fix(queue): deny ambiguous reopen reclose

[JSONbored]

Motivation

• A bounded timeline scan for issue events can be incomplete (paged window), making it ambiguous whether a later maintainer reopened a PR; treating that ambiguity as if the original contributor is still current allowed the App to wrongly close a maintainer-reopened PR.
• The change restores a fail-safe: when the scan cannot confirm the webhook sender is still the latest reopener, the handler must deny the automated GitHub write to avoid undoing a legitimate maintainer action.

Description

• Update the reopener freshness guard in src/queue/processors.ts to fail-safe: treat an unconfirmed latest reopener (partial-window null result) as superseding and record a denied audit event instead of proceeding to comment and close.
• Simplify the reopenerSuperseded check to require an explicit visible match for reopener before allowing the close attempt.
• Adjust the padded-event-window regression in test/unit/queue.test.ts to assert that no comment or PATCH-close occurs and that the audit records denied with an appropriate detail string for the ambiguous-window case.
• Changes touch src/queue/processors.ts and test/unit/queue.test.ts only.

Testing

• Ran the targeted unit suite with npx vitest run test/unit/queue.test.ts -t "one-shot reopen prevention" --reporter=verbose, and the one-shot reopen prevention tests passed.
• Verified local hygiene with git diff --check, which reported no issues.
• The modified regression test now asserts no comment/close and an audit outcome of denied, and it passes in the run above.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-07 07:48:45 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This tightens the reopener-freshness guard in `recloseDisallowedReopenIfNeeded` (src/queue/processors.ts) so that any partial/incomplete event-window scan is treated as superseded and the auto-close is denied, rather than special-casing the null+uncoveredPages case as safe-to-proceed. The new `reopenerSuperseded = latestReopener.errored || latestReopenerLogin !== reopener` correctly fails closed whenever the scan can't affirmatively confirm the webhook sender is still the current reopener (null login, partial or full coverage, or error), closing the padding-based bypass described in the PR. The accompanying test update in test/unit/queue.test.ts flips the padded-window regression to assert no comment/PATCH occurs and that the audit records `denied`, which is consistent with the new logic and passed in CI.

Nits — 4 non-blocking

• The detail string asserted in the updated test ('the current reopener is now unknown, not contributor') is generated by code not shown in this diff — worth confirming that wiring produces the correct wording specifically for the partial-window-null case versus the errored case, so the two denial paths remain distinguishable in audit logs.
• The removed comment previously documented three distinct outcomes (attacker-padded original reopen, incomplete-but-covered no-match, and read error); the new comment is good but doesn't call out the fully-covered-no-match case explicitly — a one-line note that fully covered + null login is also treated as superseded (same as before) would help future readers avoid re-litigating this.
• Consider adding a regression case for a partial window where the visible login *does* match the current reopener, to confirm the fail-safe change didn't inadvertently start denying legitimate matches found within a partial scan.
• If not already covered elsewhere, add/verify a test for the fully-covered, no-match case (previously handled by `latestReopenerUnknownInPartialWindow` being false due to `coveredAllPages`) to lock in that this behavior is unchanged.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 343 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 343 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 343 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.66%. Comparing base (1ce4364) to head (24ccbce).
⚠️ Report is 15 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3945      +/-   ##
==========================================
- Coverage   93.66%   93.66%   -0.01%     
==========================================
  Files         372      372              
  Lines       34856    34855       -1     
  Branches    12743    12742       -1     
==========================================
- Hits        32649    32648       -1     
  Misses       1588     1588              
  Partials      619      619              

Files with missing lines	Coverage Δ
src/queue/processors.ts	94.54% <100.00%> (-0.01%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.