@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/src/modules/workflow/__tests__/workflow.service.facade.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type {
   AuthUser,
   ChangeInput,
@@ -13,9 +14,10 @@ import { FileLockService } from '../file-lock.service.js';
 import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowService } from '../workflow.service.js';
 import { PullRebaseConflictError, WorkflowDomainError } from '../../../shared/domain-errors.js';
-import { DEFAULT_BRANCH, isProtectedBranch } from '@bevel-software/platform-shared';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import type { Database } from '../../database/connection.js';
 import { openChangeGate } from '../../../__tests__/open-change-gate.js';
+import { hashEmail } from '../../../shared/email-identity.js';
 
 // `deleteBranch`'s open-request guard is the only DB touch these tests
 // exercise. The stub ANSWERS FROM THE WHERE-CLAUSE rather than returning the
@@ -238,7 +240,7 @@ describe('WorkflowService — branch delegation', () => {
     const branches = [{ name: 'main', isCurrent: true, isProtected: true, ahead: 0, behind: 0, hasRemote: true }];
     (git.listBranches as ReturnType<typeof vi.fn>).mockResolvedValue(branches);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.listBranches('w1')).resolves.toBe(branches);
     // listBranches(workspaceId, opts?) forwards opts — undefined when omitted.
     expect(git.listBranches).toHaveBeenCalledWith('w1', undefined);
@@ -248,7 +250,7 @@ describe('WorkflowService — branch delegation', () => {
     const git = makeGit();
     (git.createBranch as ReturnType<typeof vi.fn>).mockResolvedValue({ name: 'feat' });
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.createBranch('w1', 'feat', 'current-company-state');
     expect(git.createBranch).toHaveBeenCalledWith('w1', 'feat', 'current-company-state');
   });
@@ -258,7 +260,7 @@ describe('WorkflowService — branch delegation', () => {
     const status = { branch: 'main', isDirty: false, hasUpstream: true, unpushedCommits: 0, conflicted: [], unmergedFromUpstream: false };
     (git.status as ReturnType<typeof vi.fn>).mockResolvedValue(status);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.branchStatus('w1')).resolves.toBe(status);
     expect(git.status).toHaveBeenCalledWith('w1');
   });
@@ -272,7 +274,7 @@ describe('WorkflowService — change delegation', () => {
     const commit = { sha: 'abc', authorName: 'Alice', authorEmail: 'alice@example.com', subject: 'tweak owner', committedAt: '2026-01-01T00:00:00Z' };
     (git.commit as ReturnType<typeof vi.fn>).mockResolvedValue(commit);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.commitChange('w1', user, input)).resolves.toBe(commit);
     expect(git.commit).toHaveBeenCalledWith('w1', user, input);
   });
@@ -281,7 +283,7 @@ describe('WorkflowService — change delegation', () => {
     const git = makeGit();
     (git.logForFile as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.listChangesForFile('w1', 'Knowledge/Foo.md', 5);
     expect(git.logForFile).toHaveBeenCalledWith('w1', 'Knowledge/Foo.md', 5);
   });
@@ -290,7 +292,7 @@ describe('WorkflowService — change delegation', () => {
     const git = makeGit();
     (git.diffFileBetweenBranches as ReturnType<typeof vi.fn>).mockResolvedValue('@@ diff');
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const diff = await svc.compareFile('w1', 'Foo.md', 'a', 'b');
     expect(diff).toBe('@@ diff');
     expect(git.diffFileBetweenBranches).toHaveBeenCalledWith('w1', 'Foo.md', 'a', 'b');
@@ -302,7 +304,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const prs = makePrs();
     (prs.listOpenPrs as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.listChangeRequests({ fresh: true });
     expect(prs.listOpenPrs).toHaveBeenCalledWith({ fresh: true });
   });
@@ -314,7 +316,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const input: PostChangeRequestCommentInput = { body: 'hi' };
     (reviewWorkflow.postComment as ReturnType<typeof vi.fn>).mockResolvedValue(comment);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const user = makeUser();
     await expect(svc.postComment(42, user, input, 'sha1')).resolves.toBe(comment);
     expect(reviewWorkflow.postComment).toHaveBeenCalledWith(42, user, input, 'sha1');
@@ -327,7 +329,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const reviewWorkflow = makeReviewWorkflow();
     (reviewWorkflow.approveFile as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.approveFile(7, 'Foo.md', makeUser(), [], 'sha', 'main', null, 'w1');
     expect(prs.invalidateDetailCache).toHaveBeenCalledWith(7);
     expect(prs.invalidateDetailCache).toHaveBeenCalledTimes(1);
@@ -338,7 +340,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const reviewWorkflow = makeReviewWorkflow();
     (reviewWorkflow.cancelPr as ReturnType<typeof vi.fn>).mockResolvedValue({ prNumber: 9, cancelledAt: 't' });
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const user = makeUser();
     await svc.rejectChangeRequest(9, user, 'open', null, 'main', 'w1');
     expect(reviewWorkflow.cancelPr).toHaveBeenCalledWith(9, user, 'open', null, 'main', 'w1');
@@ -357,7 +359,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
 
