@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/workflow/pending-commits.worker.js

@@ -7,23 +7,30 @@
  *
  * Design context: `lock-decoupling-plan.md`.
  *
- * One worker per backend process; we don't currently run multi-replica
- * backends, so a single drain loop is fine. The `claimNext` SQL uses
- * `FOR UPDATE SKIP LOCKED` so a future multi-replica deployment can run
- * multiple workers without double-processing rows.
+ * One worker DRAINS at a time across the deployment: the process holding the
+ * commit-worker lease (see `core/lifecycle.ts`) runs this loop, any other
+ * process serves requests and waits for the lease. The `claimNext` SQL uses
+ * `FOR UPDATE SKIP LOCKED` as a second line — two claimers can never take one
+ * row — but the lease is what keeps two processes out of one working tree.
  *
- * Concurrency: at most one commit in flight at a time across all
- * workspaces. We could parallelise across workspaces (different
- * `mutex.run` keys), but the current commit volume is comfortably
- * sequential and the simpler shape catches more potential bugs.
+ * Concurrency WITHIN the worker is across workspaces, never within one. Each
+ * workspace's rows drain in order, one commit in flight, because they share a
+ * clone and the mutex that serializes git on it; different workspaces are
+ * different clones, and up to {@link MAX_CONCURRENT_WORKSPACES} of them drain
+ * side by side. The point is containment: a remote that has stopped answering
+ * costs its own workspace the git deadline, and nobody else anything. It used
+ * to cost everyone — the loop was single-flight across all workspaces, so one
+ * stalled push parked every other user's save behind it.
  */
-import { BACKOFF_MS, N_RECOVERY, N_TRANSIENT } from './pending-commits.service.js';
+import { logger } from '../../shared/logging.js';
+const log = logger('pending-commits');
+import { BACKOFF_MS, N_RECOVERY, N_TRANSIENT, canonicalWorkspaceId, } from './pending-commits.service.js';
 import { sanitizeError } from './sanitize-error.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 /** Core default: terminal-failure notices go to stderr (no dashboard). */
 export const consoleSystemNoticeSink = {
     async send(notice) {
-        console.error(`[system-notice] ${notice.user.email}: ${notice.message}`);
+        logger('system-notice').error(`${notice.user.email}: ${notice.message}`);
     },
 };
 /**
@@ -34,13 +41,24 @@ export const consoleSystemNoticeSink = {
 const POLL_INTERVAL_MS = 500;
 /**
  * Ceiling on rows drained from ONE workspace before the sweep moves on.
- * Fairness, not throughput: the loop holds the single in-flight commit slot,
- * so an unbounded drain would let one workspace's thousand-file migration
- * stall every other user's save until it finished. At this size a normal
- * bulk change (tens of files) still lands in one sweep, and a huge one gives
- * way after a bounded stretch and resumes on the next pass.
+ * Fairness, not throughput: a workspace being drained holds one of the
+ * in-flight slots, so an unbounded drain would let one workspace's
+ * thousand-file migration keep that slot from every other user's save until
+ * it finished. At this size a normal bulk change (tens of files) still lands
+ * in one sweep, and a huge one gives way after a bounded stretch and resumes
+ * on the next pass.
  */
 const MAX_BURST_PER_WORKSPACE = 50;
+/**
+ * How many WORKSPACES drain at once. Each in-flight commit is a git process
+ * (and, on push, a network round-trip), so this is also the ceiling on
+ * concurrent git the worker can spawn. Four is enough that one unresponsive
+ * remote — or four — leaves other workspaces draining, and small enough that
+ * a busy deployment's saves do not turn into a fork storm on the host that
+ * every other request shares. Within a workspace nothing changes: rows drain
+ * in order, because they share a clone.
+ */
+const MAX_CONCURRENT_WORKSPACES = 4;
 export class PendingCommitsWorker {
     deps;
     running = false;
@@ -98,47 +116,74 @@ export class PendingCommitsWorker {
      * hand the same row back within the same sweep.
      */
     async drainOnce() {
-        for (const workspace of this.deps.workspaces.knownWorkspaces()) {
-            // Bail mid-sweep if stop() fired — the in-flight workspace gets
-            // to finish but we don't start a new one.
+        // Distinct CLONES, under one spelling each. `knownWorkspaces()` reports
+        // encoded ids and the queue stores the canonical form, but the invariant
+        // the whole worker rests on — one clone is never worked by two drains at
+        // once — must not depend on where an id came from. Two spellings of one
+        // workspace here would be two concurrent drains of one working tree, which
+        // is exactly the interleaving the mutex exists to prevent and the reason
+        // the id is canonicalized BEFORE anything runs side by side.
+        const ids = [...new Set([...this.deps.workspaces.knownWorkspaces()].map((w) => canonicalWorkspaceId(w.id)))];
+        const queue = ids;
+        const slots = Math.min(MAX_CONCURRENT_WORKSPACES, queue.length);
+        await Promise.all(Array.from({ length: slots }, async () => {
+            // Bail between workspaces if stop() fired — the in-flight workspace
+            // gets to finish but no new one is started.
