@bevel-software/platform-core-backend 0.22.0 → 0.24.0

package/src/modules/workflow/git/__tests__/git.service.prFetchFailure.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import type { WorkspaceService } from '../../../workspace/workspace.service.js';
+import { WorkflowHooks } from '../../workflow-hooks.js';
+import { GitService } from '../git.service.js';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * What the log says when a change request's branches cannot be fetched.
+ *
+ * The fetch is best-effort: when it fails, the refs are resolved from what the
+ * working copy already has. A working copy that could not reach the remote at
+ * all then reported `unknown branch` for every branch it had never seen, and
+ * nothing said the fetch had been refused — the log named a missing branch
+ * that was on the remote the whole time.
+ */
+
+const TRUNK = 'current-company-state';
+const WORKSPACE = 'ws-pr-fetch';
+
+async function runGit(cwd: string, args: string[]): Promise<void> {
+  await execFileAsync('git', args, {
+    cwd,
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: 'Test', GIT_AUTHOR_EMAIL: 't@x.com',
+      GIT_COMMITTER_NAME: 'Test', GIT_COMMITTER_EMAIL: 't@x.com',
+    },
+  });
+}
+
+let root: string;
+let repo: string;
+let upstream: string;
+
+beforeEach(async () => {
+  root = await fs.mkdtemp(path.join(os.tmpdir(), 'git-pr-fetch-'));
+  upstream = path.join(root, 'upstream.git');
+  await runGit(root, ['init', '--bare', '-b', TRUNK, upstream]);
+  const seed = path.join(root, '.seed');
+  await fs.mkdir(seed);
+  await runGit(seed, ['init', '-b', TRUNK]);
+  await runGit(seed, ['remote', 'add', 'origin', upstream]);
+  await fs.writeFile(path.join(seed, 'base.md'), 'base\n');
+  await runGit(seed, ['add', '-A']);
+  await runGit(seed, ['commit', '-m', 'init']);
+  await runGit(seed, ['push', 'origin', TRUNK]);
+  // A draft the working copy below has never seen: pushed after it was cloned.
+  repo = path.join(root, WORKSPACE, 'knowledge-base');
+  await fs.mkdir(path.dirname(repo), { recursive: true });
+  await runGit(root, ['clone', upstream, repo]);
+  await runGit(seed, ['checkout', '-b', 'alice/feature']);
+  await fs.writeFile(path.join(seed, 'new.md'), 'new\n');
+  await runGit(seed, ['add', '-A']);
+  await runGit(seed, ['commit', '-m', 'feature']);
+  await runGit(seed, ['push', 'origin', 'alice/feature']);
+});
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await fs.rm(root, { recursive: true, force: true });
+});
+
+function service(): GitService {
+  const workspaces = {
+    getWorkspacePath: async () => path.dirname(repo),
+  } as unknown as WorkspaceService;
+  return new GitService(workspaces, new WorkflowHooks(), testKbContext());
+}
+
+/** Everything the service logged at warn level, as one string per line. */
+function warnings(spy: ReturnType<typeof vi.spyOn>): string[] {
+  return spy.mock.calls.map((call) => call.map((part) => (typeof part === 'string' ? part : JSON.stringify(part))).join(' '));
+}
+
+describe('a change request whose branches cannot be fetched', () => {
+  it('says the fetch failed, and where, when the working copy cannot reach the remote', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    // The remote this working copy fetches from is gone from under it.
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+
+    await expect(service().changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).rejects.toThrow(
+      'unknown branch: alice/feature',
+    );
+
+    const said = warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    expect(said).toHaveLength(1);
+    expect(said[0]).toContain(`"${WORKSPACE}"`);
+    expect(said[0]).toContain('though it may be on the remote');
+  });
+
+  it('says it once for a list that asks about many requests in one working copy', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+    const git = service();
+
+    for (const branch of ['alice/feature', 'bob/other', 'carol/third']) {
+      await git.changedPathsForPr(WORKSPACE, TRUNK, branch).catch(() => undefined);
+    }
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toHaveLength(1);
+  });
+
+  it('says it again once a minute has passed, and not before', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+    const git = service();
+    const said = () => warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    // Only the clock the service reads is moved: git itself runs for real.
+    const realNow = Date.now.bind(Date);
+    let ahead = 0;
+    vi.spyOn(Date, 'now').mockImplementation(() => realNow() + ahead);
+
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    ahead = 30_000;
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    ahead = 61_000;
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(2);
+  });
+
+  it('says it again at once for a working copy that reached the remote in between', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const git = service();
+    const said = () => warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    const broken = path.join(root, 'no-such-remote.git');
+
+    await runGit(repo, ['remote', 'set-url', 'origin', broken]);
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    // It reaches the remote again: what was said about it is over, and nothing
+    // of it is kept.
+    await runGit(repo, ['remote', 'set-url', 'origin', upstream]);
+    expect(await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).toEqual(['new.md']);
+
+    // So a failure right after is a new one, said without waiting out a minute.
+    await runGit(repo, ['remote', 'set-url', 'origin', broken]);
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'bob/other').catch(() => undefined);
+    expect(said()).toHaveLength(2);
+  });
+
+  it('says nothing when the branch is simply gone from the remote: that is what a retired branch looks like', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    await expect(service().changedPathsForPr(WORKSPACE, TRUNK, 'dave/retired')).rejects.toThrow(
+      'unknown branch: dave/retired',
+    );
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toEqual([]);
+  });
+
+  it('says nothing when the fetch works, and finds the branch the working copy had never seen', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    expect(await service().changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).toEqual(['new.md']);
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toEqual([]);
+  });
+});

