@bevel-software/platform-core-backend 0.25.2 → 0.27.0

package/src/modules/workflow/git/__tests__/git.service.changedFilesForPr.test.ts

@@ -517,3 +517,127 @@ describe('GitService.changedPathsForPr: who pays for the fetch', () => {
     ).toEqual(['brief.pdf']);
   });
 });
+
+/**
+ * `changedPathsAndPairsForPr` is what a change-request SUMMARY is built from,
+ * and `changedFilesForPr` is what its DETAIL is built from. A read gate decides
+ * visibility over each — so if they ever describe different files, or pair a
+ * rename differently, a list advertises requests its own detail answers 404 for.
+ * That happened (ticket log, attempt 2: the list judged the flat path list,
+ * which names a rename by its new path alone), so the agreement is asserted
+ * here against a real repository rather than assumed.
+ */
+describe('GitService.changedPathsAndPairsForPr agrees with changedFilesForPr', () => {
+  let root: string;
+  const workspaceId = 'current-company-state';
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-pr-pairs-'));
+  });
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true }).catch(() => {});
+  });
+
+  /** The two file sets, each reduced to `path` + `previousPath`, sorted. */
+  async function bothViews(git: GitService, branch: string) {
+    const files = await git.changedFilesForPr(workspaceId, 'current-company-state', branch);
+    const { paths, pairs } = await git.changedPathsAndPairsForPr(
+      workspaceId,
+      'current-company-state',
+      branch,
+    );
+    const key = (f: { path: string; previousPath?: string }) => `${f.path}<=${f.previousPath ?? ''}`;
+    return {
+      detail: files.map(key).sort(),
+      summary: pairs.map(key).sort(),
+      paths: paths.sort(),
+    };
+  }
+
+  it('pairs a rename the same way, and the flat paths still name only the new side', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await fs.mkdir(path.join(repo, 'Engineering'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'Engineering/note.md'), 'one\ntwo\nthree\n');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'note']);
+    await runGit(repo, ['push', 'origin', 'current-company-state']);
+    await runGit(repo, ['checkout', '-b', 'alice/moved']);
+    await fs.mkdir(path.join(repo, 'GTM'), { recursive: true });
+    await runGit(repo, ['mv', 'Engineering/note.md', 'GTM/note.md']);
+    await runGit(repo, ['commit', '-m', 'move it']);
+    await runGit(repo, ['push', '-u', 'origin', 'alice/moved']);
+
+    const git = new GitService(stubWorkspaceService(workspaceId, repo), new WorkflowHooks(), testKbContext());
+    const { detail, summary, paths } = await bothViews(git, 'alice/moved');
+
+    expect(summary).toEqual(['GTM/note.md<=Engineering/note.md']);
+    expect(summary).toEqual(detail);
+    // And this is exactly why the pairs are needed: the flat list cannot say
+    // the file came out of `Engineering/`.
+    expect(paths).toEqual(['GTM/note.md']);
+  });
+
+  it('agrees on a mixed change: add, modify, delete and rename together', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await fs.writeFile(path.join(repo, 'old-home.md'), 'a\nb\nc\nd\ne\n');
+    await fs.writeFile(path.join(repo, 'doomed.md'), 'goes away\n');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'seed more']);
+    await runGit(repo, ['push', 'origin', 'current-company-state']);
+    await runGit(repo, ['checkout', '-b', 'alice/mixed']);
+    await runGit(repo, ['mv', 'old-home.md', 'new-home.md']);
+    await fs.rm(path.join(repo, 'doomed.md'));
+    await fs.writeFile(path.join(repo, 'base.md'), 'base changed\n');
+    await fs.writeFile(path.join(repo, 'fresh.md'), 'new\n');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'mixed']);
+    await runGit(repo, ['push', '-u', 'origin', 'alice/mixed']);
+
+    const git = new GitService(stubWorkspaceService(workspaceId, repo), new WorkflowHooks(), testKbContext());
+    const { detail, summary } = await bothViews(git, 'alice/mixed');
+    expect(summary).toEqual(detail);
+    expect(summary).toContain('new-home.md<=old-home.md');
+  });
+
+  it('agrees that roles.yaml and the folder placeholder are not files of the request', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await runGit(repo, ['checkout', '-b', 'alice/config']);
+    await fs.writeFile(path.join(repo, 'roles.yaml'), 'roles:\n  Admin:\n    - a@x.io\n');
+    await fs.mkdir(path.join(repo, 'Reports'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'Reports/.gitkeep'), '');
+    await fs.writeFile(path.join(repo, 'Reports/q3.md'), 'one\n');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'config + folder']);
+    await runGit(repo, ['push', '-u', 'origin', 'alice/config']);
+
+    const git = new GitService(stubWorkspaceService(workspaceId, repo), new WorkflowHooks(), testKbContext());
+    const { detail, summary, paths } = await bothViews(git, 'alice/config');
+    expect(summary).toEqual(['Reports/q3.md<=']);
+    expect(summary).toEqual(detail);
+    // The flat list keeps the placeholder — it is the authoritative
+    // empty-request check — which is a third reason not to gate reads on it.