+            while (this.running) {
+                const id = queue.shift();
+                if (id === undefined)
+                    return;
+                // Contained here, in the slot: a rejection that escaped would settle
+                // the `Promise.all` below while the other slots were still draining,
+                // and the loop would start the next pass — and possibly the same
+                // clone — alongside them. The failure is the workspace's, logged;
+                // the pass ends when every slot has.
+                try {
+                    await this.drainWorkspace(id);
+                }
+                catch (err) {
+                    log.error(`drain failed for ws=${id}; its rows wait for the next pass:`, { err });
+                }
+            }
+        }));
+    }
+    /** Drain one workspace's ready rows, in order, up to the burst ceiling. */
+    async drainWorkspace(workspaceId) {
+        for (let drained = 0; drained < MAX_BURST_PER_WORKSPACE; drained += 1) {
             if (!this.running)
                 return;
-            for (let drained = 0; drained < MAX_BURST_PER_WORKSPACE; drained += 1) {
-                if (!this.running)
-                    return;
-                const row = await this.deps.service.claimNext(workspace.id, this.deps.now());
-                if (!row)
-                    break;
-                // Is this the last commit of the burst? Everything before it can skip
-                // the advisory commit validator, which parses the whole KB to produce
-                // a report that is only logged. Running it per file made a bulk change
-                // pay one full parse per commit; running it on the last one reports
-                // the same end state once. Asked AFTER the claim, so the row in hand
-                // is already out of `pending` and cannot answer for itself.
-                //
-                // At the burst ceiling this IS the last commit of the pass, however
-                // many rows remain queued — so it must validate, or a backlog larger
-                // than the cap would end every sweep on a skipped validation. Known
-                // without asking, so the ceiling is checked BEFORE the peek rather
-                // than folded in after it: on a big backlog that would be one wasted
-                // round-trip per sweep, on the hot path this change exists to speed up.
-                let lastOfBurst = drained === MAX_BURST_PER_WORKSPACE - 1;
-                if (!lastOfBurst) {
-                    // The peek is an OPTIMISATION, never a gate: the row is already
-                    // claimed and `running`, and throwing here would abandon it in that
-                    // state — nothing resets it, so the workspace would stop draining
-                    // until the process restarted. A failed peek therefore means
-                    // "assume last", costing one extra validation pass and nothing else.
-                    try {
-                        lastOfBurst = !(await this.deps.service.hasReadyRow(workspace.id, this.deps.now()));
-                    }
-                    catch (peekErr) {
-                        console.warn(`[pending-commits] ready-row peek failed for ws=${workspace.id}; validating this commit: ${sanitizeError(peekErr)}`);
-                        lastOfBurst = true;
-                    }
+            const row = await this.deps.service.claimNext(workspaceId, this.deps.now());
+            if (!row)
+                break;
+            // Is this the last commit of the burst? Everything before it can skip
+            // the advisory commit validator, which parses the whole KB to produce
+            // a report that is only logged. Running it per file made a bulk change
+            // pay one full parse per commit; running it on the last one reports
+            // the same end state once. Asked AFTER the claim, so the row in hand
+            // is already out of `pending` and cannot answer for itself.
+            //
+            // At the burst ceiling this IS the last commit of the pass, however
+            // many rows remain queued — so it must validate, or a backlog larger
+            // than the cap would end every sweep on a skipped validation. Known
+            // without asking, so the ceiling is checked BEFORE the peek rather
+            // than folded in after it: on a big backlog that would be one wasted
+            // round-trip per sweep, on the hot path this change exists to speed up.
+            let lastOfBurst = drained === MAX_BURST_PER_WORKSPACE - 1;
+            if (!lastOfBurst) {
+                // The peek is an OPTIMISATION, never a gate: the row is already
+                // claimed and `running`, and throwing here would abandon it in that
+                // state — nothing resets it, so the workspace would stop draining
+                // until the process restarted. A failed peek therefore means
+                // "assume last", costing one extra validation pass and nothing else.
+                try {
+                    lastOfBurst = !(await this.deps.service.hasReadyRow(workspaceId, this.deps.now()));
+                }
+                catch (peekErr) {
+                    log.warn(`ready-row peek failed for ws=${workspaceId}; validating this commit: ${sanitizeError(peekErr)}`);
+                    lastOfBurst = true;
                 }
-                await this.processRow(row, { skipValidation: !lastOfBurst });
             }
+            await this.processRow(row, { skipValidation: !lastOfBurst });
         }
     }
     async runLoop() {
@@ -150,7 +195,7 @@ export class PendingCommitsWorker {
                 // A throw out of drainOnce means something inside the loop
                 // itself failed — claimNext, processRow's outer scope, etc.
                 // Log loudly and keep looping; the next pass may succeed.