package/src/modules/workflow/git/git.service.ts

@@ -35,10 +35,12 @@ import {
   ProtectedBranchError,
   PullRebaseConflictError,
   RemoteBranchGoneError,
+  VersionNotOnBranchError,
   isMissingRemoteBranchFailure,
 } from '../../../shared/domain-errors.js';
 import {
   GitRunError,
+  assertOneSpecPerLine,
   isGitTimeout,
   redactGitToken,
   type GitCredentials,
@@ -2331,6 +2333,10 @@ export class GitService implements IGitService {
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
+      // Branch-scoped, like the bytes route: a patch is a past version too,
+      // and leaving this route open would let a sha refused there be read
+      // here instead.
+      await this.assertOnBranchHistory(cwd, sha);
       // BOTH sides: at a commit that DELETES a directory the path is absent
       // at `sha` but a tree at `sha^` — and the diff of that deletion is
       // every child's content, exactly what the per-file gate never checked.
@@ -2382,6 +2388,10 @@ export class GitService implements IGitService {
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
+      // Same branch rule as the patch and the bytes: this route serves the
+      // FULL text of both sides, so it is the most generous of the three and
+      // the least safe one to leave ungated.
+      await this.assertOnBranchHistory(cwd, sha);
       await this.assertNotTreeAtRef(cwd, sha, repoRelativePath, relativePath);
       await this.assertNotTreeAtRef(cwd, `${sha}^`, repoRelativePath, relativePath);
       const current = await this.readFileAtRef(workspaceId, sha, repoRelativePath);
@@ -2949,7 +2959,53 @@ export class GitService implements IGitService {
       'fetch', '--no-write-fetch-head', 'origin',
       `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`,
       `+refs/heads/${headBranch}:refs/remotes/origin/${headBranch}`,
-    ]).catch(() => undefined);
+    ]).then(
+      () => void this.prFetchFailureLoggedAt.delete(cwd),
+      (err: unknown) => this.notePrFetchFailure(cwd, err),
+    );
+  }
+
+  /**
+   * When each working copy's change-request fetch failure was last logged.
+   * Holds only the working copies that are failing NOW: an entry goes the
+   * moment that copy reaches the remote again, so the table never outgrows the
+   * clones that cannot fetch, however many come and go over a process's life.
+   */
+  private readonly prFetchFailureLoggedAt = new Map<string, number>();
+
+  /**
+   * Say WHY a change request's branches could not be fetched, when the reason
+   * is not the one that is expected.
+   *
+   * The fetch stays best-effort, so the caller goes on to resolve the refs
+   * from whatever the clone already has. One failure is ordinary and says
+   * nothing: a branch that is gone from the remote, which is what a retired
+   * source branch looks like. Every OTHER failure is the working copy being
+   * unable to reach the remote at all — a credential it does not have, a host
+   * that does not answer — and swallowed, it resurfaced one step later as
+   * `unknown branch` for a branch that was sitting on the remote the whole
+   * time. A deployment logged that for every open change request on every
+   * list, and nothing in the log said the fetch had been refused.
+   *
+   * Logged once a minute per working copy at most: the list asks once per open
+   * request, and the reason is the same for all of them.
+   */
+  private notePrFetchFailure(cwd: string, err: unknown): void {
+    const message = err instanceof Error ? err.message : String(err);
+    if (isMissingRemoteBranchFailure(message)) {
+      // The remote answered, and said the branch is not there: this working
+      // copy reaches it, so whatever was logged about it before is over.
+      this.prFetchFailureLoggedAt.delete(cwd);
+      return;
+    }
+    const now = Date.now();
+    if (now - (this.prFetchFailureLoggedAt.get(cwd) ?? 0) < 60_000) return;
+    this.prFetchFailureLoggedAt.set(cwd, now);
+    log.warn(
+      `could not fetch change-request branches in the working copy "${path.basename(path.dirname(cwd))}": ` +
+        'a branch it has not seen will be reported as unknown, though it may be on the remote.',
+      { detail: redactGitToken(message, this.credentials.token()) },
+    );
   }
 
