@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/src/modules/plugins/discovery/kb-plugin-source.ts

@@ -1,7 +1,8 @@
 import path from 'node:path';
-import { PLUGINS_DIR, PLUGIN_MANIFEST_FILE, pluginManifestName } from '@bevel-software/platform-shared';
+import { PLUGIN_MANIFEST_FILE, pluginManifestName, type KbLayout } from '@bevel-software/platform-shared';
 import type { DiscoveredPlugin, Discovery, PluginSource, PluginSourceWalk } from './plugin-source.js';
 import type { IFsProbe, ITreeWalker, WalkListener } from '../../../shared/fs.contract.js';
+import type { KbContext } from '../../../shared/kb-context.js';
 import { readNativePlugin } from './native.source.js';
 import { BUNDLE_FILE, loadRegistry, readBundlePlugin } from './bundle-dialect/bundle.source.js';
 import type { McpRegistry } from './bundle-dialect/registry.js';
@@ -38,7 +39,11 @@ import type { McpRegistry } from './bundle-dialect/registry.js';
 export class KbPluginSource implements PluginSource {
   readonly dialect = 'kb';
 
-  constructor(private readonly disk: ITreeWalker & IFsProbe) {}
+  constructor(
+    private readonly disk: ITreeWalker & IFsProbe,
+    /** Read per walk, never captured: the plugins root is renameable from the setup screen. */
+    private readonly kb: Pick<KbContext, 'layout'>,
+  ) {}
 
   async discover(kbRoot: string): Promise<Discovery> {
     return (await this.walkWith(kbRoot, [])).discovery;
@@ -47,7 +52,7 @@ export class KbPluginSource implements PluginSource {
   async walkWith(kbRoot: string, listeners: readonly WalkListener[]): Promise<PluginSourceWalk> {
     const warnings: string[] = [];
     const registry = await loadRegistry(kbRoot, warnings);
-    const listener = pluginListener(this.disk, kbRoot, registry, warnings);
+    const listener = pluginListener(this.disk, kbRoot, this.kb.layout, registry, warnings);
     const { holes } = await this.disk.walkKb(kbRoot, [listener.listener, ...listeners]);
     return { discovery: listener.result(), holes };
   }
@@ -57,16 +62,18 @@ export class KbPluginSource implements PluginSource {
 function pluginListener(
   disk: IFsProbe,
   kbRoot: string,
+  layout: KbLayout,
   registry: McpRegistry | null,
   warnings: string[],
 ): { listener: WalkListener; result(): Discovery } {
+  const { pluginsDir } = layout;
   const unreadable: string[] = [];
   const plugins: DiscoveredPlugin[] = [];
   const seen = new Map<string, string>();
   /** Folders claimed as plugins (or as holes standing where a plugin may be): nothing beneath is looked at. */
   const claimed: string[] = [];
 
-  const underRoot = (rel: string) => rel === PLUGINS_DIR || rel.startsWith(`${PLUGINS_DIR}/`);
+  const underRoot = (rel: string) => rel === pluginsDir || rel.startsWith(`${pluginsDir}/`);
   const beneathClaimed = (rel: string) => claimed.some((c) => rel === c || rel.startsWith(`${c}/`));
 
   // Uniqueness is judged on the MANIFEST SLUG, not the raw name: `Sales Team`
@@ -87,18 +94,18 @@ function pluginListener(
   return {
     listener: {
       async onDir(rel, entries) {
-        if (!underRoot(rel) || rel === PLUGINS_DIR || beneathClaimed(rel)) return;
+        if (!underRoot(rel) || rel === pluginsDir || beneathClaimed(rel)) return;
         const has = (name: string) => entries.some((e) => e.isFile() && e.name === name);
         const dir = path.join(kbRoot, rel);
-        const relFolder = rel.slice(PLUGINS_DIR.length + 1);
+        const relFolder = rel.slice(pluginsDir.length + 1);
         if (has(PLUGIN_MANIFEST_FILE)) {
           claimed.push(rel);
           // A manifest that could not be read: a hole, and still claimed.
-          const native = await readNativePlugin(disk, dir, rel, relFolder, warnings, unreadable);
+          const native = await readNativePlugin(disk, dir, rel, relFolder, warnings, unreadable, layout);
           if (native) claim(native);
         } else if (has(BUNDLE_FILE)) {
           claimed.push(rel);
-          const bundle = await readBundlePlugin(dir, rel, relFolder, registry, warnings, unreadable);
+          const bundle = await readBundlePlugin(dir, rel, relFolder, registry, warnings, unreadable, layout);
           if (bundle) claim(bundle);
         }
       },