+    expect(paths).toContain('Reports/.gitkeep');
+  });
+
+  it('agrees an empty file replaced by the placeholder is the file\'s removal', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await fs.mkdir(path.join(repo, 'Reports'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'Reports/empty.md'), '');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'empty file']);
+    await runGit(repo, ['push', 'origin', 'current-company-state']);
+    await runGit(repo, ['checkout', '-b', 'alice/emptied']);
+    await fs.rm(path.join(repo, 'Reports/empty.md'));
+    await fs.writeFile(path.join(repo, 'Reports/.gitkeep'), '');
+    await runGit(repo, ['add', '-A']);
+    await runGit(repo, ['commit', '-m', 'emptied']);
+    await runGit(repo, ['push', '-u', 'origin', 'alice/emptied']);
+
+    const git = new GitService(stubWorkspaceService(workspaceId, repo), new WorkflowHooks(), testKbContext());
+    const { detail, summary } = await bothViews(git, 'alice/emptied');
+    // `withoutPlaceholderRename` runs on both sides, so neither reports a
+    // rename onto `.gitkeep` and neither loses the removed file.
+    expect(summary).toEqual(['Reports/empty.md<=']);
+    expect(summary).toEqual(detail);
+  });
+});

package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts

@@ -12,6 +12,7 @@ import type { IAccessControl } from '../../../access/access-control.interface.js
 import { GitService } from '../git.service.js';
 import {
   BranchAuthorshipError,
+  BranchDeleteRefusedError,
   ProtectedBranchError,
   WorkflowValidationError,
 } from '../../../../shared/domain-errors.js';
@@ -182,6 +183,57 @@ describe('GitService.deleteBranch — authorship + remote delete', () => {
     expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
   });
 
+  it('when the host refuses the remote deletion, deletes nothing and says so (409, no git output)', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    // The host turns every push away, as GitHub did during its incident.
+    const hook = path.join(upstream, 'hooks', 'pre-receive');
+    await fs.writeFile(hook, '#!/bin/sh\necho "Internal Server Error" >&2\nexit 1\n');
+    await fs.chmod(hook, 0o755);
+    const svc = makeService();
+
+    const err = await svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(BranchDeleteRefusedError);
+    const refusal = err as BranchDeleteRefusedError;
+    expect(refusal.status).toBe(409);
+    expect(refusal.message).toBe(
+      'The repository host refused to delete "alice/my-draft"; it is still there. Try again later.',
+    );
+    expect(JSON.stringify({ ...refusal.payload, error: refusal.message })).not.toMatch(
+      /Internal Server Error|remote rejected|pre-receive|upstream\.git/,
+    );
+    // Still there — remotely AND locally.