   /** Unified-diff patch for one file across the CR range (rename-aware). */
@@ -3269,6 +3325,143 @@ export class GitService implements IGitService {
     }
   }
 
+  /**
+   * A repo-relative file's BYTES at an arbitrary git ref — the binary sibling
+   * of {@link readFileAtRef}, with the blob's object id alongside them.
+   *
+   * `readFileAtRef` decodes stdout as UTF-8, which for a PNG or a PDF is not a
+   * lossless round trip: every byte sequence that is not valid UTF-8 comes
+   * back as U+FFFD and the file is ruined. A past version has to be delivered
+   * byte for byte, so this reads through `cat-file --batch`, whose framing is
+   * in BYTES (`<oid> <type> <size>\n<size bytes>\n`) rather than characters.
+   *
+   * One invocation, and absence is a PROTOCOL answer (`<spec> missing`) rather
+   * than a parsed error message — which also covers `<sha>^` of a root commit,
+   * where there is no "before" side at all. `null` therefore means exactly
+   * "nothing is at that path on that side".
+   *
+   * The `oid` is the content's own hash, so it is what the HTTP route uses as
+   * an ETag: cheaper than hashing the body again, and stable for a version
+   * that by definition can never change.
+   */
+  private async blobAtRef(
+    cwd: string,
+    ref: string,
+    repoRelativePath: string,
+  ): Promise<{ bytes: Buffer; blobId: string } | null> {
+    // The spec has to be ONE line: the path is refused a control character
+    // twice over before it gets here (at the route's normaliser and again at
+    // `assertValidRelativePath`), and this is the fence at the protocol —
+    // `--batch` would otherwise read `<sha>:Docs/x.md\nzzz` as two object
+    // names and answer about the first, under the gates of the second.
+    const spec = `${ref}:${repoRelativePath}`;
+    assertOneSpecPerLine([spec]);
+    const { stdout } = await this.gitBytes(cwd, ['cat-file', '--batch'], {
+      input: `${spec}\n`,
+    });
+    const nl = stdout.indexOf(0x0a);
+    if (nl < 0) throw new Error('unexpected end of git cat-file output');
+    // The spec may itself contain spaces (a KB file routinely does), hence the
+    // endsWith checks rather than a split — same protocol reading as the
+    // access resolver's `catFileBatch`.
+    const header = stdout.subarray(0, nl).toString('utf-8');
+    if (header.endsWith(' missing') || header.endsWith(' ambiguous')) return null;
+    const [blobId, type, rawSize] = header.split(' ');
+    // A tree here would be the per-file gate bypassed, and `assertNotTreeAtRef`
+    // is what refuses it before this runs; anything else non-blob (a tag, a
+    // commit) is not a file either. Nothing to serve in either case.
+    if (type !== 'blob' || blobId === undefined) return null;
+    const size = Number(rawSize);
+    if (!Number.isSafeInteger(size) || size < 0) {
+      throw new Error(`unexpected git cat-file header: ${header}`);
+    }
+    return { bytes: stdout.subarray(nl + 1, nl + 1 + size), blobId };
+  }
+
+  /**
+   * Refuse a sha that is not in the history of the branch this workspace has
+   * checked out.
+   *
+   * A file's past is served per BRANCH: the history panel lists what `git log`
+   * on this workspace's own branch touched, and every read of a past save has
+   * to stay inside that list. Without this, a sha lifted from another branch —
+   * or from a change request nobody approved — would be readable through the
+   * workspace of a branch whose history never contained it, which is the
+   * access rules of the viewed branch bypassed by a query parameter.
+   *
+   * `merge-base --is-ancestor` is the exact question, and a commit is its own
+   * ancestor, so the branch head passes. Exit 1 is git's answer for "resolved,
+   * and not an ancestor". An unresolvable object name — a made-up id — gets
+   * the SAME refusal on purpose (see {@link VersionNotOnBranchError}), but only
+   * when git's complaint NAMES that id; every other failure propagates, a
+   * broken repository included. A guard that fails open on its own errors is