-                console.error('[pending-commits] worker loop iteration threw:', err instanceof Error ? err.stack ?? err.message : err);
+                log.error('worker loop iteration threw:', { err });
             }
             if (!this.running)
                 break;
@@ -216,7 +261,7 @@ export class PendingCommitsWorker {
                 // Transient — back off and retry on the next sweep that finds
                 // the backoff elapsed.
                 await this.deps.service.markTransientFailure(row.id, message);
-                console.warn(`[pending-commits] transient failure ws=${row.workspaceId} branch=${row.branch} path=${row.path} attempt=${nextAttempts}/${N_TRANSIENT}: ${message}`);
+                log.warn(`transient failure ws=${row.workspaceId} branch=${row.branch} path=${row.path} attempt=${nextAttempts}/${N_TRANSIENT}: ${message}`);
                 return;
             }
             if (row.recoveryAgentRuns < N_RECOVERY) {
@@ -224,7 +269,7 @@ export class PendingCommitsWorker {
                 // markRecoveryStarted resets `attempts` so the post-recovery
                 // commits get a fresh transient budget.
                 await this.deps.service.markRecoveryStarted(row.id);
-                console.warn(`[pending-commits] transient budget exhausted ws=${row.workspaceId} branch=${row.branch} path=${row.path}; spawning recovery agent (run ${row.recoveryAgentRuns + 1}/${N_RECOVERY}): ${message}`);
+                log.warn(`transient budget exhausted ws=${row.workspaceId} branch=${row.branch} path=${row.path}; spawning recovery agent (run ${row.recoveryAgentRuns + 1}/${N_RECOVERY}): ${message}`);
                 try {
                     await this.deps.recoveryAgent.run({
                         workspaceId: row.workspaceId,
@@ -240,7 +285,9 @@ export class PendingCommitsWorker {
                     // the agent finishing without resolving the issue — the row
                     // stays `pending` and the next worker pass will hit the same
                     // underlying error or escalate after another recovery cycle.
-                    console.error(`[pending-commits] recovery agent threw for ws=${row.workspaceId} path=${row.path}:`, sanitizeError(agentErr));
+                    log.error(`recovery agent threw for ws=${row.workspaceId} path=${row.path}:`, {
+                        detail: sanitizeError(agentErr),
+                    });
                 }
                 return;
             }
@@ -255,7 +302,7 @@ export class PendingCommitsWorker {
      */
     async escalate(row, message, notice, why) {
         await this.deps.service.markNeedsAttention(row.id, message);
-        console.error(`[pending-commits] TERMINAL ws=${row.workspaceId} branch=${row.branch} path=${row.path} ${why}: ${message}`);
+        log.error(`TERMINAL ws=${row.workspaceId} branch=${row.branch} path=${row.path} ${why}: ${message}`);
         try {
             await this.deps.feedback.send({
                 source: 'system',
@@ -268,7 +315,9 @@ export class PendingCommitsWorker {
             // failure — the row is already `needs_attention` and the next
             // process restart will keep logging it. Just note that the
             // notice didn't reach the dashboard.
-            console.error(`[pending-commits] failed to emit terminal-failure feedback notice for ws=${row.workspaceId} path=${row.path}:`, sanitizeError(feedbackErr));
+            log.error(`failed to emit terminal-failure feedback notice for ws=${row.workspaceId} path=${row.path}:`, {
+                detail: sanitizeError(feedbackErr),
+            });
         }
     }
 }

package/dist/modules/workflow/pending-commits.worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-commits.worker.js","sourceRoot":"","sources":["../../../src/modules/workflow/pending-commits.worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAiBpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,KAAK,CAAC,IAAI,CAAC,MAAM;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,EAAE,CAAC;AA8EnC,MAAM,OAAO,oBAAoB;IACd,IAAI,CAEnB;IACM,OAAO,GAAG,KAAK,CAAC;IAChB,WAAW,GAAyB,IAAI,CAAC;IACzC,UAAU,GAAmC,IAAI,CAAC;IAE1D,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,GAAG;YACV,GAAG,IAAI;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;SAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,MAAM,EAAE,CAAC;QACX,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,SAAS;QACb,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC;YAC/D,gEAAgE;YAChE,0CAA0C;YAC1C,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC,GAAG;oBAAE,MAAM;gBAChB,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,4DAA4D;gBAC5D,EAAE;gBACF,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,IAAI,WAAW,GAAG,OAAO,KAAK,uBAAuB,GAAG,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,gEAAgE;oBAChE,oEAAoE;oBACpE,kEAAkE;oBAClE,6DAA6D;oBAC7D,qEAAqE;oBACrE,IAAI,CAAC;wBACH,WAAW,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACtF,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CACV,kDAAkD,SAAS,CAAC,EAAE,6BAA6B,aAAa,CAAC,OAAO,CAAC,EAAE,CACpH,CAAC;wBACF,WAAW,GAAG,IAAI,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0DAA0D;gBAC1D,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACtD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,UAAU,CAAC,GAAkB,EAAE,IAAmC;QAC9E,MAAM,IAAI,GAAa;YACrB,oEAAoE;YACpE,yEAAyE;YACzE,mEAAmE;YACnE,6CAA6C;YAC7C,EAAE,EAAE,yBAAyB,GAAG,CAAC,WAAW,EAAE;YAC9C,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,IAAI,EAAE,GAAG,CAAC,UAAU;SACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE;gBACrF,cAAc,EAAE,IAAI,EAAE,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAEnC,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,mEAAmE;gBACnE,qDAAqD;gBACrD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,6BAA6B,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YAEtC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,uBAAuB;gBACvB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,YAAY,YAAY,IAAI,WAAW,KAAK,OAAO,EAAE,CACrJ,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;gBACvC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,wCAAwC;gBACxC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,CACV,mDAAmD,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,kCAAkC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,UAAU,MAAM,OAAO,EAAE,CACjM,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;wBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,SAAS,EAAE,OAAO;wBAClB,mBAAmB,EAAE,GAAG,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,8DAA8D;oBAC9D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,OAAO,CAAC,KAAK,CACX,iDAAiD,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EACpF,aAAa,CAAC,QAAQ,CAAC,CACxB,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,wCAAwC;YACxC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,UAAU,gBAAgB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAkB,EAAE,OAAe,EAAE,MAAc,EAAE,GAAW;QACrF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CACX,iCAAiC,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,OAAO,EAAE,CAC5G,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAC3B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,qCAAqC;YACrC,OAAO,CAAC,KAAK,CACX,4EAA4E,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EAC/G,aAAa,CAAC,WAAW,CAAC,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,CAAC,CAAC,GAAG,YAAY,mBAAmB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB,EAAE,KAAa,EAAE,SAAiB;IAC3E,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,cAAc,GAAG,CAAC,WAAW,EAAE;QAC/B,cAAc,GAAG,CAAC,MAAM,EAAE;QAC1B,cAAc,GAAG,CAAC,IAAI,EAAE;QACxB,gBAAgB,SAAS,EAAE;QAC3B,oBAAoB,GAAG,CAAC,WAAW,EAAE;QACrC,cAAc,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE;QAC1C,UAAU,KAAK,EAAE;QACjB,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,EAAE;QACF,mBAAmB;QACnB,yBAAyB,SAAS,yCAAyC;QAC3E,yBAAyB;QACzB,+CAA+C;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB,EAAE,KAAa;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO;QACL,mDAAmD,UAAU,qBAAqB;QAClF,EAAE;QACF,cAAc,GAAG,CAAC,WAAW,EAAE;QAC/B,cAAc,GAAG,CAAC,MAAM,EAAE;QAC1B,cAAc,GAAG,CAAC,IAAI,EAAE;QACxB,oBAAoB,GAAG,CAAC,WAAW,EAAE;QACrC,cAAc,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,OAAO;QAC3D,eAAe,KAAK,EAAE;QACtB,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,SAAS,UAAU,yBAAyB;QAC5C,EAAE;QACF,uBAAuB;QACvB,0DAA0D;QAC1D,uDAAuD;QACvD,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,qEAAqE;AACrE,0DAA0D;AAC1D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"pending-commits.worker.js","sourceRoot":"","sources":["../../../src/modules/workflow/pending-commits.worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAMtC,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAiBpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,KAAK,CAAC,IAAI,CAAC,MAAM;QACf,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AA8EpC,MAAM,OAAO,oBAAoB;IACd,IAAI,CAEnB;IACM,OAAO,GAAG,KAAK,CAAC;IAChB,WAAW,GAAyB,IAAI,CAAC;IACzC,UAAU,GAAmC,IAAI,CAAC;IAE1D,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,GAAG;YACV,GAAG,IAAI;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;SAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,MAAM,EAAE,CAAC;QACX,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,SAAS;QACb,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,GAAG,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;YACvC,oEAAoE;YACpE,4CAA4C;YAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,IAAI,EAAE,KAAK,SAAS;oBAAE,OAAO;gBAC7B,qEAAqE;gBACrE,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,qCAAqC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,cAAc,CAAC,WAAmB;QAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,4DAA4D;YAC5D,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,wEAAwE;YACxE,IAAI,WAAW,GAAG,OAAO,KAAK,uBAAuB,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,gEAAgE;gBAChE,oEAAoE;gBACpE,kEAAkE;gBAClE,6DAA6D;gBAC7D,qEAAqE;gBACrE,IAAI,CAAC;oBACH,WAAW,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrF,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,GAAG,CAAC,IAAI,CAAC,gCAAgC,WAAW,6BAA6B,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC3G,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0DAA0D;gBAC1D,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,UAAU,CAAC,GAAkB,EAAE,IAAmC;QAC9E,MAAM,IAAI,GAAa;YACrB,oEAAoE;YACpE,yEAAyE;YACzE,mEAAmE;YACnE,6CAA6C;YAC7C,EAAE,EAAE,yBAAyB,GAAG,CAAC,WAAW,EAAE;YAC9C,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,IAAI,EAAE,GAAG,CAAC,UAAU;SACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE;gBACrF,cAAc,EAAE,IAAI,EAAE,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAEnC,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,mEAAmE;gBACnE,qDAAqD;gBACrD