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(true);
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('refs/heads/alice/my-draft');
+  });
+
+  it('when the host cannot be reached, the local branch stays too', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'gone.git')]);
+    const svc = makeService();
+
+    await expect(svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE)).rejects.toBeInstanceOf(
+      BranchDeleteRefusedError,
+    );
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('refs/heads/alice/my-draft');
+  });
+
+  it('deletes the remote branch even when this clone has no tracking ref for it (pushed from elsewhere since the last fetch)', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    await runGit(repo, ['update-ref', '-d', 'refs/remotes/origin/alice/my-draft']);
+    const svc = makeService();
+
+    await svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE);
+
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('');
+  });
+
   it("refuses when the user isn't the author — leaves the remote ref intact", async () => {
     const { upstream } = await seedWorkspace(root, workspaceId);
     const svc = makeService();
@@ -318,3 +370,115 @@ describe('GitService.deleteBranch — authorship + remote delete', () => {
     ).rejects.toBeInstanceOf(ProtectedBranchError);
   });
 });
+
+/**
+ * The pieces an agent's `delete_branch` and the leftover cleanup decide with:
+ * where a branch stands against the default branch, whether a commit is
+ * contained in another, and a delete leased on the tip the checks saw.
+ */
+describe('GitService — branch state for a checked delete', () => {
+  let root: string;
+  const workspaceId = 'target-company-state';
+
+  beforeEach(async () => {
+    root = await mkTmpRoot();
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  function makeService(): GitService {
+    return new GitService(
+      stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
+      new WorkflowHooks(),
+      testKbContext(),
+    );
+  }
+
+  /** Push `n` commits onto `branch` from a separate clone, as a colleague would. */
+  async function pushCommits(upstream: string, branch: string, n: number): Promise<string> {
+    const other = path.join(root, `.other-${Math.random().toString(36).slice(2)}`);
+    await runGit(root, ['clone', '-b', branch, upstream, other]);
+    for (let i = 0; i < n; i++) await runGit(other, ['commit', '--allow-empty', '-m', `work ${i}`]);
+    await runGit(other, ['push', 'origin', branch]);
+    return gitOut(other, ['rev-parse', 'HEAD']);
+  }
+
+  it('counts the commits not on the default branch, and reads the tip', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    const tip = await pushCommits(upstream, 'bob/other-draft', 3);
+    await runGit(repo, ['fetch', 'origin']);
+    const svc = makeService();
+
+    const state = await svc.branchState(workspaceId, 'bob/other-draft', 'target-company-state');
+    expect(state).toEqual({ exists: true, lastCommit: tip, unmergedCommits: 3 });
+
+    // A branch with nothing of its own counts none.
+    const merged = await svc.branchState(workspaceId, 'alice/my-draft', 'target-company-state');
+    expect(merged.exists).toBe(true);
+    expect(merged.unmergedCommits).toBe(0);
+  });
+
+  it('a name that is not a branch does not exist', async () => {
+    await seedWorkspace(root, workspaceId);
+    const state = await makeService().branchState(workspaceId, 'alice/no-such-branch', 'target-company-state');
+    expect(state).toEqual({ exists: false, lastCommit: null, unmergedCommits: 0 });
+  });
+
+  it('isAncestor: yes for a contained commit, no for one that is not, and throws for an unknown commit', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    const base = await gitOut(repo, ['rev-parse', 'HEAD']);
+    const tip = await pushCommits(upstream, 'bob/other-draft', 1);
+    await runGit(repo, ['fetch', 'origin']);
+    const svc = makeService();
+
+    expect(await svc.isAncestor(workspaceId, base, tip)).toBe(true);
+    expect(await svc.isAncestor(workspaceId, tip, base)).toBe(false);
+    await expect(svc.isAncestor(workspaceId, 'f'.repeat(40), base)).rejects.toThrow();
+  });
+
+  it('removes the branch from the shared repository even when this clone never fetched it, and answers its tip', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    // Created from elsewhere after this clone was made: no tracking ref here.
+    const other = path.join(root, '.creator');
+    await runGit(root, ['clone', upstream, other]);
+    await runGit(other, ['checkout', '-b', 'alice/new-elsewhere']);
+    await runGit(other, ['commit', '--allow-empty', '-m', 'elsewhere']);
+    await runGit(other, ['push', 'origin', 'alice/new-elsewhere']);
+    const tip = await gitOut(other, ['rev-parse', 'HEAD']);
+    expect(await gitOut(repo, ['for-each-ref', 'refs/remotes/origin/alice/new-elsewhere'])).toBe('');
+
+    const result = await makeService().deleteBranch(workspaceId, 'alice/new-elsewhere', ALICE);
+    expect(result).toEqual({ lastCommit: tip });
+    expect(await remoteHasRef(upstream, 'alice/new-elsewhere')).toBe(false);
+  });
+
+  it('a delete leased on a tip refuses a branch that moved since, and leaves it in place', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const seen = await gitOut(upstream, ['rev-parse', 'refs/heads/alice/my-draft']);
+    // A colleague pushes after the checks were made.