package/src/modules/plugins/discovery/native.source.ts

@@ -8,6 +8,7 @@ import {
   linkedSkillRoots,
   pluginDisplayNameOf,
   pluginIdentityOf,
+  type KbLayout,
 } from '@bevel-software/platform-shared';
 import { isAbsence, type IFsProbe } from '../../../shared/fs.contract.js';
 import type { DiscoveredPlugin } from './plugin-source.js';
@@ -31,6 +32,8 @@ export async function readNativePlugin(
   relFolder: string,
   warnings: string[],
   unreadable: string[],
+  /** Names the plugins root a personal folder sits directly under. */
+  layout: KbLayout,
 ): Promise<DiscoveredPlugin | null> {
   const folderName = path.posix.basename(relFolder);
   const manifestRead = await readText(path.join(dir, PLUGIN_MANIFEST_FILE), folder, warnings);
@@ -97,7 +100,7 @@ export async function readNativePlugin(
     folder,
     relFolder,
     // The one structural rule: a direct child of the root with the prefix.
-    personal: isPersonalPluginDir(folder),
+    personal: isPersonalPluginDir(folder, layout),
     exists,
     manifest,
     manifestText,

package/src/modules/plugins/index.ts

@@ -1,4 +1,4 @@
-export { PluginIndexService, pluginsWorkspaceId, pluginFolderBelowRoot } from './plugins.service.js';
+export { PluginIndexService, pluginFolderBelowRoot } from './plugins.service.js';
 export {
   PluginProvisionService,
   PluginProvisionError,

package/src/modules/plugins/join-proposals.ts

@@ -1,9 +1,12 @@
 import {
   KNOWN_VERBS,
+  ownAccessReadable,
   parseAccessFile,
+  parseOwnAccessEntries,
   type ParsedEntry,
   type Verb,
 } from '../access-model/access-grammar.js';
+import type { TargetKind } from '../access/access-mutation.service.js';
 
 /**
  * What a join branch is PROPOSING, relative to the default branch.
@@ -50,23 +53,75 @@ function identityOf(entry: ParsedEntry): string {
 }
 
