@bevel-software/platform-core-backend 0.25.2 → 0.26.0

package/src/modules/workflow/git/__tests__/git.service.mergeChangeRequest.test.ts

@@ -9,6 +9,7 @@ import type { AuthUser } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
+import { mergeCommitSubject } from '../merge-commit.js';
 
 const execFileAsync = promisify(execFile);
 const BASE = 'current-company-state';
@@ -103,6 +104,9 @@ describe('GitService.mergeChangeRequest', () => {
     expect(result.kind).toBe('merged');
     if (result.kind !== 'merged') return;
     expect(result.sha).toMatch(/^[0-9a-f]{40}$/);
+    // A commit of this request's own was written: it IS the state the target is
+    // left at here, and it is what the row may record as the merge commit.
+    expect(result.mergeCommit).toBe(result.sha);
 
     // The merge landed on origin/BASE: a fresh clone sees the feature file and a
     // merge commit authored by the human triggerer.
@@ -115,6 +119,336 @@ describe('GitService.mergeChangeRequest', () => {
     expect(log).toContain('Add feature (#1)');
   });
 
+  // cubic P1 on #347. When the target already contains the source there is
+  // nothing to merge, so no commit is written and `sha` is the TARGET TIP —
+  // whatever landed on the target last, which in a deployment that lands
+  // everything through change requests is usually ANOTHER request's merge commit.
+  // Answering `mergeCommit: null` is what stops the row recording it as this
+  // request's own: a reader that took it would answer with that other request's
+  // files under this request's number. The fixture puts request #1's merge commit
+  // on the tip for exactly that reason.
+  it('owns NO merge commit when there was nothing to merge, not even the one on the tip', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    // Another request lands first, so the target tip is a real merge commit whose
+    // subject names #1.
+    await pushFeatureBranch(root, upstream, 'bob/first', async (dir) => {
+      await fs.writeFile(path.join(dir, 'first.md'), 'first\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const first = await git.mergeChangeRequest(
+      baseWsId, 'bob/first', BASE, { subject: mergeCommitSubject('First', 1), body: 'x' }, USER,
+      { appliedChangeNumber: 1 },
+    );
+    expect(first.kind).toBe('merged');
+
+    // A branch the target already contains: branched and pushed with no commit of
+    // its own, so the merge has nothing to do. (`pushFeatureBranch` always
+    // commits, which is the one thing this case must not do.)
+    const emptyDir = path.join(root, 'feat-empty');
+    await runGit(root, ['clone', '-b', BASE, upstream, emptyDir]);
+    await runGit(emptyDir, ['checkout', '-b', 'alice/empty']);
+    await runGit(emptyDir, ['push', '-u', 'origin', 'alice/empty']);
+
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/empty', BASE,
+      { subject: mergeCommitSubject('Nothing to do', 2), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 2 },
+    );
+
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+    // Asked for #2's own merge commit and there is none — the one on the tip is
+    // #1's, and it is not offered in its place.
+    expect(result.mergeCommit).toBeNull();
+    // The sha it reports is the target tip, which is #1's merge commit.
+    const verify = path.join(root, 'verify-empty');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['rev-parse', 'HEAD'])).trim()).toBe(result.sha);
+    expect(await gitOut(verify, ['log', '-1', '--format=%s'])).toContain('(#1)');
+  });
+
+  /**
+   * cubic P2 on #347. The push and the row update are two steps, and a transient
+   * database fault between them leaves the merge commit ON the target with the
+   * row still open. The retry then finds nothing to merge — and if that answered
+   * "no merge commit", the row would record none, and the request would be
+   * permanently fileless (author-only) with the commit holding its files sitting
+   * on the target unreferenced.
+   */
+  it('recovers the merge commit a previous attempt pushed but never recorded', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merge = () =>
+      git.mergeChangeRequest(
+        baseWsId, 'alice/add', BASE,
+        { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+        { appliedChangeNumber: 7 },
+      );
+
+    // Attempt one succeeds in git; imagine the row update failing right here.
+    const first = await merge();
+    expect(first.kind).toBe('merged');
+    if (first.kind !== 'merged') return;
+    const pushed = first.mergeCommit;
+    expect(pushed).toBe(first.sha);
+
+    // Attempt two: the target already contains the source, so nothing is staged
+    // and no new commit is written — but #7 does own a merge commit, and it is
+    // the one the first attempt pushed.