+    await pushCommits(upstream, 'alice/my-draft', 1);
+
+    const err = await makeService()
+      .deleteBranch(workspaceId, 'alice/my-draft', ALICE, { expectTip: seen })
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(BranchDeleteRefusedError);
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(true);
+  });
+
+  it('a delete leased on the current tip goes through', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const seen = await gitOut(upstream, ['rev-parse', 'refs/heads/alice/my-draft']);
+    const result = await makeService().deleteBranch(workspaceId, 'alice/my-draft', ALICE, { expectTip: seen });
+    expect(result.lastCommit).toBe(seen);
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
+  });
+
+  it('mayDeleteBranch: the author yes, anyone else without the Admin role no', async () => {
+    await seedWorkspace(root, workspaceId);
+    const svc = makeService();
+    expect(await svc.mayDeleteBranch(workspaceId, 'alice/my-draft', ALICE)).toBe(true);
+    expect(await svc.mayDeleteBranch(workspaceId, 'bob/other-draft', ALICE)).toBe(false);
+  });
+});

package/src/modules/workflow/git/__tests__/git.service.mergeChangeRequest.test.ts

@@ -9,6 +9,7 @@ import type { AuthUser } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
+import { mergeCommitSubject } from '../merge-commit.js';
 
 const execFileAsync = promisify(execFile);
 const BASE = 'current-company-state';
@@ -103,6 +104,9 @@ describe('GitService.mergeChangeRequest', () => {
     expect(result.kind).toBe('merged');
     if (result.kind !== 'merged') return;
     expect(result.sha).toMatch(/^[0-9a-f]{40}$/);
+    // A commit of this request's own was written: it IS the state the target is
+    // left at here, and it is what the row may record as the merge commit.
+    expect(result.mergeCommit).toBe(result.sha);
 
     // The merge landed on origin/BASE: a fresh clone sees the feature file and a
     // merge commit authored by the human triggerer.
@@ -115,6 +119,336 @@ describe('GitService.mergeChangeRequest', () => {
     expect(log).toContain('Add feature (#1)');
   });
 
+  // cubic P1 on #347. When the target already contains the source there is
+  // nothing to merge, so no commit is written and `sha` is the TARGET TIP —
+  // whatever landed on the target last, which in a deployment that lands
+  // everything through change requests is usually ANOTHER request's merge commit.
+  // Answering `mergeCommit: null` is what stops the row recording it as this
+  // request's own: a reader that took it would answer with that other request's
+  // files under this request's number. The fixture puts request #1's merge commit
+  // on the tip for exactly that reason.
+  it('owns NO merge commit when there was nothing to merge, not even the one on the tip', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    // Another request lands first, so the target tip is a real merge commit whose
+    // subject names #1.
+    await pushFeatureBranch(root, upstream, 'bob/first', async (dir) => {
+      await fs.writeFile(path.join(dir, 'first.md'), 'first\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const first = await git.mergeChangeRequest(
+      baseWsId, 'bob/first', BASE, { subject: mergeCommitSubject('First', 1), body: 'x' }, USER,
+      { appliedChangeNumber: 1 },
+    );
+    expect(first.kind).toBe('merged');
+
+    // A branch the target already contains: branched and pushed with no commit of
+    // its own, so the merge has nothing to do. (`pushFeatureBranch` always
+    // commits, which is the one thing this case must not do.)
+    const emptyDir = path.join(root, 'feat-empty');
+    await runGit(root, ['clone', '-b', BASE, upstream, emptyDir]);
+    await runGit(emptyDir, ['checkout', '-b', 'alice/empty']);
+    await runGit(emptyDir, ['push', '-u', 'origin', 'alice/empty']);
+
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/empty', BASE,
+      { subject: mergeCommitSubject('Nothing to do', 2), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 2 },
+    );
+
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+    // Asked for #2's own merge commit and there is none — the one on the tip is
+    // #1's, and it is not offered in its place.
