@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/src/modules/workflow/pending-commits.worker.ts

@@ -7,24 +7,37 @@
  *
  * Design context: `lock-decoupling-plan.md`.
  *
- * One worker per backend process; we don't currently run multi-replica
- * backends, so a single drain loop is fine. The `claimNext` SQL uses
- * `FOR UPDATE SKIP LOCKED` so a future multi-replica deployment can run
- * multiple workers without double-processing rows.
+ * One worker DRAINS at a time across the deployment: the process holding the
+ * commit-worker lease (see `core/lifecycle.ts`) runs this loop, any other
+ * process serves requests and waits for the lease. The `claimNext` SQL uses
+ * `FOR UPDATE SKIP LOCKED` as a second line — two claimers can never take one
+ * row — but the lease is what keeps two processes out of one working tree.
  *
- * Concurrency: at most one commit in flight at a time across all
- * workspaces. We could parallelise across workspaces (different
- * `mutex.run` keys), but the current commit volume is comfortably
- * sequential and the simpler shape catches more potential bugs.
+ * Concurrency WITHIN the worker is across workspaces, never within one. Each
+ * workspace's rows drain in order, one commit in flight, because they share a
+ * clone and the mutex that serializes git on it; different workspaces are
+ * different clones, and up to {@link MAX_CONCURRENT_WORKSPACES} of them drain
+ * side by side. The point is containment: a remote that has stopped answering
+ * costs its own workspace the git deadline, and nobody else anything. It used
+ * to cost everyone — the loop was single-flight across all workspaces, so one
+ * stalled push parked every other user's save behind it.
  */
 
 import type { AuthUser } from '@bevel-software/platform-shared';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('pending-commits');
 import type {
   PendingCommit,
   PendingCommitsService,
   WorkspaceDescriptor,
 } from './pending-commits.service.js';
-import { BACKOFF_MS, N_RECOVERY, N_TRANSIENT } from './pending-commits.service.js';
+import {
+  BACKOFF_MS,
+  N_RECOVERY,
+  N_TRANSIENT,
+  canonicalWorkspaceId,
+} from './pending-commits.service.js';
 import { sanitizeError } from './sanitize-error.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 
@@ -46,7 +59,7 @@ export interface ISystemNoticeSink {
 /** Core default: terminal-failure notices go to stderr (no dashboard). */
 export const consoleSystemNoticeSink: ISystemNoticeSink = {
   async send(notice) {
-    console.error(`[system-notice] ${notice.user.email}: ${notice.message}`);
+    logger('system-notice').error(`${notice.user.email}: ${notice.message}`);
   },
 };
 
@@ -59,14 +72,26 @@ const POLL_INTERVAL_MS = 500;
 
 /**
  * Ceiling on rows drained from ONE workspace before the sweep moves on.
- * Fairness, not throughput: the loop holds the single in-flight commit slot,
- * so an unbounded drain would let one workspace's thousand-file migration
- * stall every other user's save until it finished. At this size a normal
- * bulk change (tens of files) still lands in one sweep, and a huge one gives
- * way after a bounded stretch and resumes on the next pass.
+ * Fairness, not throughput: a workspace being drained holds one of the
+ * in-flight slots, so an unbounded drain would let one workspace's
+ * thousand-file migration keep that slot from every other user's save until
+ * it finished. At this size a normal bulk change (tens of files) still lands
+ * in one sweep, and a huge one gives way after a bounded stretch and resumes
+ * on the next pass.
  */
 const MAX_BURST_PER_WORKSPACE = 50;
 