 /**
- * Folder rules from one copy of an `access.md`, per verb, grants only.
+ * The per-verb entries one copy of an item's rules declares, or null when the
+ * text could not be read as rules at all.
  *
- * A file that fails to parse yields NO grants. On the branch side that means
- * a malformed proposal offers nothing to accept (fail-closed). On the default
- * side it means every branch grant looks incoming — which is the safe
- * direction too: the manager is shown proposals to consider rather than
- * having them silently swallowed by an unreadable baseline.
+ * THE GRAMMAR FOLLOWS THE ITEM, because there are two of them and the
+ * resolver picks by item as well:
+ *
+ *   folder   a `access.md`, whose folder rules are a BODY of `verb:` block
+ *            lists — `parseAccessFile`, which fails the whole file if a verb
+ *            is not a list.
+ *   file     the node's OWN frontmatter — `parseOwnAccessEntries`, which also
+ *            accepts the single-value scalar form (`write: Rita <r@x.io>`),
+ *            ignores non-access keys like `nodeType:`, and drops a bad entry
+ *            rather than failing the file.
+ *
+ * Reading a file's frontmatter with the FOLDER grammar is what broke every
+ * request whose target was a file: `spliceGrant` writes one grant into a
+ * node's frontmatter as exactly that scalar — the same bytes the dialog's own
+ * grant writes, which the resolver honours — and the folder grammar rejects it
+ * with "'write:' must be a list", failing the parse, yielding no grants, which
+ * reads as a branch with nothing left to propose. The request was then closed
+ * on the editors' first listing, before anyone had seen it.
+ *
+ * Null is reserved for "could not be read": a folder `access.md` that does
+ * not parse, or a file whose frontmatter is broken (never closed, or not a
+ * mapping). A file with no frontmatter, or with frontmatter naming no verb,
+ * is perfectly readable and simply grants nothing. The file grammar's own
+ * null does not tell those apart, so the question is asked separately: a
+ * broken block read as "grants nothing" would close the request on a
+ * reading that failed, the same mistake by another door.
  */
-function grantsByVerb(text: string | null, path: string): Map<Verb, Map<string, ParsedEntry>> {
-  const out = new Map<Verb, Map<string, ParsedEntry>>();
-  for (const verb of KNOWN_VERBS) out.set(verb, new Map());
-  if (text === null) return out;
+function entriesOf(
+  text: string,
+  path: string,
+  kind: TargetKind,
+): Record<Verb, ParsedEntry[]> | null {
+  if (kind === 'file') {
+    return parseOwnAccessEntries(text) ?? (ownAccessReadable(text) ? emptyGrants() : null);
+  }
   const parsed = parseAccessFile(text, path);
-  if (!parsed.ok) return out;
+  return parsed.ok ? parsed.file.entries : null;
+}
+
+function emptyGrants(): Record<Verb, ParsedEntry[]> {
+  const out = {} as Record<Verb, ParsedEntry[]>;
+  for (const verb of KNOWN_VERBS) out[verb] = [];
+  return out;
+}
+
+/** An index that grants nothing — the baseline a copy nobody could read stands in as. */
+function emptyIndex(): Map<Verb, Map<string, ParsedEntry>> {
+  return new Map(KNOWN_VERBS.map((verb) => [verb, new Map<string, ParsedEntry>()]));
+}
+
+/**
+ * Grants only, indexed by canonical identity, from one copy of the rules.
+ * Null in, null out — an unreadable copy is not an empty one.
+ */
+function grantsByVerb(
+  text: string | null,
+  path: string,
+  kind: TargetKind,
+): Map<Verb, Map<string, ParsedEntry>> | null {
+  if (text === null) return null;
+  const entries = entriesOf(text, path, kind);
+  if (entries === null) return null;
+  const out = emptyIndex();
   for (const verb of KNOWN_VERBS) {
     const byId = out.get(verb)!;
-    for (const entry of parsed.file.entries[verb]) {
+    for (const entry of entries[verb]) {
       if (entry.deny) continue;
       byId.set(identityOf(entry), entry);
     }
@@ -75,19 +130,32 @@ function grantsByVerb(text: string | null, path: string): Map<Verb, Map<string,
 }
 
 /**
- * The grants `branchText` adds over `defaultText` — the proposals a manager
- * can accept. Empty ⇒ the branch's rules are a subset of the default's.
+ * The grants `branchText` adds over `defaultText` — the proposals an editor
+ * can accept. Empty ⇒ the branch's rules are a subset of the default's, which
+ * is the settled state.
+ *
+ * NULL when the branch's own copy is absent or unreadable, which is a
+ * different fact entirely and the one this surface keeps getting wrong: an
+ * empty answer closes somebody's request, so it has to mean "the branch asks
+ * for nothing more", never "the branch would not tell us".
+ *
+ * An unreadable DEFAULT copy stays what it was — every branch grant looks
+ * incoming. That is the safe direction on that side: an editor is shown
+ * proposals to consider rather than having them swallowed by a baseline
+ * nobody could read.
  *
- * `path` is only used to label parse errors; both texts are the same file at
- * two refs.
+ * `path` labels parse errors; both texts are the same file at two refs, and
+ * `kind` says which grammar that file is written in.
  */
 export function pendingProposals(
   branchText: string | null,
   defaultText: string | null,
   path: string,
-): JoinProposal[] {
-  const branch = grantsByVerb(branchText, path);
-  const base = grantsByVerb(defaultText, path);
+  kind: TargetKind,
+): JoinProposal[] | null {
+  const branch = grantsByVerb(branchText, path, kind);
+  if (branch === null) return null;
+  const base = grantsByVerb(defaultText, path, kind) ?? emptyIndex();
   const out: JoinProposal[] = [];
   for (const verb of KNOWN_VERBS) {
     const baseIds = base.get(verb)!;