+   * not a guard, and one that reports them as a refusal is worse than no
+   * message at all.
+   */
+  private async assertOnBranchHistory(cwd: string, sha: string): Promise<void> {
+    try {
+      await this.git(cwd, ['merge-base', '--is-ancestor', sha, 'HEAD']);
+    } catch (err) {
+      if (err instanceof GitRunError && !err.timedOut) {
+        if (err.exitCode === 1) throw new VersionNotOnBranchError();
+        const stderr = err.stderr ?? err.message;
+        if (
+          // The complaint has to be about THE SHA WE ASKED FOR. `HEAD` is the
+          // other argument, and git spells its own failures the same way: a
+          // repository with no commits answers "ambiguous argument 'HEAD'",
+          // which is a broken workspace, not a version off the branch.
+          // Refusing it as "not in this file's history" would hide an
+          // infrastructure failure behind a sentence about access.
+          stderr.toLowerCase().includes(sha.toLowerCase()) &&
+          // git's wording for "I cannot resolve that" varies by subcommand and
+          // by version — `merge-base` says "Not a valid commit name", others
+          // "not a valid object name" / "unknown revision" — so every spelling
+          // that means the same thing is listed rather than one guessed at.
+          /not a valid (object|commit) name|no such commit|bad object|unknown revision|malformed object name|ambiguous argument/i.test(
+            stderr,
+          )
+        ) {
+          throw new VersionNotOnBranchError();
+        }
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * One file's BYTES at a save, exactly as they were — the `after` side of
+   * `sha`, or the `before` side (`<sha>^`) for the save that deleted it.
+   *
+   * Every guard the text history surfaces apply, in the same order: the sha is
+   * a sha, the save is on this branch, and the pathspec is not a directory at
+   * that ref (a per-file gate upstream authorized one path, and a tree read
+   * would hand over every child). `null` means the file was not there on the
+   * side asked for.
+   *
+   * Runs inside the workspace's git turn — one turn for the whole read, so the
+   * ancestry check and the bytes it authorizes cannot be separated by another
+   * caller's checkout.
+   */
+  async fileBytesAtCommit(
+    workspaceId: string,
+    relativePath: string,
+    sha: string,
+    side: 'after' | 'before',
+  ): Promise<{ bytes: Buffer; blobId: string } | null> {
+    assertValidRelativePath(relativePath);
+    if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
+      throw new WorkflowValidationError('invalid commit sha');
+    }
+    const repoRelativePath = this.stripRepoPrefix(relativePath);
+    return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      await this.assertOnBranchHistory(cwd, sha);
+      const ref = side === 'before' ? `${sha}^` : sha;
+      await this.assertNotTreeAtRef(cwd, ref, repoRelativePath, relativePath);
+      return this.blobAtRef(cwd, ref, repoRelativePath);
+    });
+  }
+
   /**
    * The commits on `ref` that touched `repoRelativePath`, newest first, at
    * most `limit` of them. What a skill's `version` is looked up through: each
@@ -3377,6 +3570,27 @@ export class GitService implements IGitService {
       env: { GIT_LITERAL_PATHSPECS: '1', ...opts?.env },
     });
   }
+
+  /**
+   * {@link git}, with stdout as raw BYTES.
+   *
+   * A sibling rather than an `encoding` option on `git()` itself: every other
+   * caller in this service reads text, and the two return types (`string` vs
+   * `Buffer`) are not interchangeable at any call site. Same
+   * `GIT_LITERAL_PATHSPECS` and same runner deadline — the only difference is
+   * that the bytes are not decoded.
+   */
+  private gitBytes(
+    cwd: string,
+    args: string[],
+    opts?: Omit<GitRunOptions, 'encoding'>,
+  ): Promise<GitRunResult<Buffer>> {
+    return this.gitRunner.run(cwd, args, {
+      ...opts,
+      encoding: 'buffer',
+      env: { GIT_LITERAL_PATHSPECS: '1', ...opts?.env },
+    });
+  }
 }
 