+    expect(result.mergeCommit).toBeNull();
+    // The sha it reports is the target tip, which is #1's merge commit.
+    const verify = path.join(root, 'verify-empty');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['rev-parse', 'HEAD'])).trim()).toBe(result.sha);
+    expect(await gitOut(verify, ['log', '-1', '--format=%s'])).toContain('(#1)');
+  });
+
+  /**
+   * cubic P2 on #347. The push and the row update are two steps, and a transient
+   * database fault between them leaves the merge commit ON the target with the
+   * row still open. The retry then finds nothing to merge — and if that answered
+   * "no merge commit", the row would record none, and the request would be
+   * permanently fileless (author-only) with the commit holding its files sitting
+   * on the target unreferenced.
+   */
+  it('recovers the merge commit a previous attempt pushed but never recorded', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merge = () =>
+      git.mergeChangeRequest(
+        baseWsId, 'alice/add', BASE,
+        { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+        { appliedChangeNumber: 7 },
+      );
+
+    // Attempt one succeeds in git; imagine the row update failing right here.
+    const first = await merge();
+    expect(first.kind).toBe('merged');
+    if (first.kind !== 'merged') return;
+    const pushed = first.mergeCommit;
+    expect(pushed).toBe(first.sha);
+
+    // Attempt two: the target already contains the source, so nothing is staged
+    // and no new commit is written — but #7 does own a merge commit, and it is
+    // the one the first attempt pushed.
+    const second = await merge();
+    expect(second.kind).toBe('merged');
+    if (second.kind !== 'merged') return;
+    expect(second.mergeCommit).toBe(pushed);
+
+    // Nothing new was pushed: the target is still at that same commit.
+    const verify = path.join(root, 'verify-retry');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['rev-parse', 'HEAD'])).trim()).toBe(pushed);
+  });
+
+  // The same ownership question, asked WITHOUT a merge — the form the approval
+  // gate needs, because the gate refuses the retry before any merge runs. It
+  // must hold in the two conditions that are true by then: the source branch is
+  // retired, and the clone asking is not the clone that pushed.
+  it('finds the merge commit a request owns on the target from another clone, with no source branch left', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    // Cloned BEFORE the merge, so it can only know the commit by fetching.
+    const staleWsId = 'stale';
+    const staleRepo = path.join(root, staleWsId, 'knowledge-base');
+    await fs.mkdir(path.join(root, staleWsId), { recursive: true });
+    await runGit(root, ['clone', '-b', BASE, upstream, staleRepo]);
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+
+    // Retired, as applying a change request retires it.
+    await runGit(root, ['-C', upstream, 'branch', '-D', 'alice/add']);
+
+    const stale = new GitService(stubWorkspaceService(staleWsId, staleRepo), new WorkflowHooks(), testKbContext());
+    expect(await stale.appliedMergeCommitOnTarget(staleWsId, BASE, 7)).toBe(merged.mergeCommit);
+    // A number nothing on the target was merged under owns nothing.
+    expect(await stale.appliedMergeCommitOnTarget(staleWsId, BASE, 8)).toBeNull();
+  });
+
+  it('still finds the commit behind any number of newer merges on a busy target', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+
+    // Twenty-five merges land on the target after it — more than the fixed
+    // count the probe once stopped at, which left a stuck request on a busy
+    // branch un-finalizable for good.
+    const busy = path.join(root, 'busy');
+    await runGit(root, ['clone', '-b', BASE, upstream, busy]);
+    for (let i = 0; i < 25; i += 1) {
+      await runGit(busy, ['checkout', '-b', `other-${i}`]);
+      await fs.writeFile(path.join(busy, `other-${i}.md`), `${i}\n`);
+      await runGit(busy, ['add', '-A']);
+      await runGit(busy, ['commit', '-m', `work ${i}`]);
+      await runGit(busy, ['checkout', BASE]);
+      await runGit(busy, ['merge', '--no-ff', '-m', `Other change ${i} (#${100 + i})`, `other-${i}`]);
+    }
+    await runGit(busy, ['push', 'origin', BASE]);
+
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBe(merged.mergeCommit);
+    // Twenty-five merges are a hundred and fifty git processes; slow on a
+    // loaded Windows runner, so this one gets its own budget.