     const git = makeGit();
     const workspaceService = makeWorkspaceService();
-    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     // Conflicts are surfaced by the local merge inside `reviewWorkflow.mergePr`
     // (mocked here), so there's no provider "mergeable" pre-check to stub.
     const outcome = await svc.mergeChangeRequest(
@@ -374,7 +376,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     expect(outcome).toEqual({ kind: 'merged', result: mergeResult });
     // The target branch's workspace is pulled so it doesn't fall behind origin.
     expect(workspaceService.getOrCreateForBranch).toHaveBeenCalledWith('main');
-    expect(git.pull).toHaveBeenCalledWith('main');
+    expect(git.pull).toHaveBeenCalledWith('main', {});
     expect(reviewWorkflow.mergePr).toHaveBeenCalledWith(
       4,
       expect.objectContaining({ email: 'alice@example.com' }),
@@ -412,7 +414,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
       id: 'resolved-target-ws',
     });
     const pending = makePendingCommits();
-    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), pending, 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), pending, testKbContext(), openChangeGate());
 
     const outcome = await svc.mergeChangeRequest(
       4, makeUser(), 'sha', [], 'open', 'PR title', 'main', 'w1', { bypass: true },
@@ -435,7 +437,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
 describe('WorkflowService — file lock delegation', () => {
   it('acquireLock delegates to FileLockService.acquire', async () => {
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await svc.acquireLock('w1', 'b', 'p', makeUser());
     expect(fileLocks.acquire).toHaveBeenCalledWith('w1', 'b', 'p', expect.objectContaining({ email: 'alice@example.com' }), undefined);
   });
@@ -445,7 +447,7 @@ describe('WorkflowService — file lock delegation', () => {
     // a coordination hold masquerade as an edit lock on the very next read
     // (which is how the write paths decide what the holder may do).
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await svc.acquireLock('w1', 'b', 'p', makeUser(), { coordination: true });
     expect(fileLocks.acquire).toHaveBeenCalledWith(
       'w1', 'b', 'p', expect.objectContaining({ email: 'alice@example.com' }), { coordination: true },
@@ -454,7 +456,7 @@ describe('WorkflowService — file lock delegation', () => {
 
   it('getLock delegates to FileLockService.get', async () => {
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.getLock('w1', 'b', 'p')).resolves.toBeNull();
     expect(fileLocks.get).toHaveBeenCalledWith('w1', 'b', 'p');
   });
@@ -469,7 +471,7 @@ describe('WorkflowService — file lock delegation', () => {
       acquiredAt: '', lastHeartbeatAt: '', expiresAt: '',
     });
     const pending = makePendingCommits();
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, pending, 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, pending, testKbContext(), openChangeGate());
     await expect(svc.releaseLock('w1', 'feat', 'Foo.md', makeUser())).resolves.toBeUndefined();
     // No inline git work — the worker handles that out of band.
     expect(git.commitFile).not.toHaveBeenCalled();
@@ -488,28 +490,28 @@ describe('WorkflowService — file lock delegation', () => {
     // One open request rides the branch — deleting it would strand the request.
     // `sourceBranch` matters to the guard now: it decides whether the refusal
     // says "withdraw yours" (source) or names the other request's actors (target).
-    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).rejects.toThrow(/open change request \(#7\)/);
     expect(git.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('deleteBranch refuses when an open request proposes INTO the branch (target end)', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb([{ number: 9, sourceBranch: 'other/y', targetBranch: 'feat/x', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 9, sourceBranch: 'other/y', targetBranch: 'feat/x', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).rejects.toThrow(/proposes changes into/);
     expect(git.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('deleteBranch proceeds past a CLOSED request — the guard filters on state, not mere mention', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'closed' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'closed' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).resolves.toBeUndefined();
     expect(git.deleteBranch).toHaveBeenCalled();
   });
 