package/src/modules/plugins/join-request-jobs.service.ts

@@ -1,5 +1,4 @@
 import {
-  DEFAULT_BRANCH,
   joinBranchFor,
   type AuthUser,
   type ChangeRequestState,
@@ -9,8 +8,8 @@ import { spliceGrant } from '../access-model/access-splice.js';
 import { sanitizeError } from '../workflow/sanitize-error.js';
 import { logger } from '../../shared/logging.js';
 import { printable } from '../../shared/printable.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { pluginsWorkspaceId } from './plugins.service.js';
 import type {
   ClaimedJoinRequest,
   JoinRequestRecord,
@@ -148,7 +147,8 @@ export interface JoinRequestJobsDeps {
     | 'listChangeRequestsAuthoredBy'
   >;
   workspaceService: Pick<WorkspaceService, 'getOrCreateForBranch' | 'readFile' | 'writeFile'>;
-  kbDirName: string;
+  /** The checkout folder, and which branch the request is cut from and aimed at. */
+  kb: Pick<KbContext, 'kbDirName' | 'defaultBranch' | 'defaultWorkspaceId'>;
   /**
    * The plugin a recorded key still names, or null when nothing does — it was
    * deleted, or its folder moved out from under the record.
@@ -508,7 +508,8 @@ export class PluginJoinRequestJobs {
     claim: ClaimedJoinRequest,
     stillOurs: () => Promise<void>,
   ): Promise<void> {
-    const { workflow, workspaceService, kbDirName } = this.deps;
+    const { workflow, workspaceService, kb } = this.deps;
+    const { kbDirName } = kb;
     const target = await this.deps.target(record.pluginKey);
     if (!target) throw new Error('the plugin is no longer available');
     const user = await this.deps.requester(record.requesterEmail);
@@ -607,7 +608,7 @@ export class PluginJoinRequestJobs {
     }
     const detail = await workflow.openChangeRequest(ws.id, user, {
       sourceBranch: branch,
-      targetBranch: DEFAULT_BRANCH,
+      targetBranch: kb.defaultBranch,
       // People read these: the display name, not the identifier.
       title: `Join request: ${target.displayName}`,
       description:
@@ -637,9 +638,9 @@ export class PluginJoinRequestJobs {
    * leaves the next click free to retry the same row.
    */
   private async ensureBranch(branch: string): Promise<void> {
-    const wsId = pluginsWorkspaceId();
+    const wsId = this.deps.kb.defaultWorkspaceId();
     try {
-      await this.deps.workflow.createBranch(wsId, branch, DEFAULT_BRANCH);
+      await this.deps.workflow.createBranch(wsId, branch, this.deps.kb.defaultBranch);
       return;
     } catch (err) {
       const branches = await this.deps.workflow.listBranches(wsId, {

package/src/modules/plugins/join-requests.service.ts

@@ -1,5 +1,4 @@
 import {
-  DEFAULT_BRANCH,
   isJoinBranchFor,
   type AuthUser,
   type ChangeRequest,
@@ -9,7 +8,14 @@ import { type WorkspaceService } from '../workspace/workspace.service.js';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('plugins');
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import type { KbContext } from '../../shared/kb-context.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import {
+  rulesFileFor,
+  type AccessRequestTarget,
+  type IAccessRequestLifecycle,
+} from '../access/access-requests.contract.js';
+import type { Verb } from '../access-model/access-grammar.js';
 import { pendingProposals, type JoinProposal } from './join-proposals.js';
 
 /** One open join change request, with what it still proposes. */
@@ -23,56 +29,185 @@ export interface JoinRequest {
 }
 