+  }, 120_000);
+
+  it('recognises a merge commit an earlier release wrote with the title unflattened, given the stored title', async () => {
+    // Before titles were flattened, a title with a blank line put `(#N)` after
+    // git's one-paragraph subject, and such rows read as author-only. The row
+    // still holds the title, which is what names the commit now.
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const title = 'Add feature\n\nand a note';
+    const old = path.join(root, 'old-format');
+    await runGit(root, ['clone', '-b', BASE, upstream, old]);
+    await runGit(old, ['merge', '--no-ff', '-m', `${title} (#5)`, '-m', 'Merged via Bevel', 'origin/alice/add']);
+    await runGit(old, ['push', 'origin', BASE]);
+    const sha = (await gitOut(old, ['rev-parse', 'HEAD'])).trim();
+    expect((await gitOut(old, ['log', '-1', '--format=%s'])).trim()).toBe('Add feature');
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    // With the title: the commit is the request's own, on the target and by sha.
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5, title)).toBe(sha);
+    expect(await git.appliedChangeShas(baseWsId, { number: 5, mergeSha: sha, title }))
+      .toMatchObject({ baseSha: expect.any(String), headSha: expect.any(String) });
+    // Without it, nothing vouches for a number that is not where the subject
+    // rule looks — and another title does not either.
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5)).toBeNull();
+    await expect(git.appliedChangeShas(baseWsId, { number: 5, mergeSha: sha })).rejects.toThrow(/not the merge commit/);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 5, 'Add feature')).toBeNull();
+  });
+
+  it('does not take a current-format commit of another request for one whose title merely contains its number', async () => {
+    // Request 43, titled `Fix crash (#42)`, merges as `Fix crash (#42) (#43)`.
+    // Asked for request 42 with the stored title `Fix crash`, the old-format
+    // rule must refuse it: 42's number is not at the end of the line there.
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Fix crash (#42)', 43), body: 'x' }, USER,
+      { appliedChangeNumber: 43 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 43)).toBe(merged.mergeCommit);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 42, 'Fix crash')).toBeNull();
+    await expect(git.appliedChangeShas(baseWsId, { number: 42, mergeSha: merged.sha, title: 'Fix crash' })).rejects.toThrow(
+      /not the merge commit/,
+    );
+  });
+
+  // One variable at a time, because the two halves of the P1 are not the same
+  // claim. With the remote REACHABLE, a missing tracking ref is not a hazard at
+  // all: the refresh names its destination explicitly, so it recreates the ref
+  // and the walk has what it needs. With the remote UNREACHABLE, there is no
+  // authority for an answer, and the stale ref the clone still holds must not be
+  // scanned — what the caller does with a commit is record it as the request's
+  // published state, and a ref it could not refresh may name a commit the
+  // published branch no longer carries (cubic P1 on #347).
+  it('recreates a missing tracking ref, and refuses to read a stale one', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const merged = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature', 7), body: 'Merged via Bevel' }, USER,
+      { appliedChangeNumber: 7 },
+    );
+    expect(merged.kind).toBe('merged');
+    if (merged.kind !== 'merged') return;
+    // The commit IS in this clone, and origin/BASE names it.
+    expect((await gitOut(baseRepo, ['rev-parse', `origin/${BASE}`])).trim()).toBe(merged.mergeCommit);
+
+    // Variable 1: no tracking ref, remote reachable. The refresh brings it back.
+    await runGit(baseRepo, ['update-ref', '-d', `refs/remotes/origin/${BASE}`]);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBe(merged.mergeCommit);
+    expect((await gitOut(baseRepo, ['rev-parse', `origin/${BASE}`])).trim()).toBe(merged.mergeCommit);
+
+    // Variable 2: tracking ref present and naming the commit, remote gone. No
+    // authority, no answer — the ref is not scanned.