+    const second = await merge();
+    expect(second.kind).toBe('merged');
+    if (second.kind !== 'merged') return;
+    expect(second.mergeCommit).toBe(pushed);
+
+    // Nothing new was pushed: the target is still at that same commit.
+    const verify = path.join(root, 'verify-retry');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['rev-parse', 'HEAD'])).trim()).toBe(pushed);
+  });
+
+  // The same ownership question, asked WITHOUT a merge — the form the approval
+  // gate needs, because the gate refuses the retry before any merge runs. It
+  // must hold in the two conditions that are true by then: the source branch is
+  // retired, and the clone asking is not the clone that pushed.
+  it('finds the merge commit a request owns on the target from another clone, with no source branch left', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    // Cloned BEFORE the merge, so it can only know the commit by fetching.
+    const staleWsId = 'stale';
+    const staleRepo = path.join(root, staleWsId, 'knowledge-base');
+    await fs.mkdir(path.join(root, staleWsId), { recursive: true });
+    await runGit(root, ['clone', '-b', BASE, upstream, staleRepo]);
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+
+    // Retired, as applying a change request retires it.
+    await runGit(root, ['-C', upstream, 'branch', '-D', 'alice/add']);
+
+    const stale = new GitService(stubWorkspaceService(staleWsId, staleRepo), new WorkflowHooks(), testKbContext());
+    expect(await stale.appliedMergeCommitOnTarget(staleWsId, BASE, 7)).toBe(merged.mergeCommit);
+    // A number nothing on the target was merged under owns nothing.
+    expect(await stale.appliedMergeCommitOnTarget(staleWsId, BASE, 8)).toBeNull();
+  });
+
+  it('still finds the commit behind any number of newer merges on a busy target', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+
+    // Twenty-five merges land on the target after it — more than the fixed
+    // count the probe once stopped at, which left a stuck request on a busy
+    // branch un-finalizable for good.
+    const busy = path.join(root, 'busy');
+    await runGit(root, ['clone', '-b', BASE, upstream, busy]);
+    for (let i = 0; i < 25; i += 1) {
+      await runGit(busy, ['checkout', '-b', `other-${i}`]);
+      await fs.writeFile(path.join(busy, `other-${i}.md`), `${i}\n`);
+      await runGit(busy, ['add', '-A']);
+      await runGit(busy, ['commit', '-m', `work ${i}`]);
+      await runGit(busy, ['checkout', BASE]);
+      await runGit(busy, ['merge', '--no-ff', '-m', `Other change ${i} (#${100 + i})`, `other-${i}`]);
+    }
+    await runGit(busy, ['push', 'origin', BASE]);
+
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBe(merged.mergeCommit);
+    // Twenty-five merges are a hundred and fifty git processes; slow on a
+    // loaded Windows runner, so this one gets its own budget.
+  }, 120_000);
+
+  it('recognises a merge commit an earlier release wrote with the title unflattened, given the stored title', async () => {
+    // Before titles were flattened, a title with a blank line put `(#N)` after
+    // git's one-paragraph subject, and such rows read as author-only. The row
+    // still holds the title, which is what names the commit now.
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const title = 'Add feature\n\nand a note';
+    const old = path.join(root, 'old-format');
+    await runGit(root, ['clone', '-b', BASE, upstream, old]);
+    await runGit(old, ['merge', '--no-ff', '-m', `${title} (#5)`, '-m', 'Merged via Bevel', 'origin/alice/add']);
+    await runGit(old, ['push', 'origin', BASE]);
+    const sha = (await gitOut(old, ['rev-parse', 'HEAD'])).trim();
+    expect((await gitOut(old, ['log', '-1', '--format=%s'])).trim()).toBe('Add feature');
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    // With the title: the commit is the request's own, on the target and by sha.
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5, title)).toBe(sha);
+    expect(await git.appliedChangeShas(baseWsId, { number: 5, mergeSha: sha, title }))
+      .toMatchObject({ baseSha: expect.any(String), headSha: expect.any(String) });
+    // Without it, nothing vouches for a number that is not where the subject
+    // rule looks — and another title does not either.