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,6BAA6B,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YAEtC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,uBAAuB;gBACvB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,CACN,wBAAwB,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,YAAY,YAAY,IAAI,WAAW,KAAK,OAAO,EAAE,CACnI,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;gBACvC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,wCAAwC;gBACxC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,IAAI,CACN,iCAAiC,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,kCAAkC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,UAAU,MAAM,OAAO,EAAE,CAC/K,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;wBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,SAAS,EAAE,OAAO;wBAClB,mBAAmB,EAAE,GAAG,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,8DAA8D;oBAC9D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,GAAG,CAAC,KAAK,CAAC,+BAA+B,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EAAE;wBAC5E,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;qBAChC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YAED,wCAAwC;YACxC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,UAAU,gBAAgB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAkB,EAAE,OAAe,EAAE,MAAc,EAAE,GAAW;QACrF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAC3B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,qCAAqC;YACrC,GAAG,CAAC,KAAK,CAAC,0DAA0D,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EAAE;gBACvG,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,CAAC,CAAC,GAAG,YAAY,mBAAmB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB,EAAE,KAAa,EAAE,SAAiB;IAC3E,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,cAAc,GAAG,CAAC,WAAW,EAAE;QAC/B,cAAc,GAAG,CAAC,MAAM,EAAE;QAC1B,cAAc,GAAG,CAAC,IAAI,EAAE;QACxB,gBAAgB,SAAS,EAAE;QAC3B,oBAAoB,GAAG,CAAC,WAAW,EAAE;QACrC,cAAc,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE;QAC1C,UAAU,KAAK,EAAE;QACjB,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,EAAE;QACF,mBAAmB;QACnB,yBAAyB,SAAS,yCAAyC;QAC3E,yBAAyB;QACzB,+CAA+C;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB,EAAE,KAAa;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO;QACL,mDAAmD,UAAU,qBAAqB;QAClF,EAAE;QACF,cAAc,GAAG,CAAC,WAAW,EAAE;QAC/B,cAAc,GAAG,CAAC,MAAM,EAAE;QAC1B,cAAc,GAAG,CAAC,IAAI,EAAE;QACxB,oBAAoB,GAAG,CAAC,WAAW,EAAE;QACrC,cAAc,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,OAAO;QAC3D,eAAe,KAAK,EAAE;QACtB,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,SAAS,UAAU,yBAAyB;QAC5C,EAAE;QACF,uBAAuB;QACvB,0DAA0D;QAC1D,uDAAuD;QACvD,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,qEAAqE;AACrE,0DAA0D;AAC1D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}

package/dist/modules/workflow/recovery-bot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-bot.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,eAAO,MAAM,kBAAkB,QAEhB,CAAC;AAEhB,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmC3E"}
+{"version":3,"file":"recovery-bot.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,eAAO,MAAM,kBAAkB,QAEhB,CAAC;AAEhB,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmC3E"}

package/dist/modules/workflow/recovery-bot.js

@@ -16,6 +16,8 @@
  * `RECOVERY_BOT_EMAIL` env override mirrors `ROUTINE_BOT_EMAIL`.
  */
 import { eq } from 'drizzle-orm';
+import { logger } from '../../shared/logging.js';
+const log = logger('pending-commits');
 import { users } from '../database/schema.js';
 export const RECOVERY_BOT_EMAIL = (process.env.RECOVERY_BOT_EMAIL ?? 'recovery-bot@bevel.local').toLowerCase();
 export const RECOVERY_BOT_NAME = 'Bevel Recovery Bot';
@@ -35,7 +37,7 @@ export async function ensureRecoveryBotUser(db) {
         .returning();
     if (inserted.length > 0) {
         const row = inserted[0];
-        console.log(`[pending-commits] created recovery-bot user id=${row.id} email=${row.email}`);
+        log.info(`created recovery-bot user id=${row.id} email=${row.email}`);
         return {
             id: row.id,
             email: row.email,

package/dist/modules/workflow/recovery-bot.js.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-bot.js","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,0BAA0B,CAC7D,CAAC,WAAW,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAY;IACtD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;SAC5C,SAAS,EAAE,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,kDAAkD,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,uEAAuE;QACvE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,IAAI,KAAK,CACb,sBAAsB,kBAAkB,qDAAqD,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"recovery-bot.js","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAGtC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,0BAA0B,CAC7D,CAAC,WAAW,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAY;IACtD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;SAC5C,SAAS,EAAE,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,uEAAuE;QACvE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,IAAI,KAAK,CACb,sBAAsB,kBAAkB,qDAAqD,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC"}

package/dist/modules/workflow/review-workflow/approval-lock.d.ts

@@ -0,0 +1,60 @@
+import type { Database } from '../../database/connection.js';
+/**
+ * How long a per-request approval write waits before giving up.