 /**
- * Join requests as PROPOSALS, and the reconciliation that retires them.
+ * Access requests as PROPOSALS, and the reconciliation that retires them.
  *
  * The lifecycle has no state of its own — it is derived, every time, from two
- * copies of one file:
+ * copies of one file (a folder's `access.md`, or a file's own frontmatter):
  *
- *   open        the branch's `access.md` grants something the default's does not
+ *   open        the branch proposes something the person does not already hold
  *   settled     it does not
  *
- * so "approve" is not an operation on the request at all. A manager grants a
+ * so "approve" is not an operation on the request at all. An editor grants a
  * principal through the ordinary access path (the same lock + commit every
  * other access edit uses, gated the same way), the default branch gains that
- * entry, and the proposal stops being pending because the diff no longer
- * contains it. When the last one goes, the change request has nothing left to
- * say and is rejected, its branch deleted.
+ * entry, and the proposal stops being pending.
+ *
+ * "Does not already hold" is stronger than "is not in the file", and
+ * deliberately so: Owner covers Can edit, a parent folder's grant covers this
+ * one, and a role or group carries access without naming anybody. Each of
+ * those would leave a proposal nobody can usefully accept — accepting writes
+ * a grant that changes nothing — and the request would sit open forever. See
+ * {@link JoinRequestsService.unmetProposals}.
  *
- * That reconciliation runs LAZILY on every listing as well as on demand, so a
- * grant made anywhere — this banner, the Manage-access dialog, a hand edit —
- * settles the request that asked for it. Nothing has to remember to.
+ * That reconciliation runs LAZILY on every listing as well as on demand, so
+ * access gained anywhere — this banner, the Manage access dialog, a hand
+ * edit, a role someone joined — settles the request that asked for it.
+ * Nothing has to remember to.
  */
-export class JoinRequestsService {
+export class JoinRequestsService implements IAccessRequestLifecycle {
   constructor(
     private readonly workspaceService: WorkspaceService,
     private readonly workflow: IWorkflowService,
+    private readonly kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId'>,
+    /**
+     * Read-only, and asked one question only: does this person already hold
+     * this verb on the item, on the DEFAULT branch? See {@link unmetProposals}.
+     */
+    private readonly accessControl: Pick<
+      IAccessControl,
+      'canRead' | 'canWrite' | 'canOwner' | 'canDownload'
+    >,
   ) {}
 