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5)).toBeNull();
+    await expect(git.appliedChangeShas(baseWsId, { number: 5, mergeSha: sha })).rejects.toThrow(/not the merge commit/);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5, 'Add feature')).toBeNull();
+  });
+
+  it('does not take a current-format commit of another request for one whose title merely contains its number', async () => {
+    // Request 43, titled `Fix crash (#42)`, merges as `Fix crash (#42) (#43)`.
+    // Asked for request 42 with the stored title `Fix crash`, the old-format
+    // rule must refuse it: 42's number is not at the end of the line there.
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Fix crash (#42)', 43), body: 'x' }, USER,
+      { appliedChangeNumber: 43 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 43)).toBe(merged.mergeCommit);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 42, 'Fix crash')).toBeNull();
+    await expect(git.appliedChangeShas(baseWsId, { number: 42, mergeSha: merged.sha, title: 'Fix crash' })).rejects.toThrow(
+      /not the merge commit/,
+    );
+  });
+
+  // One variable at a time, because the two halves of the P1 are not the same
+  // claim. With the remote REACHABLE, a missing tracking ref is not a hazard at
+  // all: the refresh names its destination explicitly, so it recreates the ref
+  // and the walk has what it needs. With the remote UNREACHABLE, there is no
+  // authority for an answer, and the stale ref the clone still holds must not be
+  // scanned — what the caller does with a commit is record it as the request's
+  // published state, and a ref it could not refresh may name a commit the
+  // published branch no longer carries (cubic P1 on #347).
+  it('recreates a missing tracking ref, and refuses to read a stale one', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+    // The commit IS in this clone, and origin/BASE names it.
+    expect((await gitOut(baseRepo, ['rev-parse', `origin/${BASE}`])).trim()).toBe(merged.mergeCommit);
+
+    // Variable 1: no tracking ref, remote reachable. The refresh brings it back.
+    await runGit(baseRepo, ['update-ref', '-d', `refs/remotes/origin/${BASE}`]);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBe(merged.mergeCommit);
+    expect((await gitOut(baseRepo, ['rev-parse', `origin/${BASE}`])).trim()).toBe(merged.mergeCommit);
+
+    // Variable 2: tracking ref present and naming the commit, remote gone. No
+    // authority, no answer — the ref is not scanned.
+    await runGit(baseRepo, ['remote', 'set-url', 'origin', path.join(root, 'gone.git')]);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBeNull();
+  });
+
+  // The merge commit a later attempt recovers is matched on the number alone, so
+  // a request that landed a DIFFERENT change under its own number is not offered
+  // another request's commit — and `git log --grep` finding the number in a
+  // BODY is not enough either, since the subject check still has to pass.
+  it('does not mistake a mention of the number in a merge body for the request\'s own commit', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'bob/first', async (dir) => {
+      await fs.writeFile(path.join(dir, 'first.md'), 'first\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    // #1's merge commit, whose BODY mentions #9 — the shape `--grep` matches and
+    // the subject check must reject.
+    await git.mergeChangeRequest(
+      baseWsId, 'bob/first', BASE,
+      { subject: mergeCommitSubject('First', 1), body: 'Supersedes the work in (#9)' }, USER,
+      { appliedChangeNumber: 1 },
+    );
+
+    const emptyDir = path.join(root, 'feat-empty-9');
+    await runGit(root, ['clone', '-b', BASE, upstream, emptyDir]);
+    await runGit(emptyDir, ['checkout', '-b', 'alice/empty']);
+    await runGit(emptyDir, ['push', '-u', 'origin', 'alice/empty']);
+
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/empty', BASE, { subject: mergeCommitSubject('Nothing', 9), body: 'x' }, USER,
+      { appliedChangeNumber: 9 },
+    );
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+    expect(result.mergeCommit).toBeNull();
+  });
+
+  /**
+   * `git commit -m` takes the FIRST PARAGRAPH of the message as the subject, so a
+   * blank line inside it pushes `(#N)` into the body — where `%s` never reports
+   * it and the applied request's reader cannot find it (cubic P2 on #347).
+   * `mergeCommitSubject` flattens the title it builds from; this is the guard
+   * against any other caller reintroducing the break.