+/**
+ * How many WORKSPACES drain at once. Each in-flight commit is a git process
+ * (and, on push, a network round-trip), so this is also the ceiling on
+ * concurrent git the worker can spawn. Four is enough that one unresponsive
+ * remote — or four — leaves other workspaces draining, and small enough that
+ * a busy deployment's saves do not turn into a fork storm on the host that
+ * every other request shares. Within a workspace nothing changes: rows drain
+ * in order, because they share a clone.
+ */
+const MAX_CONCURRENT_WORKSPACES = 4;
+
 /**
  * The recovery-agent dispatcher the worker calls when a row exhausts its
  * transient budget. Pulled behind an interface so the unit tests can
@@ -204,45 +229,72 @@ export class PendingCommitsWorker {
    * hand the same row back within the same sweep.
    */
   async drainOnce(): Promise<void> {
-    for (const workspace of this.deps.workspaces.knownWorkspaces()) {
-      // Bail mid-sweep if stop() fired — the in-flight workspace gets
-      // to finish but we don't start a new one.
-      if (!this.running) return;
-      for (let drained = 0; drained < MAX_BURST_PER_WORKSPACE; drained += 1) {
-        if (!this.running) return;
-        const row = await this.deps.service.claimNext(workspace.id, this.deps.now());
-        if (!row) break;
-        // Is this the last commit of the burst? Everything before it can skip
-        // the advisory commit validator, which parses the whole KB to produce
-        // a report that is only logged. Running it per file made a bulk change
-        // pay one full parse per commit; running it on the last one reports
-        // the same end state once. Asked AFTER the claim, so the row in hand
-        // is already out of `pending` and cannot answer for itself.
-        //
-        // At the burst ceiling this IS the last commit of the pass, however
-        // many rows remain queued — so it must validate, or a backlog larger
-        // than the cap would end every sweep on a skipped validation. Known
-        // without asking, so the ceiling is checked BEFORE the peek rather
-        // than folded in after it: on a big backlog that would be one wasted
-        // round-trip per sweep, on the hot path this change exists to speed up.
-        let lastOfBurst = drained === MAX_BURST_PER_WORKSPACE - 1;
-        if (!lastOfBurst) {
-          // The peek is an OPTIMISATION, never a gate: the row is already
-          // claimed and `running`, and throwing here would abandon it in that
-          // state — nothing resets it, so the workspace would stop draining
-          // until the process restarted. A failed peek therefore means
-          // "assume last", costing one extra validation pass and nothing else.
+    // Distinct CLONES, under one spelling each. `knownWorkspaces()` reports
+    // encoded ids and the queue stores the canonical form, but the invariant
+    // the whole worker rests on — one clone is never worked by two drains at
+    // once — must not depend on where an id came from. Two spellings of one
+    // workspace here would be two concurrent drains of one working tree, which
+    // is exactly the interleaving the mutex exists to prevent and the reason
+    // the id is canonicalized BEFORE anything runs side by side.
+    const ids = [...new Set([...this.deps.workspaces.knownWorkspaces()].map((w) => canonicalWorkspaceId(w.id)))];
+    const queue = ids;
+    const slots = Math.min(MAX_CONCURRENT_WORKSPACES, queue.length);
+    await Promise.all(
+      Array.from({ length: slots }, async () => {
+        // Bail between workspaces if stop() fired — the in-flight workspace
+        // gets to finish but no new one is started.
+        while (this.running) {
+          const id = queue.shift();
+          if (id === undefined) return;
+          // Contained here, in the slot: a rejection that escaped would settle
+          // the `Promise.all` below while the other slots were still draining,
+          // and the loop would start the next pass — and possibly the same
+          // clone — alongside them. The failure is the workspace's, logged;
+          // the pass ends when every slot has.
           try {
-            lastOfBurst = !(await this.deps.service.hasReadyRow(workspace.id, this.deps.now()));
-          } catch (peekErr) {
-            console.warn(
-              `[pending-commits] ready-row peek failed for ws=${workspace.id}; validating this commit: ${sanitizeError(peekErr)}`,
-            );
-            lastOfBurst = true;
+            await this.drainWorkspace(id);
+          } catch (err) {
+            log.error(`drain failed for ws=${id}; its rows wait for the next pass:`, { err });
           }
         }
-        await this.processRow(row, { skipValidation: !lastOfBurst });
+      }),
+    );
+  }
+
+  /** Drain one workspace's ready rows, in order, up to the burst ceiling. */
+  private async drainWorkspace(workspaceId: string): Promise<void> {
+    for (let drained = 0; drained < MAX_BURST_PER_WORKSPACE; drained += 1) {
+      if (!this.running) return;
+      const row = await this.deps.service.claimNext(workspaceId, this.deps.now());
+      if (!row) break;
+      // Is this the last commit of the burst? Everything before it can skip
+      // the advisory commit validator, which parses the whole KB to produce
+      // a report that is only logged. Running it per file made a bulk change
+      // pay one full parse per commit; running it on the last one reports
+      // the same end state once. Asked AFTER the claim, so the row in hand
+      // is already out of `pending` and cannot answer for itself.
+      //
+      // At the burst ceiling this IS the last commit of the pass, however
+      // many rows remain queued — so it must validate, or a backlog larger
+      // than the cap would end every sweep on a skipped validation. Known
+      // without asking, so the ceiling is checked BEFORE the peek rather
+      // than folded in after it: on a big backlog that would be one wasted
+      // round-trip per sweep, on the hot path this change exists to speed up.
+      let lastOfBurst = drained === MAX_BURST_PER_WORKSPACE - 1;
+      if (!lastOfBurst) {
+        // The peek is an OPTIMISATION, never a gate: the row is already
+        // claimed and `running`, and throwing here would abandon it in that
+        // state — nothing resets it, so the workspace would stop draining
+        // until the process restarted. A failed peek therefore means
+        // "assume last", costing one extra validation pass and nothing else.
+        try {
+          lastOfBurst = !(await this.deps.service.hasReadyRow(workspaceId, this.deps.now()));
+        } catch (peekErr) {
+          log.warn(`ready-row peek failed for ws=${workspaceId}; validating this commit: ${sanitizeError(peekErr)}`);
+          lastOfBurst = true;
+        }
       }
+      await this.processRow(row, { skipValidation: !lastOfBurst });
     }
   }
 