   it('deleteBranch deletes when the branch has no open change request', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).resolves.toBeUndefined();
     expect(git.deleteBranch).toHaveBeenCalledWith('w1', 'feat/x', expect.objectContaining({ email: 'alice@example.com' }), undefined);
   });
@@ -529,7 +531,7 @@ describe('WorkflowService — file lock delegation', () => {
     vi.mocked(git.deleteBranch)
       .mockImplementationOnce(async () => { order.push('first:start'); await gate; order.push('first:end'); })
       .mockImplementationOnce(async () => { order.push('second'); });
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const first = svc.deleteBranch('w1', 'feat/x', makeUser());
     const second = svc.deleteBranch('w1', 'feat/x', makeUser());
     // Only release the gate once the first operation is provably inside its
@@ -544,7 +546,7 @@ describe('WorkflowService — file lock delegation', () => {
   it('releaseLock refuses when the caller does not hold the lock', async () => {
     const git = makeGit();
     const fileLocks = makeFileLockService(); // default: get → null
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.releaseLock('w1', 'feat', 'Foo.md', makeUser())).rejects.toThrow(/not held by you/);
     // The commit must NOT run when the caller doesn't hold the lock —
     // otherwise a non-holder could trigger a commit attributed as them.
@@ -605,7 +607,7 @@ describe('WorkflowService — revertChangeRequestFile / closeEmptyChangeRequest'
       returning: vi.fn(async () => updateRows),
     });
     const db = chain as unknown as Database;
-    const svc = new WorkflowService(db, git, prs, makeReviewWorkflow(), makeWorkspaceService(), access, fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(db, git, prs, makeReviewWorkflow(), makeWorkspaceService(), access, fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     return { svc, git, prs, access, fileLocks, db: chain };
   }
 
@@ -783,8 +785,13 @@ describe('WorkflowService — revertChangeRequestFile / closeEmptyChangeRequest'
   });
 });
 
-describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () => {
-  function makeDeleteHarness(opts: { isAdmin?: boolean; prState?: string } = {}) {
+describe('WorkflowService — deleteChangeRequest (the author’s and the admin’s verb)', () => {
+  const AUTHOR_EMAIL = 'alice@example.com'; // makeUser()'s default caller
+  const STRANGER_AUTHOR = 'mallory@example.com';
+
+  function makeDeleteHarness(
+    opts: { isAdmin?: boolean; prState?: string; authorEmail?: string | null } = {},
+  ) {
     const git = Object.assign(makeGit(), {
       changedPathsForPr: vi.fn().mockResolvedValue(['Docs/a.md']),
     }) as unknown as GitService;
@@ -794,26 +801,83 @@ describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () =
       base: 'main',
       branch: 'mallory/spam',
       state: opts.prState ?? 'open',
+      // Authorship as the server reads it: the stored hash, never the caller's
+      // claim. Defaults to someone OTHER than makeUser(), so a test that says
+      // nothing about authorship is testing the admin grant alone.
+      // `null` means a request with no stored author (opened outside this
+      // backend); undefined means "someone, just not the caller".
+      authorId:
+        opts.authorEmail === null ? undefined : hashEmail(opts.authorEmail ?? STRANGER_AUTHOR),
     });
     const access = makeAccessControl();
     (access.canWriteAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(opts.isAdmin ?? false);
     const chain: Record<string, unknown> = {};
+    // Two different selects run under one chain mock: the branch-retirement
+    // lookup asks for `{ sourceBranch }`, and `openChangeRequestOn` asks for
+    // `{ number, sourceBranch }`. Answer by projection rather than call order,
+    // so the retirement path is exercised (a branch to retire, and no other
+    // open request holding it) without the test depending on call sequence.
+    let projection: Record<string, unknown> = {};
     Object.assign(chain, {
-      select: vi.fn(() => chain),
+      select: vi.fn((proj?: Record<string, unknown>) => {
+        projection = proj ?? {};
+        return chain;
+      }),
       from: vi.fn(() => chain),
       where: vi.fn(() => chain),
-      limit: vi.fn(async () => []),
+      limit: vi.fn(async () =>
+        'number' in projection ? [] : [{ sourceBranch: 'mallory/spam' }],
+      ),
       update: vi.fn(() => chain),
       set: vi.fn(() => chain),
       returning: vi.fn(async () => [{ id: 1 }]),
     });
     const workspaces = makeWorkspaceService();
-    const svc = new WorkflowService(chain as unknown as Database, git, prs, makeReviewWorkflow(), workspaces, access, makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
-    return { svc, prs, db: chain, access, workspaces };
+    const svc = new WorkflowService(chain as unknown as Database, git, prs, makeReviewWorkflow(), workspaces, access, makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
+    return { svc, prs, db: chain, access, workspaces, git };
   }
 