+    await runGit(baseRepo, ['remote', 'set-url', 'origin', path.join(root, 'gone.git')]);
+    expect(await git.appliedMergeCommitOnTarget(baseWsId, BASE, 7)).toBeNull();
+  });
+
+  // The merge commit a later attempt recovers is matched on the number alone, so
+  // a request that landed a DIFFERENT change under its own number is not offered
+  // another request's commit — and `git log --grep` finding the number in a
+  // BODY is not enough either, since the subject check still has to pass.
+  it('does not mistake a mention of the number in a merge body for the request\'s own commit', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'bob/first', async (dir) => {
+      await fs.writeFile(path.join(dir, 'first.md'), 'first\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    // #1's merge commit, whose BODY mentions #9 — the shape `--grep` matches and
+    // the subject check must reject.
+    await git.mergeChangeRequest(
+      baseWsId, 'bob/first', BASE,
+      { subject: mergeCommitSubject('First', 1), body: 'Supersedes the work in (#9)' }, USER,
+      { appliedChangeNumber: 1 },
+    );
+
+    const emptyDir = path.join(root, 'feat-empty-9');
+    await runGit(root, ['clone', '-b', BASE, upstream, emptyDir]);
+    await runGit(emptyDir, ['checkout', '-b', 'alice/empty']);
+    await runGit(emptyDir, ['push', '-u', 'origin', 'alice/empty']);
+
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/empty', BASE, { subject: mergeCommitSubject('Nothing', 9), body: 'x' }, USER,
+      { appliedChangeNumber: 9 },
+    );
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+    expect(result.mergeCommit).toBeNull();
+  });
+
+  /**
+   * `git commit -m` takes the FIRST PARAGRAPH of the message as the subject, so a
+   * blank line inside it pushes `(#N)` into the body — where `%s` never reports
+   * it and the applied request's reader cannot find it (cubic P2 on #347).
+   * `mergeCommitSubject` flattens the title it builds from; this is the guard
+   * against any other caller reintroducing the break.
+   */
+  it('refuses a subject that is more than one paragraph, before touching the clone', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    await expect(
+      git.mergeChangeRequest(
+        baseWsId, 'alice/add', BASE, { subject: 'Add feature\n\nand a note (#3)', body: 'x' }, USER,
+      ),
+    ).rejects.toThrow(/single paragraph/);
+
+    // Nothing was merged or pushed.
+    const verify = path.join(root, 'verify-subject');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    await expect(fs.readFile(path.join(verify, 'feature.md'), 'utf8')).rejects.toThrow();
+  });
+
+  // A title with a blank line in it reaches here (titles are stored `.trim()`-ed
+  // and the tool schema bounds only their length), and the whole read-back of an
+  // applied request hangs on the number being ON the subject git reports.
+  it('keeps the number on the subject when the title itself spans paragraphs', async () => {
+    const { upstream, baseWsId, baseRepo } = await seed(root, { 'base.md': 'base\n' });
+    await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
+      await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
+    });
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
+    const result = await git.mergeChangeRequest(
+      baseWsId, 'alice/add', BASE,
+      { subject: mergeCommitSubject('Add feature\n\nand a note', 4), body: 'x' }, USER,
+      { appliedChangeNumber: 4 },
+    );
+    expect(result.kind).toBe('merged');
+    if (result.kind !== 'merged') return;
+
+    const verify = path.join(root, 'verify-flat');
+    await runGit(root, ['clone', '-b', BASE, upstream, verify]);
+    expect((await gitOut(verify, ['log', '-1', '--format=%s'])).trim())
+      .toBe('Add feature and a note (#4)');
+    // Which is what lets the request be recognised as the owner of this commit:
+    // the same read that would otherwise refuse it as "not the merge commit of
+    // change request #4" and leave the applied request fileless.
+    expect(await git.appliedChangeShas(baseWsId, { number: 4, mergeSha: result.sha }))
+      .toMatchObject({ baseSha: expect.any(String), headSha: expect.any(String) });
+  });
+
   it('returns the conflicting paths when base and source both changed a file', async () => {
     const { upstream, baseWsId, baseRepo } = await seed(root, { 'shared.md': 'original\n' });
     // Source edits shared.md one way…