+ *
+ * Every body under this lock is a statement or two against rows already in
+ * cache, so a wait anywhere near this is a stuck holder rather than a busy
+ * one — and waiting a stuck holder out would pin a pooled connection for as
+ * long as it lasts, which is how one wedged transaction becomes a backend with
+ * no connections left. Five seconds is far past honest contention and far
+ * short of that.
+ */
+export declare const APPROVAL_LOCK_TIMEOUT_MS = 5000;
+/**
+ * The same, for erasure — longer, because erasure must not fail over ordinary
+ * contention. It waits out every per-request writer in flight (each of them
+ * sub-second, and bounded by the timeout above), and gives up only on a holder
+ * that has genuinely wedged. Its transaction is atomic, so giving up erases
+ * nothing and the operator simply runs it again.
+ */
+export declare const ERASURE_LOCK_TIMEOUT_MS = 30000;
+/** The handle `db.transaction` hands its callback — a `Database` minus the pool. */
+export type ApprovalTx = Parameters<Parameters<Database['transaction']>[0]>[0];
+/**
+ * Whether a rejection is that timeout. The driver surfaces the SQLSTATE on the
+ * error itself today; `cause` is checked too so a driver that starts wrapping
+ * its errors does not turn a retryable refusal back into a bare 500.
+ */
+export declare function isApprovalLockTimeout(err: unknown): boolean;
+/**
+ * Claim one change request's approvals for the rest of `tx`.
+ *
+ * Shared on the every-request key first, then exclusive on this request's:
+ * writers of different requests run side by side, writers of the same one
+ * queue, and an erasure waits for all of them before it starts. The order is
+ * the same in both directions of this file, which is what keeps the pair
+ * deadlock-free.
+ *
+ * Call it as the first thing in the transaction, before any row is read: each
+ * statement in a READ COMMITTED transaction takes a fresh snapshot, so a
+ * select made after the lock sees everything the previous holder committed,
+ * while one made before it sees a world that may already be gone.
+ */
+export declare function takeApprovalLock(tx: ApprovalTx, prNumber: number): Promise<void>;
+/**
+ * Claim the approvals of EVERY change request for the rest of `tx` — account
+ * erasure, whose rewrite is keyed by a person rather than by a request.
+ *
+ * Exclusive on the every-request key: it waits for every per-request writer in
+ * flight and holds the rest off until the erasure commits. Without it, a
+ * carry-forward that read an approval a moment earlier would re-insert the
+ * erased address onto the new head, after the statement that was supposed to
+ * be the last trace of it.
+ *
+ * Take it BEFORE the statement that anonymizes the rows, not at the top of the
+ * transaction: what it has to cover is that rewrite and everything after it,
+ * and starting later is that many fewer milliseconds of approvals queueing
+ * behind an erasure.
+ */
+export declare function takeEveryApprovalLock(tx: ApprovalTx): Promise<void>;
+//# sourceMappingURL=approval-lock.d.ts.map

package/dist/modules/workflow/review-workflow/approval-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-lock.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/approval-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AA2C7D;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAI9C,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAK3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE"}

package/dist/modules/workflow/review-workflow/approval-lock.js

@@ -0,0 +1,116 @@
+import { sql } from 'drizzle-orm';
+/**
+ * The lock every writer of `pr_file_approvals` takes, and the one thing that
+ * orders them against each other.
+ *
+ * Three writers exist, in two different modules: a change request bringing
+ * itself up to date copies the approvals its merge did not disturb onto the
+ * new head, a reviewer approves or revokes one file, and account erasure
+ * rewrites an erased person's name and address out of every row they ever
+ * approved. Any two of those interleaved lose something real — a revoke that
+ * comes back, an approval pinned to a head that has already gone, or an erased
+ * address re-inserted onto a new head by a copy that read it a moment before
+ * the erasure landed.
+ *
+ * In the DATABASE, not in this process: two app instances share the rows but
+ * not a mutex.
+ *
+ * WHY NOT `AdvisoryLock` (see `modules/database/advisory-lock.ts`). That
+ * registry keys every lock it owns as (its shared namespace, one id per
+ * concern), which spends the second slot on naming the concern. These locks
+ * need that slot for the change request: approvals of #12 must not queue
+ * behind approvals of #13. Sharing the registry's namespace would put a
+ * request number where its lock ids live, so the approvals of change request
+ * #1 would BE the `Migrations` lock and #3's the `CommitWorker` lease — a
+ * boot migration and a reviewer clicking Approve, excluding each other for no
+ * reason anyone could find from either side. Hence a class of this file's own,
+ * with the request number beneath it. The registry's rule still holds within
+ * it: the two keys below are the whole set, and a third belongs here beside
+ * them rather than as a number at a call site.
+ */
+const APPROVAL_LOCK_CLASS = 4207;
+/**
+ * The key that means EVERY change request. Change request numbers start at 1,
+ * so nothing else claims it.