+   */
+  it('refuses a subject that is more than one paragraph, before touching the clone', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    await expect(
+      git.mergeChangeRequest(
+        baseWsId, 'alice/add', BASE, { subject: 'Add feature\n\nand a note (#3)', body: 'x' }, USER,
+      ),
+    ).rejects.toThrow(/single paragraph/);
+
+    // Nothing was merged or pushed.
+    const verify = path.join(root, 'verify-subject');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    await expect(fs.readFile(path.join(verify, 'feature.md'), 'utf8')).rejects.toThrow();
+  });
+
+  // A title with a blank line in it reaches here (titles are stored `.trim()`-ed
+  // and the tool schema bounds only their length), and the whole read-back of an
+  // applied request hangs on the number being ON the subject git reports.
+  it('keeps the number on the subject when the title itself spans paragraphs', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature\n\nand a note', 4), body: 'x' }, USER,
+      { appliedChangeNumber: 4 },
+    );
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+
+    const verify = path.join(root, 'verify-flat');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['log', '-1', '--format=%s'])).trim())
+      .toBe('Add feature and a note (#4)');
+    // Which is what lets the request be recognised as the owner of this commit:
+    // the same read that would otherwise refuse it as "not the merge commit of
+    // change request #4" and leave the applied request fileless.
+    expect(await git.appliedChangeShas(baseWsId, { number: 4, mergeSha: result.sha }))
+      .toMatchObject({ baseSha: expect.any(String), headSha: expect.any(String) });
+  });
+
   it('returns the conflicting paths when base and source both changed a file', async () => {
     const { upstream, baseWsId, baseRepo } = await seed(root, { 'shared.md': 'original\n' });
     // Source edits shared.md one way…

package/src/modules/workflow/git/__tests__/pull-request.service.list-fetch.test.ts

@@ -5,6 +5,7 @@ import type { Database } from '../../../database/connection.js';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import type { GitService } from '../git.service.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
+import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 /**
  * What a change-request LIST is allowed to cost.
@@ -47,8 +48,13 @@ function harness(rows = [row(1, 'suggestions/a/knowledge'), row(2, 'suggestions/
       }),
     }),
   } as unknown as Database;
-  const changedPathsForPr = vi.fn(async () => ['Shared/one.pdf']);
-  const git = { changedPathsForPr } as unknown as GitService;
+  // The summary builder asks for the flat paths AND the rename-aware pairs in
+  // one call, so this is the method the per-request cost now lands on.
+  const changedPathsForPr = vi.fn(async () => ({
+    paths: ['Shared/one.pdf'],
+    pairs: [{ path: 'Shared/one.pdf' }],
+  }));
+  const git = { changedPathsAndPairsForPr: changedPathsForPr } as unknown as GitService;
   const ensureRemotesFetched = vi.fn(async () => undefined);
   const workspace = {
     findAnyWorkspaceId: async () => 'ws-main',
@@ -119,3 +125,67 @@ describe('the change-request list refreshes the clone once, not once per request
     expect(changedPathsForPr).toHaveBeenCalledTimes(2);
   });
 });
+
+/**
+ * What a list of APPLIED requests is allowed to cost. Each is read from its
+ * merge commit, which asks git four times per row and never the network. A
+ * merge commit cannot change, so the second list must not ask git again.
+ */
+describe('the list of applied requests reads each merge commit once', () => {
+  const applied = (number: number) => ({
+    ...row(number, `suggestions/${number}/knowledge`),
+    state: 'merged',
+    mergedSha: `${number}`.padStart(40, 'a'),
+    closedAt: new Date('2026-09-19T00:00:00Z'),
+  });
+
+  function appliedHarness(rows: ReturnType<typeof applied>[]) {
+    const db = {
+      select: () => ({
+        from: () => ({
+          where: () => ({ orderBy: async () => rows, limit: async () => rows }),
+        }),
+      }),
+    } as unknown as Database;
+    const ofAppliedChange = vi.fn(async (_w: string, ref: { number: number }) => ({
+      paths: [`Shared/${ref.number}.md`],
+      pairs: [{ path: `Shared/${ref.number}.md` }],
+    }));
+    const git = { changedPathsAndPairsOfAppliedChange: ofAppliedChange } as unknown as GitService;
+    const ensureRemotesFetched = vi.fn(async () => undefined);
+    const workspace = {
+      findAnyWorkspaceId: async () => 'ws-main',
+      ensureRemotesFetched,
+    } as unknown as WorkspaceService;
+    const access = {} as unknown as IAccessControl;
+    return { svc: new PullRequestService(db, workspace, access, git), ofAppliedChange, ensureRemotesFetched };
+  }
+
+  it('asks git once per request, however often the list is read, and refreshes the clone once per list — never per row', async () => {
+    const { svc, ofAppliedChange, ensureRemotesFetched } = appliedHarness([applied(1), applied(2), applied(3)]);
+
+    const first = await svc.listPrsByState(['merged']);
+    const second = await svc.listPrsByState(['merged']);
+
+    expect(first.map((s) => s.touchedNodePaths)).toEqual([['Shared/1.md'], ['Shared/2.md'], ['Shared/3.md']]);
+    expect(second).toEqual(first);
+    expect(ofAppliedChange).toHaveBeenCalledTimes(3);
+    // One refresh per LIST (TTL-cached underneath), not one per row: a merge
+    // commit cannot change, but a clone that has not fetched since the merge
+    // does not hold it, and would read every applied request as author-only.
