fix(queue): re-verify live PR state before draft-dodge and reopen-reclose closes

[JSONbored]

What

Both the converted_to_draft draft-dodge handler and the reopen-reclose handler (maybeRecloseDisallowedReopen) go straight from their async DB reads (getGateBlockOutcome/isGlobalAgentFrozen, or the permission/closer-history lookups) to closePullRequest with no live GET first — unlike the main gate-close path, which routes every close through executeAgentMaintenanceActions's freshness guard immediately before the mutation.

In the window between webhook ingestion and the final PATCH, a maintainer could merge/close the PR themselves, or a fresh push could clear the underlying gate failure, and the close would still fire blind off the stale ingestion-time payload. A queued github-webhook job retried after a transient failure hits the same gap, since retries replay the originally captured payload rather than re-fetching (up to 3 retries, 30s delay per attempt — a real window).

Fix

Add a fetchPullRequestFreshness call immediately before each closePullRequest, mirroring executeAgentMaintenanceActions's existing freshness step, and deny the close with a denied audit outcome when the PR's live state or head SHA no longer matches what triggered the handler. Both call sites are structurally identical bypasses of the same pattern, so this applies the same fix to both.

Tests

• Draft-dodge: denied (no comment, no close) when live state has moved; existing happy-path/freeze/dry-run/no-block/owner-exemption tests unaffected.
• Reopen-reclose: denied (no comment, no close) when live state has moved; existing happy-path/autonomy-floor/freeze/dry-run tests unaffected.
• Both: a recordAuditEvent failure on the new denial path is swallowed — the handler still completes without throwing (mirrors the existing fail-safe convention for this file's other .catch() bodies).

Full unsharded test:coverage green (5604 passed); typecheck green; npm audit clean.

Advances #1936. Closes #2130. Closes #2261.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-01 21:26:48 UTC}

4 files · 1 AI reviewer · no blockers · readiness 75/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change correctly adds a live freshness check before the two close mutations that previously acted on webhook-era state, and the draft-dodge path now verifies the PR is still a draft rather than relying on head/state alone. The reopened-PR path also re-checks the reopener's permission immediately before closing, which covers the same-head authorization race described in the PR. The freshness utility keeps existing callers' behavior unchanged unless `requireDraft` is explicitly passed, and the added tests cover the new stale, no-longer-draft, promoted-reopener, and audit-failure paths.

Nits — 6 non-blocking

• nit: src/queue/processors.ts:3505 and src/queue/processors.ts:7522 carry long incident-style comments in the hot path; trim them to the invariant being enforced and leave the detailed race narrative in the tests or issue.
• nit: test/unit/queue.test.ts:10636 and test/unit/queue.test.ts:10909 mock `fetchPullRequestFreshness`, so the queue tests should assert the exact call arguments for `installationId`, `repoFullName`, `pullNumber`, and `expectedHeadSha` on both handlers, not only `requireDraft` on the draft-dodge case.
• src/queue/processors.ts:3505: keep the comment focused on the rule, e.g. live state must still be open, same-head, and draft immediately before the close.
• test/unit/queue.test.ts:10636: add `expect(fetchPullRequestFreshness).toHaveBeenCalledWith(env, expect.objectContaining({ installationId: 123, repoFullName: "JSONbored/gittensory", pullNumber: 42, expectedHeadSha: "abc123" }))` for the reopen stale case and the analogous assertion for draft-dodge.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2130, #2261
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; 2 linked issues).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 67 registered-repo PR(s), 57 merged, 589 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 67 PR(s), 589 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 67 PR(s), 589 issue(s).
• Related work: Items reference the same linked issue fix(queue): draft-dodge close has no live PR-state re-check before closing #2130. (issue #2130)
• Related work: Items reference the same linked issue fix(queue): reopen-reclose closes with no live PR-state re-check before the mutation #2261. (issue #2261)
• Related work: Open PR work references issue fix(queue): draft-dodge close has no live PR-state re-check before closing #2130. (issue #2130)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.83%. Comparing base (28b345a) to head (6f94152).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2369   +/-   ##
=======================================
  Coverage   95.83%   95.83%           
=======================================
  Files         224      224           
  Lines       25006    25023   +17     
  Branches     9094     9100    +6     
=======================================
+ Hits        23964    23981   +17     
  Misses        428      428           
  Partials      614      614           

Files with missing lines	Coverage Δ
src/github/pr-freshness.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	91.18% <100.00%> (+0.06%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.