 /** Map a git status letter (`git diff --name-status`) to the DTO's `PrFileStatus`. */

package/src/modules/workflow/pending-commits.service.ts

@@ -34,7 +34,7 @@
  *                                                    (status='needs_attention')
  */
 
-import { and, eq, inArray, isNull, min, or, sql } from 'drizzle-orm';
+import { and, eq, inArray, isNull, min, or, sql, type SQL } from 'drizzle-orm';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('pending-commits');
@@ -195,6 +195,7 @@ export class PendingCommitsService {
       .set({
         queuedAt: new Date(),
         authorEmail: email,
+        authorEmailBidx: email,
         authorName: input.authorName,
         // Reset transient counters — this is effectively a fresh enqueue.
         attempts: 0,
@@ -216,6 +217,7 @@ export class PendingCommitsService {
       branch: input.branch,
       path: input.path,
       authorEmail: email,
+      authorEmailBidx: email,
       authorName: input.authorName,
     });
   }
@@ -249,11 +251,13 @@ export class PendingCommitsService {
         ),
       );
     if ((rows[0]?.count ?? 0) > 0) return false;
+    const email = canonicalEmail(input.authorEmail);
     await this.db.insert(pendingCommits).values({
       workspaceId,
       branch: input.branch,
       path: input.path,
-      authorEmail: canonicalEmail(input.authorEmail),
+      authorEmail: email,
+      authorEmailBidx: email,
       authorName: input.authorName,
     });
     return true;
@@ -384,6 +388,64 @@ export class PendingCommitsService {
       .where(eq(pendingCommits.id, id));
   }
 