-  it('refuses a non-admin with 403 and touches nothing', async () => {
-    const { svc, db } = makeDeleteHarness({ isAdmin: false });
+  it('refuses a non-admin who is not the author, with 403 and the author-or-admin message', async () => {
+    const { svc, db, git } = makeDeleteHarness({ isAdmin: false });
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 403,
+      message: "Only the request's author or an admin can delete it.",
+    });
+    // "Changes nothing" is the whole promise of the refusal: no row flipped,
+    // no branch removed.
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('lets the AUTHOR delete their own request without admin rights: closes it and retires the branch', async () => {
+    const { svc, prs, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    await svc.deleteChangeRequest(9, makeUser());
+    expect(db.update).toHaveBeenCalled();
+    expect(prs.invalidateDetailCache).toHaveBeenCalledWith(9);
+    expect(git.deleteBranch).toHaveBeenCalledWith(
+      expect.any(String),
+      'mallory/spam',
+      expect.objectContaining({ email: AUTHOR_EMAIL }),
+      expect.objectContaining({ systemCleanup: true }),
+    );
+  });
+
+  it('matches the author case-insensitively, as hashEmail does', async () => {
+    // The stored hash is of the normalized address; a caller signed in as
+    // `Alice@Example.com` is the same person and must not be refused.
+    const { svc, db } = makeDeleteHarness({ isAdmin: false, authorEmail: AUTHOR_EMAIL });
+    await svc.deleteChangeRequest(9, makeUser({ email: '  Alice@Example.com  ' }));
+    expect(db.update).toHaveBeenCalled();
+  });
+
+  it('refuses a request with no stored author to a non-admin', async () => {
+    // Opened outside this backend: nobody can claim authorship of it, so the
+    // admin grant is the only one left. An absent hash must never read as a
+    // match.
+    const { svc, db } = makeDeleteHarness({ isAdmin: false, authorEmail: null });
     await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({ status: 403 });
     expect(db.update).not.toHaveBeenCalled();
   });
@@ -831,6 +895,94 @@ describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () =
     expect(db.update).not.toHaveBeenCalled();
   });
 
+  it('refuses the AUTHOR on an applied request with 422 and the applied message', async () => {
+    // Applied between opening the dialog and confirming. The author's new
+    // grant does not reach applied history either.
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      prState: 'merged',
+      authorEmail: AUTHOR_EMAIL,
+    });
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 422,
+      message: 'This change request has already been applied.',
+    });
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('refuses the AUTHOR with 409 when the base cannot be verified, and changes nothing', async () => {
+    // The strict base fetch is NOT skipped for an author, even though their
+    // grant needs no roles.yaml read: an unreachable origin means the branch
+    // removal would fail silently, and the delete must refuse whole rather
+    // than close the request and leave the branch.
+    const { svc, db, git, workspaces } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    (workspaces.ensureRemotesFetched as ReturnType<typeof vi.fn>).mockRejectedValue(
+      new Error('origin unreachable'),
+    );
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 409,
+      message: expect.stringContaining('Retry in a moment.'),
+    });
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('refuses the AUTHOR with 409 when the base ref does not resolve', async () => {
+    const { svc, db, access } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    (access.canWriteAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({ status: 409 });
+    expect(db.update).not.toHaveBeenCalled();
+  });
+
+  it('a request already closed elsewhere still has its branch retired', async () => {
+    // Withdrawn in another tab: the guarded update flips no row, the request
+    // is not merged, so the delete finishes the job the withdraw left undone.
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      prState: 'closed',
+      authorEmail: AUTHOR_EMAIL,
+    });
+    // The update is guarded on `state = 'open'`, so it flips nothing here.
+    (db.returning as ReturnType<typeof vi.fn>).mockResolvedValue([]);
+    await expect(svc.deleteChangeRequest(9, makeUser())).resolves.toBeUndefined();
+    expect(git.deleteBranch).toHaveBeenCalledWith(
+      expect.any(String),
+      'mallory/spam',
+      expect.anything(),
+      expect.objectContaining({ systemCleanup: true }),
+    );
+  });
+
+  it('keeps a branch another open request still uses, and closes the request silently', async () => {
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    // `openChangeRequestOn` finds a live request on the branch (the
+    // `{ number, sourceBranch }` projection), so retirement backs off.
+    let projection: Record<string, unknown> = {};
+    (db.select as ReturnType<typeof vi.fn>).mockImplementation((proj?: Record<string, unknown>) => {
+      projection = proj ?? {};
+      return db;
+    });
+    (db.limit as ReturnType<typeof vi.fn>).mockImplementation(async () =>
+      'number' in projection
+        ? [{ number: 11, sourceBranch: 'mallory/spam' }]
+        : [{ sourceBranch: 'mallory/spam' }],
+    );
+    // No throw, no message: the request closes and the branch survives.
+    await expect(svc.deleteChangeRequest(9, makeUser())).resolves.toBeUndefined();
+    expect(db.update).toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
   it('kicks the deleted-branch sweep when the base workspace cannot be resolved', async () => {
     const { svc, db, workspaces } = makeDeleteHarness({ isAdmin: true });
     (workspaces.getOrCreateForBranch as ReturnType<typeof vi.fn>).mockRejectedValue(
@@ -916,7 +1068,7 @@ describe('WorkflowService.mergeBranch — an agent merges branches, never an ope
     const access = makeAccessControl();
     (access.canWriteBatchAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(opts.canWrite === undefined ? null : opts.canWrite);
     const workspaceService = makeWorkspaceService();
-    const svc = new WorkflowService(makeDb([OPEN_REQUEST]), git, makePrs(), makeReviewWorkflow(), workspaceService, access, makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([OPEN_REQUEST]), git, makePrs(), makeReviewWorkflow(), workspaceService, access, makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const merge = (git as unknown as { mergeChangeRequest: ReturnType<typeof vi.fn> }).mergeChangeRequest;
     return { svc, git, access, merge };
   }
@@ -956,7 +1108,7 @@ describe('WorkflowService.mergeBranch — an agent merges branches, never an ope
   });
 