+ *
+ * Held shared by the per-request writers — they do not exclude each other, the
+ * per-request key does that — and exclusively by the one writer whose reach is
+ * every request at once. That is what makes "all approvals of this person" a
+ * single serialized step rather than a race against whichever copy happens to
+ * be in flight.
+ */
+const EVERY_REQUEST = 0;
+/**
+ * How long a per-request approval write waits before giving up.
+ *
+ * Every body under this lock is a statement or two against rows already in
+ * cache, so a wait anywhere near this is a stuck holder rather than a busy
+ * one — and waiting a stuck holder out would pin a pooled connection for as
+ * long as it lasts, which is how one wedged transaction becomes a backend with
+ * no connections left. Five seconds is far past honest contention and far
+ * short of that.
+ */
+export const APPROVAL_LOCK_TIMEOUT_MS = 5_000;
+/**
+ * The same, for erasure — longer, because erasure must not fail over ordinary
+ * contention. It waits out every per-request writer in flight (each of them
+ * sub-second, and bounded by the timeout above), and gives up only on a holder
+ * that has genuinely wedged. Its transaction is atomic, so giving up erases
+ * nothing and the operator simply runs it again.
+ */
+export const ERASURE_LOCK_TIMEOUT_MS = 30_000;
+/** `lock_timeout` fired — Postgres `lock_not_available`. */
+const LOCK_NOT_AVAILABLE = '55P03';
+/**
+ * Whether a rejection is that timeout. The driver surfaces the SQLSTATE on the
+ * error itself today; `cause` is checked too so a driver that starts wrapping
+ * its errors does not turn a retryable refusal back into a bare 500.
+ */
+export function isApprovalLockTimeout(err) {
+    for (let e = err, depth = 0; e && depth < 3; e = e.cause, depth++) {
+        if (e.code === LOCK_NOT_AVAILABLE)
+            return true;
+    }
+    return false;
+}
+/**
+ * Claim one change request's approvals for the rest of `tx`.
+ *
+ * Shared on the every-request key first, then exclusive on this request's:
+ * writers of different requests run side by side, writers of the same one
+ * queue, and an erasure waits for all of them before it starts. The order is
+ * the same in both directions of this file, which is what keeps the pair
+ * deadlock-free.
+ *
+ * Call it as the first thing in the transaction, before any row is read: each
+ * statement in a READ COMMITTED transaction takes a fresh snapshot, so a
+ * select made after the lock sees everything the previous holder committed,
+ * while one made before it sees a world that may already be gone.
+ */
+export async function takeApprovalLock(tx, prNumber) {
+    // SET takes no bind parameters, so the interval is rendered from a module
+    // constant — never from anything a caller supplies.
+    await tx.execute(sql.raw(`set local lock_timeout = ${APPROVAL_LOCK_TIMEOUT_MS}`));
+    await tx.execute(sql `select pg_advisory_xact_lock_shared(${APPROVAL_LOCK_CLASS}, ${EVERY_REQUEST})`);
+    await tx.execute(sql `select pg_advisory_xact_lock(${APPROVAL_LOCK_CLASS}, ${prNumber})`);
+}
+/**
+ * Claim the approvals of EVERY change request for the rest of `tx` — account
+ * erasure, whose rewrite is keyed by a person rather than by a request.
+ *
+ * Exclusive on the every-request key: it waits for every per-request writer in
+ * flight and holds the rest off until the erasure commits. Without it, a
+ * carry-forward that read an approval a moment earlier would re-insert the
+ * erased address onto the new head, after the statement that was supposed to
+ * be the last trace of it.
+ *
+ * Take it BEFORE the statement that anonymizes the rows, not at the top of the
+ * transaction: what it has to cover is that rewrite and everything after it,
+ * and starting later is that many fewer milliseconds of approvals queueing
+ * behind an erasure.
+ */
+export async function takeEveryApprovalLock(tx) {
+    await tx.execute(sql.raw(`set local lock_timeout = ${ERASURE_LOCK_TIMEOUT_MS}`));
+    await tx.execute(sql `select pg_advisory_xact_lock(${APPROVAL_LOCK_CLASS}, ${EVERY_REQUEST})`);
+}
+//# sourceMappingURL=approval-lock.js.map

package/dist/modules/workflow/review-workflow/approval-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-lock.js","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/approval-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAKnC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,KAAK,IAAI,CAAC,GAAY,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,GAAI,CAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACpG,IAAK,CAAwB,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAc,EAAE,QAAgB;IACrE,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,wBAAwB,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,uCAAuC,mBAAmB,KAAK,aAAa,GAAG,CAAC,CAAC;IACrG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,gCAAgC,mBAAmB,KAAK,QAAQ,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAc;IACxD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,uBAAuB,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,gCAAgC,mBAAmB,KAAK,aAAa,GAAG,CAAC,CAAC;AAChG,CAAC"}

package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts

@@ -1,18 +1,30 @@
 import type { AuthUser, CancelPrResult, FileApprovalState, MergePrResult, PostPrCommentInput, PrReviewComment, PullRequestFile, PullRequestState } from '@bevel-software/platform-shared';
+import type { ApprovalTx } from './approval-lock.js';
+/**
+ * The transaction handle a caller outside this module hands `eraseApprover`.