@@ -254,10 +306,7 @@ export class PendingCommitsWorker {
         // A throw out of drainOnce means something inside the loop
         // itself failed — claimNext, processRow's outer scope, etc.
         // Log loudly and keep looping; the next pass may succeed.
-        console.error(
-          '[pending-commits] worker loop iteration threw:',
-          err instanceof Error ? err.stack ?? err.message : err,
-        );
+        log.error('worker loop iteration threw:', { err });
       }
       if (!this.running) break;
       await this.interruptibleSleep(POLL_INTERVAL_MS);
@@ -325,8 +374,8 @@ export class PendingCommitsWorker {
         // Transient — back off and retry on the next sweep that finds
         // the backoff elapsed.
         await this.deps.service.markTransientFailure(row.id, message);
-        console.warn(
-          `[pending-commits] transient failure ws=${row.workspaceId} branch=${row.branch} path=${row.path} attempt=${nextAttempts}/${N_TRANSIENT}: ${message}`,
+        log.warn(
+          `transient failure ws=${row.workspaceId} branch=${row.branch} path=${row.path} attempt=${nextAttempts}/${N_TRANSIENT}: ${message}`,
         );
         return;
       }
@@ -336,8 +385,8 @@ export class PendingCommitsWorker {
         // markRecoveryStarted resets `attempts` so the post-recovery
         // commits get a fresh transient budget.
         await this.deps.service.markRecoveryStarted(row.id);
-        console.warn(
-          `[pending-commits] transient budget exhausted ws=${row.workspaceId} branch=${row.branch} path=${row.path}; spawning recovery agent (run ${row.recoveryAgentRuns + 1}/${N_RECOVERY}): ${message}`,
+        log.warn(
+          `transient budget exhausted ws=${row.workspaceId} branch=${row.branch} path=${row.path}; spawning recovery agent (run ${row.recoveryAgentRuns + 1}/${N_RECOVERY}): ${message}`,
         );
         try {
           await this.deps.recoveryAgent.run({
@@ -353,10 +402,9 @@ export class PendingCommitsWorker {
           // the agent finishing without resolving the issue — the row
           // stays `pending` and the next worker pass will hit the same
           // underlying error or escalate after another recovery cycle.
-          console.error(
-            `[pending-commits] recovery agent threw for ws=${row.workspaceId} path=${row.path}:`,
-            sanitizeError(agentErr),
-          );
+          log.error(`recovery agent threw for ws=${row.workspaceId} path=${row.path}:`, {
+            detail: sanitizeError(agentErr),
+          });
         }
         return;
       }
@@ -373,9 +421,7 @@ export class PendingCommitsWorker {
    */
   private async escalate(row: PendingCommit, message: string, notice: string, why: string): Promise<void> {
     await this.deps.service.markNeedsAttention(row.id, message);
-    console.error(
-      `[pending-commits] TERMINAL ws=${row.workspaceId} branch=${row.branch} path=${row.path} ${why}: ${message}`,
-    );
+    log.error(`TERMINAL ws=${row.workspaceId} branch=${row.branch} path=${row.path} ${why}: ${message}`);
     try {
       await this.deps.feedback.send({
         source: 'system',
@@ -387,10 +433,9 @@ export class PendingCommitsWorker {
       // failure — the row is already `needs_attention` and the next
       // process restart will keep logging it. Just note that the
       // notice didn't reach the dashboard.
-      console.error(
-        `[pending-commits] failed to emit terminal-failure feedback notice for ws=${row.workspaceId} path=${row.path}:`,
-        sanitizeError(feedbackErr),
-      );
+      log.error(`failed to emit terminal-failure feedback notice for ws=${row.workspaceId} path=${row.path}:`, {
+        detail: sanitizeError(feedbackErr),
+      });
     }
   }
 }