   it('refuses a protected target when the caller could not commit the changed files directly', async () => {
-    expect(isProtectedBranch(PROTECTED)).toBe(true);
+    expect(testKbContext().isProtectedBranch(PROTECTED)).toBe(true);
     const { svc, git, access, merge } = harness({ canWrite: new Map([['Team/Process.md', false]]) });
     const err = await svc.mergeBranch(makeUser(), 'alice/other', PROTECTED).catch((e: unknown) => e);
     expect(err).toMatchObject({ status: 403, payload: { kind: 'protected-merge-target', deniedPaths: ['Team/Process.md'] } });

package/src/modules/workflow/__tests__/workflow.service.folder-proposals.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, PullRequestSummary } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -138,7 +139,7 @@ function makeHarness(requests: PullRequestSummary[], access: Access = {}) {
     accessControl,
     fileLocks,
     pendingCommits,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
   );
   // Which request an UPDATE is closing is not recoverable from the drizzle

package/src/modules/workflow/__tests__/workflow.service.platform-restore.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -53,7 +54,7 @@ function makeService(canRestorePlatformFile: IAccessControl['canRestorePlatformF
     accessControl,
     { acquire, get: vi.fn(async () => null) } as unknown as FileLockService,
     {} as PendingCommitsService,
-    KB,
+    testKbContext({ kbDirName: KB }),
     openChangeGate(),
     new WorkflowEventBus(),
   );

package/src/modules/workflow/__tests__/workflow.service.read-gate.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -61,7 +62,7 @@ function makeService(opts: {
     accessControl,
     { acquire, get: vi.fn(async () => null) } as unknown as FileLockService,
     {} as PendingCommitsService,
-    KB,
+    testKbContext({ kbDirName: KB }),
     opts.gate ?? gateThat({ allowed: true, via: 'readable' }).gate,
     new WorkflowEventBus(),
   );
@@ -81,7 +82,7 @@ describe('WorkflowService cannot exist without the gate', () => {
           {} as IAccessControl,
           {} as FileLockService,
           {} as PendingCommitsService,
-          KB,
+          testKbContext({ kbDirName: KB }),
           undefined as unknown as IChangeReadGate,
         ),
     ).toThrow(/requires a read-before-write gate/);

package/src/modules/workflow/__tests__/workflow.service.releaseLock.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach, type MockInstance } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, Change } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -143,7 +144,7 @@ function makeFacade(
     {} as IAccessControl,
     locks,
     pending,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
     events,
   );

package/src/modules/workflow/__tests__/workflow.service.sync.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { RemoteSyncPullResult } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -37,7 +38,7 @@ function build(opts: { sync: () => Promise<RemoteSyncPullResult> }) {
     {} as IAccessControl,
     {} as FileLockService,
     pendingCommits,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
     events,
   );
@@ -259,7 +260,7 @@ describe('WorkflowService.retireRemoteGoneClone', () => {
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     return { svc, git, workspaceService };
@@ -327,7 +328,7 @@ describe('WorkflowService.retireRemoteGoneClone — what can bring the branch ba
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     expect(await svc.retireRemoteGoneClone('ali%2Fx')).toBe(false);
@@ -356,7 +357,7 @@ describe('WorkflowService.retireRemoteGoneClone — what can bring the branch ba
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     // Retirement enters first; a createBranch for the same name arrives while