLockTimeout(err)) {
+                log.warn(`gave up waiting for the approval lock on PR #${prNumber} after ${APPROVAL_LOCK_TIMEOUT_MS}ms`);
+                throw new ApprovalBusyError();
+            }
+            throw err;
+        }
+    }
     async unapproveFile(prNumber, path, user, files, headSha, baseBranch, prAuthorIdHash, workspaceId) {
         assertValidPrNumber(prNumber);
         assertValidPath(path);
         if (!headSha)
             throw new WorkflowValidationError('head sha is required');
-        const callerEmail = user.email.trim().toLowerCase();
+        const callerEmail = canonicalEmail(user.email);
         // Only revoke the caller's OWN approval — never someone else's. Filter on
         // (PR, path, approverEmail) without pinning the SHA so a user revoking
         // after a force-push can drop their stale row in one click.
-        await this.db
-            .delete(prFileApprovals)
-            .where(and(eq(prFileApprovals.prNumber, prNumber), eq(prFileApprovals.path, path), eq(prFileApprovals.approverEmail, callerEmail)));
+        //
+        // Under the same per-request lock `carryApprovalsForward` takes: an
+        // automatic update copies the approvals of the head it is replacing onto
+        // the new one, and a delete that interleaved with that copy would be
+        // undone by it — the revoked approval would come back at the new head.
+        await this.withApprovalLock(prNumber, async (tx) => {
+            await tx
+                .delete(prFileApprovals)
+                .where(and(eq(prFileApprovals.prNumber, prNumber), eq(prFileApprovals.path, path), eq(prFileApprovals.approverEmail, callerEmail)));
+        });
         // WITH the caller as viewer: these approvals go straight back to the UI
         // that just clicked, and omitting the viewer computed every
         // `viewerCanApprove` as false — one approval made the apply button and