package/src/modules/workflow/recovery-bot.ts

@@ -17,6 +17,9 @@
  */
 
 import { eq } from 'drizzle-orm';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('pending-commits');
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { Database } from '../database/connection.js';
 import { users } from '../database/schema.js';
@@ -43,7 +46,7 @@ export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
     .returning();
   if (inserted.length > 0) {
     const row = inserted[0];
-    console.log(`[pending-commits] created recovery-bot user id=${row.id} email=${row.email}`);
+    log.info(`created recovery-bot user id=${row.id} email=${row.email}`);
     return {
       id: row.id,
       email: row.email,

package/src/modules/workflow/review-workflow/__tests__/approval-states.test.ts

@@ -12,7 +12,7 @@ import type { Database } from '../../../database/connection.js';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import type { GitService } from '../../git/git.service.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
-import { hashEmail as hash } from '../../../../shared/hash-email.js';
+import { hashEmail as hash } from '../../../../shared/email-identity.js';
 import { AccessUnreadableError } from '../../../access-model/access-errors.js';
 
 function file(overrides: Partial<PullRequestFile>): PullRequestFile {
@@ -234,6 +234,19 @@ describe('ReviewWorkflowService.getApprovalStates', () => {
     expect(states[0].eligibleApprovers.roles).toEqual([]);
     expect(states[0].eligibleApprovers.users).toEqual([]);
     expect(states[0].isApproved).toBe(false);
+    // Empty because it could not be resolved — not because nobody may write.
+    expect(states[0].eligibilityResolved).toBe(false);
+  });
+
+  it('a failed eligibility lookup is marked unresolved, not "outside the gate"', async () => {
+    const svc = makeService([], {});
+    const access = (svc as unknown as { accessControl: IAccessControl }).accessControl;
+    access.eligibleWritersForPathsAtRef = async () => {
+      throw new Error('git show timed out');
+    };
+    const states = await svc.getApprovalStates(1, [file({ path: 'Knowledge/Foo.md' })], HEAD, BASE, null, 'ws-1');
+    expect(states[0].eligibleApprovers.roles).toEqual([]);
+    expect(states[0].eligibilityResolved).toBe(false);
   });
 
   it('marks a file approved when an eligible approver has a non-stale approval', async () => {
@@ -358,6 +371,35 @@ describe('ReviewWorkflowService.getApprovalStates', () => {
     expect(states[0].eligibleApprovers.roles).toEqual([]);
     expect(states[0].eligibleApprovers.users).toEqual([]);
     expect(states[0].isApproved).toBe(false);
+    expect(states[0].inMergeGate).toBe(false);
+    // The tree answered: nobody may write it, so it truly is outside the gate.
+    expect(states[0].eligibilityResolved).toBe(true);
+  });
+
+  it('stamps each file with the gate\'s own relevance verdict', async () => {
+    const svc = makeService([], {
+      'Knowledge/Foo.md': ALICE_ELIGIBLE,
+      'assets/shot.png': ALICE_ELIGIBLE,
+      'roles.yaml': ALICE_ELIGIBLE,
+      'Knowledge/Ops/Makefile': ALICE_ELIGIBLE,
+    });
+    const states = await svc.getApprovalStates(
+      1,
+      [
+        file({ path: 'Knowledge/Foo.md' }),
+        file({ path: 'assets/shot.png', isBinary: true }),
+        file({ path: 'roles.yaml' }),
+        file({ path: 'Knowledge/Ops/Makefile' }),
+        file({ path: 'assets/unowned.bin', isBinary: true }),
+      ],
+      HEAD,
+      BASE,
+      null,
+      'ws-1',
+    );
+    // Every file with an eligible approver binds the gate, whatever its type;
+    // a file nobody can approve does not.
+    expect(states.map((s) => s.inMergeGate)).toEqual([true, true, true, true, false]);
   });
 
   it('flags self-approval via the authorId hash marker', async () => {
@@ -559,6 +601,143 @@ describe('mergePr — roles.yaml privilege-escalation guard', () => {
   });
 });
 