   /**
-   * Open join requests for `plugin`, each carrying only its still-pending
-   * proposals. Requests with none left are reconciled away (rejected, branch
-   * deleted) and omitted.
+   * What `branch` still proposes for `target`, minus everything the person it
+   * names already holds — or NULL when the branch's own copy could not be read
+   * at all.
+   *
+   * That distinction is the whole point of the return type. "The branch says
+   * nothing" is NOT "the branch proposes nothing", and the two arrive as the
+   * same empty diff: `pendingProposals` reads an unreadable file as carrying
+   * no grants (fail-closed, which is right for deciding what to SHOW). Used as
+   * the settle test it is fail-open in the one direction that cannot be taken
+   * back — it closes a request nobody answered.
+   *
+   * And unreadable is the normal case for a few seconds. These reads go
+   * through `origin/<branch>` in the DEFAULT branch's clone, whose fetch is
+   * throttled; a request opened moments ago names a ref that clone has not
+   * heard of. So a miss is retried behind a FORCED fetch before it is believed,
+   * and if it still misses the caller is told nothing rather than something
+   * false.
+   */
+  async proposalsOn(
+    branch: string,
+    target: AccessRequestTarget,
+    opts: { fresh?: boolean } = {},
+  ): Promise<JoinProposal[] | null> {
+    const rulesPath = rulesFileFor(target);
+    await this.refresh({ force: opts.fresh });
+    let branchText = await this.readAt(branch, rulesPath);
+    if (branchText === null && !opts.fresh) {
+      await this.refresh({ force: true });
+      branchText = await this.readAt(branch, rulesPath);
+    }
+    if (branchText === null) return null;
+    // `kind` picks the grammar: a folder's rules are block lists in an
+    // access.md body, a file's are its own frontmatter, where one grant is
+    // written as a scalar. Reading one with the other's grammar yields no
+    // grants, which reads as a finished request.
+    const proposals = pendingProposals(
+      branchText,
+      await this.readAt(this.kb.defaultBranch, rulesPath),
+      rulesPath,
+      target.kind,
+    );
+    // Unreadable rules on the branch: say nothing rather than "nothing left".
+    if (proposals === null) return null;
+    return this.unmetProposals(proposals, target);
+  }
+
+  /**
+   * Drop every proposal the live workspace has already ANSWERED, however it
+   * was answered.
+   *
+   * The file diff alone cannot see this. A request asking for `write` is
+   * satisfied by an `owner:` line, by a grant on a parent folder, or by a role
+   * or group the person has since joined — none of which put their email into
+   * this file, so the diff keeps reporting a proposal nobody can usefully
+   * accept (accepting writes a grant that changes nothing, and the request
+   * never retires). Asking the resolver the question the dialog's own grant
+   * would have to satisfy closes those requests instead of stranding them.
+   *
+   * A proposal naming a ROLE keeps the literal rule: "does this role hold the
+   * verb here" is not a question the per-person resolver answers, and a role
+   * proposal is answered by the live rules carrying it.
+   */
+  private async unmetProposals(
+    proposals: JoinProposal[],
+    target: AccessRequestTarget,
+  ): Promise<JoinProposal[]> {
+    const out: JoinProposal[] = [];
+    for (const proposal of proposals) {
+      if (proposal.principal.kind !== 'user') {
+        out.push(proposal);
+        continue;
+      }
+      if (await this.holds(proposal.principal.email, proposal.verb, target.path)) continue;
+      out.push(proposal);
+    }
+    return out;
+  }
+
+  /**
+   * Does `email` hold `verb` on the ITEM, on the default branch? The verb
+   * folds are the resolver's own (owner covers write, write covers read), so
+   * this asks exactly what an accepted grant would have to achieve.
+   *
+   * Best-effort in ONE direction: a resolver that fails answers "no", which
+   * leaves the request open. A failure must never close somebody's request for
+   * them.
+   */
+  private async holds(email: string, verb: Verb, itemPath: string): Promise<boolean> {
+    const wsId = this.kb.defaultWorkspaceId();
+    try {
+      switch (verb) {
+        case 'owner':
+          return await this.accessControl.canOwner(wsId, email, itemPath);
+        case 'write':
+          return await this.accessControl.canWrite(wsId, email, itemPath);
+        case 'download':
+          return await this.accessControl.canDownload(wsId, email, itemPath);
+        default:
+          return await this.accessControl.canRead(wsId, email, itemPath);
+      }
+    } catch (err) {
+      log.warn(
+        `could not resolve ${verb} on "${itemPath}" for a request: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+      return false;
+    }
+  }
+
+  /**
+   * Open requests for one item, each carrying only what it still proposes.
+   * Requests with nothing left are reconciled away (rejected, branch deleted)
+   * and omitted.
    *
-   * `actor` is who the reconciliation acts as — a manager of the plugin, since
+   * `key` is what named the branch (`joinBranchFor`) — a plugin's name for a
+   * Subscribe request, the item's own path for everything the Manage access
+   * dialog opens. `target` is the item whose rules those proposals edit; the
+   * two differ only for plugins, whose folder is not their name.
+   *
+   * `actor` is who the reconciliation acts as — an editor of the item, since
    * rejecting a change request requires write on everything it touches.
    */
   async list(
-    plugin: string,
-    folder: string,
+    key: string,
+    target: AccessRequestTarget,
     crs: ChangeRequest[],
     actor: AuthUser,
   ): Promise<JoinRequest[]> {
-    await this.refresh();
-    const accessPath = `${folder}/access.md`;
-    const baseText = await this.readAt(DEFAULT_BRANCH, accessPath);
     const out: JoinRequest[] = [];
     for (const cr of crs) {
-      if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, plugin)) continue;
-      const proposals = pendingProposals(
-        await this.readAt(cr.branch, accessPath),
-        baseText,
-        accessPath,
-      );
+      if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, key)) continue;
+      const proposals = await this.confirmedProposals(cr.branch, target);
+      // Unreadable: leave it exactly as it is. There is nothing to offer an
+      // editor and nothing that says it is finished, and closing it on a read
+      // that failed would end somebody's request for them. It stays in Change
+      // requests for you, where it can still be answered by hand.
+      if (proposals === null) continue;
       if (proposals.length === 0) {
         await this.settle(cr, actor);
         continue;
@@ -94,24 +229,46 @@ export class JoinRequestsService {
    * same round-trip instead of waiting for the next listing.
    */
   async reconcile(
-    plugin: string,
-    folder: string,
+    key: string,
+    target: AccessRequestTarget,
     cr: ChangeRequest,
     actor: AuthUser,
   ): Promise<boolean> {
-    if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, plugin)) return false;
-    await this.refresh();
-    const accessPath = `${folder}/access.md`;
-    const proposals = pendingProposals(
-      await this.readAt(cr.branch, accessPath),
-      await this.readAt(DEFAULT_BRANCH, accessPath),
-      accessPath,
-    );
-    if (proposals.length > 0) return false;
+    if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, key)) return false;
+    const proposals = await this.confirmedProposals(cr.branch, target);
+    // Same rule as the listing: only a branch that was READ and, on a fresh
+    // read, proposes nothing is finished.
+    if (proposals === null || proposals.length > 0) return false;
     await this.settle(cr, actor);
     return true;
   }
 