+    expect(ensureRemotesFetched).toHaveBeenCalledTimes(2);
+  });
+
+  it('asks again for a merge commit the clone did not hold the first time', async () => {
+    const { svc, ofAppliedChange } = appliedHarness([applied(1)]);
+    ofAppliedChange.mockRejectedValueOnce(new WorkflowValidationError('commit is not in this clone'));
+
+    const before = await svc.listPrsByState(['merged']);
+    const after = await svc.listPrsByState(['merged']);
+
+    // Fail-closed while the commit is missing, answered once it is there.
+    expect(before[0].touchedNodePaths).toEqual([]);
+    expect(after[0].touchedNodePaths).toEqual(['Shared/1.md']);
+    expect(ofAppliedChange).toHaveBeenCalledTimes(2);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.placeholder.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { isFolderPlaceholder } from '@bevel-software/platform-shared';
 
 import { PullRequestService } from '../pull-request.service.js';
 import type { Database } from '../../../database/connection.js';
@@ -40,8 +41,19 @@ describe('PullRequestService summaries — folder placeholder', () => {
         }),
       }),
     } as unknown as Database;
-    const changedPathsForPr = vi.fn(async () => paths);
-    const git = { changedPathsForPr } as unknown as GitService;
+    // The real `changedPathPairs` drops the placeholder (it is never a file
+    // anybody reads) while the flat list keeps it for the empty-request check,
+    // so the double answers both the way the service does. It borrows the
+    // production predicate rather than spelling one out: `isFolderPlaceholder`
+    // matches on the BASENAME, so a root-level `.gitkeep` is a placeholder too,
+    // and both of the real readers drop `roles.yaml`.
+    const changedPathsForPr = vi.fn(async () => ({
+      paths: paths.filter((p) => p !== 'roles.yaml'),
+      pairs: paths
+        .filter((p) => !isFolderPlaceholder(p) && p !== 'roles.yaml')
+        .map((path) => ({ path })),
+    }));
+    const git = { changedPathsAndPairsForPr: changedPathsForPr } as unknown as GitService;
     const workspace = {
       findAnyWorkspaceId: async () => 'ws-main',
       ensureRemotesFetched: async () => undefined,
@@ -76,4 +88,14 @@ describe('PullRequestService summaries — folder placeholder', () => {
     const { svc } = harness(['Elsewhere/.gitkeep']);
     expect(await svc.listPrsForOwnerEmail('ws-main', 'bob@bevel.software', { fresh: true })).toEqual([]);
   });
+
+  it('a placeholder at the ROOT is a placeholder too, on both views of the summary', async () => {
+    // `isFolderPlaceholder` matches the basename, so `.gitkeep` with no folder
+    // in front of it is the same non-file — the corner a filter spelled
+    // `endsWith('/.gitkeep')` would get wrong on both the paths and the pairs.
+    const { svc } = harness(['.gitkeep', 'Reports/q3.md']);
+    const [summary] = await svc.listOpenPrs({ fresh: true });
+    expect(summary.touchedNodePaths).toEqual(['Reports/q3.md']);
+    expect(summary.touchedNodeFiles).toEqual([{ path: 'Reports/q3.md' }]);
+  });
 });