+/**
+ * The gate is extension-blind. Driven through the real path — getApprovalStates
+ * → evaluateMergeGate → mergePr — for an extensionless file, a binary file, a
+ * Markdown file and a mix: a missing approval makes the request non-mergeable
+ * and refuses a plain merge, an approval clears it, and an admin bypass merges
+ * past it with the bypassed files recorded in the merge commit body.
+ */
+describe('merge gate — every file type', () => {
+  beforeEach(() => {
+    mergeChangeRequestMock.mockClear();
+  });
+
+  const HEAD = 'head-sha-1';
+  const BASE = 'current-company-state';
+  const ADMIN = { id: 'u-alice', name: 'Alice', email: 'alice@bevel.software' };
+  const OWNER = { id: 'u-olga', name: 'Olga', email: 'olga@bevel.software' };
+  const AUTHOR = { id: 'u-mallory', name: 'Mallory', email: 'mallory@bevel.software' };
+  // Olga owns every Knowledge file; only Alice can write roles.yaml (admin).
+  const OWNED = { roles: ['Finance'], users: [], emails: [OWNER.email] };
+  const ELIGIBILITY = {
+    'roles.yaml': { roles: ['Admin'], users: [], emails: [ADMIN.email] },
+    'Knowledge/Ops/Makefile': OWNED,
+    'Knowledge/Finance/report.pdf': OWNED,
+    'Knowledge/Foo.md': OWNED,
+  };
+
+  const KINDS = {
+    extensionless: [file({ path: 'Knowledge/Ops/Makefile' })],
+    binary: [file({ path: 'Knowledge/Finance/report.pdf', isBinary: true, patch: undefined })],
+    markdown: [file({ path: 'Knowledge/Foo.md' })],
+    mixed: [
+      file({ path: 'Knowledge/Ops/Makefile' }),
+      file({ path: 'Knowledge/Finance/report.pdf', isBinary: true, patch: undefined }),
+      file({ path: 'Knowledge/Foo.md' }),
+    ],
+  } as const;
+
+  function approvalRows(files: readonly PullRequestFile[]): ApprovalRow[] {
+    return files.map((f) => ({
+      prNumber: 1,
+      path: f.path,
+      approverEmail: OWNER.email,
+      approverName: OWNER.name,
+      headSha: HEAD,
+      approvedAt: new Date('2026-09-17T12:00:00Z'),
+    }));
+  }
+
+  for (const [kind, files] of Object.entries(KINDS)) {
+    describe(`${kind} request`, () => {
+      it('without approvals: not mergeable, every file named, plain merge refused', async () => {
+        const svc = makeService([], ELIGIBILITY);
+        const approvals = await svc.getApprovalStates(1, [...files], HEAD, BASE, null, 'ws-1');
+        const gate = svc.evaluateMergeGate({ prNumber: 1, state: 'open', approvals });
+
+        const expected = files.map((f) => `Waiting on approval for ${f.path} from Finance.`);
+        expect(gate.mergeable).toBe(false);
+        expect(gate.reasons).toEqual(expected);
+        expect(gate.warnings).toEqual(expected);
+
+        await expect(
+          svc.mergePr(1, AUTHOR, HEAD, approvals, 'open', 'Update', BASE, 'ws-1'),
+        ).rejects.toMatchObject({ name: 'MergeBlockedError' });
+        expect(mergeChangeRequestMock).not.toHaveBeenCalled();
+      });
+
+      it('with approvals: mergeable, no reasons, merges without bypass', async () => {
+        const svc = makeService(approvalRows(files), ELIGIBILITY);
+        const approvals = await svc.getApprovalStates(1, [...files], HEAD, BASE, null, 'ws-1');
+        const gate = svc.evaluateMergeGate({ prNumber: 1, state: 'open', approvals });
+        expect(gate).toEqual({ mergeable: true, reasons: [], warnings: [] });
+
+        await svc.mergePr(1, AUTHOR, HEAD, approvals, 'open', 'Update', BASE, 'ws-1');
+        expect(mergeChangeRequestMock).toHaveBeenCalledTimes(1);
+        const [, , , message] = mergeChangeRequestMock.mock.calls[0] as unknown as [
+          string, string, string, { subject: string; body: string },
+        ];
+        expect(message.body).not.toMatch(/bypassed/);
+      });
+