+  /**
+   * Take every commit still queued for `branch` out of the worker's reach and
+   * onto the admin surface, and answer how many moved.
+   *
+   * The one caller is the knowledge-base repository being REPLACED. A release
+   * ENQUEUES the bytes and only then drops its lock, so the moment the locks
+   * on a branch are dropped there may be rows already waiting — bytes that
+   * were written against a working copy of the repository that is gone. Left
+   * `pending`, the worker would pick them up after the re-clone and commit
+   * them onto a same-named branch of a DIFFERENT repository: someone else's
+   * file, overwritten by a change nobody made to it.
+   *
+   * `needs_attention`, not deleted — the same rule as everything else about a
+   * replacement. The bytes are still in the row, the reason is on it, and they
+   * show up on the pending-commit admin surface for a person to decide about.
+   * `running` rows go too: the worker checks the row back in when it finishes,
+   * and a row it is mid-flight with is exactly one whose destination just
+   * changed under it.
+   */
+  async markNeedsAttentionOnBranch(branch: string, error: string): Promise<number> {
+    return this.escalateQueued(eq(pendingCommits.branch, branch), error);
+  }
+
+  /** Every commit still queued that `which` selects goes to a person, with the reason. Answers how many. */
+  private async escalateQueued(which: SQL, error: string): Promise<number> {
+    const moved = await this.db
+      .update(pendingCommits)
+      .set({
+        status: 'needs_attention',
+        lastError: error,
+        lastAttemptedAt: new Date(),
+      })
+      .where(and(which, inArray(pendingCommits.status, ['pending', 'running'])))
+      .returning({ id: pendingCommits.id });
+    return moved.length;
+  }
+
+  /**
+   * The same, for every commit still queued against ONE WORKING COPY, and
+   * answer how many moved.
+   *
+   * The caller is the startup phase setting a working copy aside: a clone of
+   * a repository the configured one shares no history with. Whatever was
+   * queued for it was written against that clone, on any branch, the default
+   * one included, and the directory the worker would write to is now a fresh
+   * clone of another repository. Closing change requests covers the branches
+   * of the requests that were closed and nothing else, which is why this is
+   * keyed on the working copy: it is the thing that was replaced.
+   *
+   * A working copy that was only pointed at a new address (the same
+   * repository, moved) keeps its queue, and is never passed here.
+   */
+  async markNeedsAttentionInWorkspace(workspaceId: string, error: string): Promise<number> {
+    // The canonical form `enqueue` stores (see `canonicalWorkspaceId`), so the
+    // caller's spelling of the id cannot make this match nothing.
+    return this.escalateQueued(eq(pendingCommits.workspaceId, canonicalWorkspaceId(workspaceId)), error);
+  }
+
   /**
    * When the oldest commit still waiting to land was queued, or null when
    * nothing waits — the readiness answer's one number. `pending` and

package/src/modules/workflow/recovery-bot.ts

@@ -41,8 +41,12 @@ export const RECOVERY_BOT_NAME = 'Bevel Recovery Bot';
 export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
   const inserted = await db
     .insert(users)
-    .values({ email: RECOVERY_BOT_EMAIL, name: RECOVERY_BOT_NAME })
-    .onConflictDoNothing({ target: users.email })
+    .values({
+      email: RECOVERY_BOT_EMAIL,
+      emailBidx: RECOVERY_BOT_EMAIL,
+      name: RECOVERY_BOT_NAME,
+    })
+    .onConflictDoNothing({ target: users.emailBidx })
     .returning();
   if (inserted.length > 0) {
     const row = inserted[0];
@@ -57,7 +61,7 @@ export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
   const [row] = await db
     .select()
     .from(users)
-    .where(eq(users.email, RECOVERY_BOT_EMAIL))
+    .where(eq(users.emailBidx, RECOVERY_BOT_EMAIL))
     .limit(1);
   if (!row) {
     // Vanishingly unlikely: the row exists for the conflict to fire but is

package/src/modules/workflow/review-workflow/__tests__/carry-approvals-forward.test.ts