+  /**
+   * What the branch proposes, with an EMPTY answer confirmed against freshly
+   * fetched refs before anyone acts on it. Null keeps its meaning: nothing
+   * could be read, so nothing can be said.
+   *
+   * The confirmation is there because an empty answer is the terminal one.
+   * These reads go through `origin/<branch>` in the default branch's clone,
+   * and that clone's fetch is throttled — so a branch whose remote-tracking
+   * ref is a few seconds old answers with the commit BEFORE the proposal was
+   * pushed. That is a file identical to live, which is an empty diff, which
+   * reads as "every grant has landed". A request nobody answered is then
+   * closed, its branch deleted, and the person told it was not accepted.
+   *
+   * One extra fetch, on the one path that cannot be undone — and when that
+   * fetch turns up a proposal after all, it is the answer, not a discarded
+   * second opinion.
+   */
+  private async confirmedProposals(
+    branch: string,
+    target: AccessRequestTarget,
+  ): Promise<JoinProposal[] | null> {
+    const first = await this.proposalsOn(branch, target);
+    if (first === null || first.length > 0) return first;
+    return this.proposalsOn(branch, target, { fresh: true });
+  }
+
   /**
    * Close a request whose proposals have all landed, and delete its branch.
    *
@@ -125,7 +282,7 @@ export class JoinRequestsService {
    * next pass tries again.
    */
   private async settle(cr: ChangeRequest, actor: AuthUser): Promise<void> {
-    const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+    const wsId = this.kb.defaultWorkspaceId();
     try {
       await this.workflow.rejectChangeRequest(
         cr.number,
@@ -167,7 +324,7 @@ export class JoinRequestsService {
   private async readAt(branch: string, repoRelPath: string): Promise<string | null> {
     try {
       return await this.workspaceService.readFileAtRef(
-        workspaceIdForBranch(DEFAULT_BRANCH),
+        this.kb.defaultWorkspaceId(),
         `origin/${branch}`,
         repoRelPath,
       );
@@ -180,10 +337,13 @@ export class JoinRequestsService {
    * Refresh remote-tracking refs before reading them. Throttled inside, and
    * best-effort: a request pushed seconds ago is worth one fetch, but a fetch
    * failure must degrade to "read what we have" rather than empty the list.
+   *
+   * `force` skips the throttle — for the one caller that has already missed
+   * and must not mistake a stale ref list for an answer.
    */
-  private async refresh(): Promise<void> {
+  private async refresh(opts: { force?: boolean } = {}): Promise<void> {
     await this.workspaceService
-      .ensureRemotesFetched(workspaceIdForBranch(DEFAULT_BRANCH))
+      .ensureRemotesFetched(this.kb.defaultWorkspaceId(), opts)
       .catch(() => undefined);
   }
 }