+      it('with the bypass: an admin merges past the missing approvals, recorded in the commit', async () => {
+        const svc = makeService([], ELIGIBILITY);
+        const approvals = await svc.getApprovalStates(1, [...files], HEAD, BASE, null, 'ws-1');
+
+        await svc.mergePr(1, ADMIN, HEAD, approvals, 'open', 'Update', BASE, 'ws-1', { bypass: true });
+        expect(mergeChangeRequestMock).toHaveBeenCalledTimes(1);
+        const [, , , message] = mergeChangeRequestMock.mock.calls[0] as unknown as [
+          string, string, string, { subject: string; body: string },
+        ];
+        expect(message.body).toContain('Approval requirements bypassed:');
+        for (const f of files) {
+          expect(message.body).toContain(`- Waiting on approval for ${f.path} from Finance.`);
+        }
+      });
+
+      it('with the bypass: a non-admin is refused', async () => {
+        const svc = makeService([], ELIGIBILITY);
+        const approvals = await svc.getApprovalStates(1, [...files], HEAD, BASE, null, 'ws-1');
+
+        await expect(
+          svc.mergePr(1, OWNER, HEAD, approvals, 'open', 'Update', BASE, 'ws-1', { bypass: true }),
+        ).rejects.toMatchObject({ name: 'BypassAuthError' });
+        expect(mergeChangeRequestMock).not.toHaveBeenCalled();
+      });
+    });
+  }
+
+  it('a partly approved mix names only the unapproved files, and bypass records only those', async () => {
+    const files = KINDS.mixed;
+    const svc = makeService(approvalRows([files[2]]), ELIGIBILITY);
+    const approvals = await svc.getApprovalStates(1, [...files], HEAD, BASE, null, 'ws-1');
+    const gate = svc.evaluateMergeGate({ prNumber: 1, state: 'open', approvals });
+    expect(gate.mergeable).toBe(false);
+    expect(gate.reasons).toEqual([
+      'Waiting on approval for Knowledge/Ops/Makefile from Finance.',
+      'Waiting on approval for Knowledge/Finance/report.pdf from Finance.',
+    ]);
+
+    await svc.mergePr(1, ADMIN, HEAD, approvals, 'open', 'Update', BASE, 'ws-1', { bypass: true });
+    const [, , , message] = mergeChangeRequestMock.mock.calls[0] as unknown as [
+      string, string, string, { subject: string; body: string },
+    ];
+    expect(message.body).toContain('- Waiting on approval for Knowledge/Ops/Makefile from Finance.');
+    expect(message.body).toContain('- Waiting on approval for Knowledge/Finance/report.pdf from Finance.');
+    expect(message.body).not.toContain('Knowledge/Foo.md');
+  });
+
+  it('bypass never overrides a hard block, whatever the file type', async () => {
+    const svc = makeService([], ELIGIBILITY);
+    const approvals = await svc.getApprovalStates(1, [...KINDS.binary], HEAD, BASE, null, 'ws-1');
+    await expect(
+      svc.mergePr(1, ADMIN, HEAD, approvals, 'closed', 'Update', BASE, 'ws-1', { bypass: true }),
+    ).rejects.toMatchObject({ name: 'MergeBlockedError', message: 'Merge gate rejected: This pull request is closed.' });
+    expect(mergeChangeRequestMock).not.toHaveBeenCalled();
+  });
+});
+
 /**
  * An access tree that could not be READ is not the same as "no eligible
  * writers": the latter drops a file out of the merge gate, so answering it for

package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts

@@ -5,7 +5,7 @@ import type { Database } from '../../../database/connection.js';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import type { GitService } from '../../git/git.service.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
-import { hashEmail } from '../../../../shared/hash-email.js';
+import { hashEmail } from '../../../../shared/email-identity.js';
 import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 // Cancel is now a DB state flip (no `gh`): `update(change_requests) … WHERE