@@ -247,6 +247,9 @@ describe('ReviewWorkflowService.carryApprovalsForward', () => {
         prNumber: PR,
         path: 'Sales/Terms.md',
         approverEmail: 'carol@bevel.software',
+        // The index column of a copied row is written with the address, not
+        // with the stored index read back beside it.
+        approverEmailBidx: 'carol@bevel.software',
         approverName: 'Carol',
         headSha: NEW_HEAD,
         // The reviewer approved THEN, not now — the merge is not an approval.
@@ -256,6 +259,7 @@ describe('ReviewWorkflowService.carryApprovalsForward', () => {
         prNumber: PR,
         path: 'Sales/Pricing.md',
         approverEmail: 'bob@bevel.software',
+        approverEmailBidx: 'bob@bevel.software',
         approverName: 'Bob',
         headSha: NEW_HEAD,
         approvedAt: APPROVED_AT,

package/src/modules/workflow/review-workflow/__tests__/erase-approver.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect } from 'vitest';
+import type { SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
 import { ReviewWorkflowService } from '../review-workflow.service.js';
 import type { ApprovalTx } from '../review-workflow.interface.js';
 
@@ -34,6 +36,8 @@ function harness() {
   const locked: unknown[][] = [];
   const lockSql: string[] = [];
   const sets: unknown[] = [];
+  /** The condition each rewrite was limited to, as the SQL and values it sends. */
+  const wheres: { sql: string; params: unknown[] }[] = [];
   const tx = {
     execute: async (statement: { queryChunks?: unknown[] }) => {
       const text = statementText(statement);
@@ -48,8 +52,9 @@ function harness() {
     },
     update: (table: unknown) => ({
       set: (values: unknown) => ({
-        where: async () => {
+        where: async (condition: SQL) => {
           sets.push(values);
+          wheres.push(new PgDialect().sqlToQuery(condition));
           order.push(`update:${tableOf(table)}`);
         },
       }),
@@ -58,7 +63,7 @@ function harness() {
   // `eraseApprover` touches nothing but the transaction it is given, so the
   // service's own collaborators are never reached.
   const svc = new ReviewWorkflowService({} as never, {} as never, {} as never, {} as never);
-  return { svc, tx: tx as unknown as ApprovalTx, order, locked, lockSql, sets };
+  return { svc, tx: tx as unknown as ApprovalTx, order, locked, lockSql, sets, wheres };
 }
 
 describe('ReviewWorkflowService.eraseApprover', () => {
@@ -79,6 +84,23 @@ describe('ReviewWorkflowService.eraseApprover', () => {
     expect(h.lockSql[0]).toContain('pg_advisory_xact_lock');
     expect(h.lockSql[0]).not.toMatch(/pg_advisory_lock\b/);
     // And the rewrite is to the placeholder identity it was given.
-    expect(h.sets).toEqual([{ approverEmail: 'deleted-1@erased.invalid', approverName: 'Deleted user' }]);
+    // The blind index is rewritten with the email: nothing keyed to the
+    // erased address may survive, and the email itself is ciphertext. The
+    // index column is written with the address; the handle indexes it.
+    expect(h.sets).toEqual([
+      {
+        approverEmail: 'deleted-1@erased.invalid',
+        approverEmailBidx: 'deleted-1@erased.invalid',
+        approverName: 'Deleted user',
+      },
+    ]);
+    // WHICH rows: the ones whose blind index is the erased address's. The
+    // address column holds randomized ciphertext, so a match on it finds
+    // nothing — the rewrite would report success having rewritten no row, and
+    // every approval of the erased person would keep their name.
+    expect(h.wheres).toHaveLength(1);
+    expect(h.wheres[0]!.sql).toMatch(/"approver_email_bidx" = \$1$/);
+    expect(h.wheres[0]!.sql).not.toMatch(/"approver_email" =/);
+    expect(JSON.stringify(h.wheres[0]!.params)).toContain('bob@bevel.software');
   });
 });