+ * Re-exported so the caller depends on this contract alone, never on the lock
+ * file behind it.
+ */
+export type { ApprovalTx };
 export interface MergeGateInput {
     prNumber: number;
     state: PullRequestState;
     approvals: FileApprovalState[];
 }
 export interface MergeGateResult {
-    /** False only on hard blocks (PR closed/merged, zero files). Warnings do NOT flip this false. */
+    /** False while any reason remains — a hard block or a missing approval. */
     mergeable: boolean;
-    /** Hard-block reasons — merge cannot proceed until these resolve. */
+    /**
+     * Blocking reasons: hard blocks (PR closed/merged, zero files) followed by
+     * every missing approval. Merge cannot proceed until these resolve, except
+     * that an admin may bypass the missing approvals.
+     */
     reasons: string[];
     /**
-     * Soft warnings — md files with an owner who hasn't approved (or whose
-     * approval is stale). Merge proceeds only when the caller explicitly opts
-     * into bypass; the frontend surfaces these in a confirm dialog.
+     * The missing approvals alone — files of any type with an eligible approver
+     * who hasn't approved (or whose approval is stale). These are the part of
+     * `reasons` an admin may merge past with bypass; the bypassed list is
+     * recorded in the merge commit body.
      */
     warnings: string[];
 }
@@ -75,6 +87,20 @@ export interface IReviewWorkflowService {
      * composite state for all files.
      */
     approveFile(prNumber: number, path: string, user: AuthUser, files: PullRequestFile[], headSha: string, baseBranch: string, prAuthorIdHash: string | null, workspaceId: string): Promise<FileApprovalState[]>;
+    /**
+     * Re-pin the per-file approvals a commit did not disturb onto a new head.
+     *
+     * For the merge an update-from-target lands on a proposal's branch: the
+     * approvers did not make that commit, so voiding their approvals over files
+     * whose bytes it never touched would make every automatic update a second
+     * round of review. `changedPaths` is the content verdict — every path that
+     * differs between the two heads — and only a path absent from it keeps its
+     * approval. The approval RULE is unchanged: a row still counts only against
+     * the current head, and the author's own later commit still resets it.
+     *
+     * Idempotent; returns the number of rows written.
+     */
+    carryApprovalsForward(prNumber: number, fromHeadSha: string, toHeadSha: string, changedPaths: string[]): Promise<number>;
     /**
      * Revoke the caller's own approval on one file. Non-author users cannot
      * revoke someone else's approval (403). Idempotent when no matching
@@ -87,6 +113,27 @@ export interface IReviewWorkflowService {
      * merge route re-validate via the same code path.
      */
     evaluateMergeGate(input: MergeGateInput): MergeGateResult;
+    /**
+     * Rewrite one person out of every approval they ever made, as `erased`.
+     *
+     * Account erasure calls this INSIDE its own transaction (`tx`) rather than
+     * touching the rows itself, because this module owns them and the writers
+     * that race the rewrite are this module's: a reviewer approving or revoking
+     * one file, and a change request copying the approvals its update did not
+     * disturb onto its new head. Both take the approval lock; this takes it
+     * exclusively on every request at once, BEFORE the rewrite, and the caller's
+     * transaction keeps it held until the erasure commits — so a copy that read
+     * the row a moment earlier cannot re-insert the real address onto a new head
+     * after what was supposed to be the last trace of it.
+     *
+     * Bounded (`ERASURE_LOCK_TIMEOUT_MS`): a wedged holder fails the erasure
+     * loudly instead of hanging it, and since the caller's transaction is atomic
+     * a refusal erases nothing — the operator runs it again.
+     */
+    eraseApprover(tx: ApprovalTx, email: string, erased: {
+        email: string;
+        name: string;
+    }): Promise<void>;
     /**
      * Execute the merge via a local `git merge --no-ff` on the base branch's
      * workspace, pushed to origin (provider-agnostic — no PR API). Re-validates
@@ -107,8 +154,8 @@ export interface IReviewWorkflowService {
     /** Workspace clone — used for the access-tree lookup that gates bypass. */
     workspaceId: string, 
     /**
-     * When true, proceed even if soft warnings (unapproved md-with-owner files)
-     * exist. Hard blocks are refused regardless. The bypassed warnings are
+     * When true, proceed even if missing approvals (files of any type with an
+     * eligible approver who hasn't approved) exist. Hard blocks are refused regardless. The bypassed warnings are
      * recorded in the merge commit body for audit. Bypass requires admin
      * write access at `origin/<baseBranch>` (i.e. write on `roles.yaml`) —
      * non-admins get a 403 even when warnings would otherwise be skippable.