refactor(queue): extract review-evasion close-enforcement guards into their own module

[JSONbored]

Summary

• Part of refactor(queue): split processors.ts into cohesive modules #4013's module-split sequence for src/queue/processors.ts. Step 5, after transient-locks.ts (refactor(queue): extract transient-lock primitives into their own module #4157), signal-snapshot.ts (refactor(queue): extract signal-snapshot generation into its own module #4820), duplicate-detection.ts (refactor(queue): extract duplicate-cluster adjudication into its own module #4823), and slop-detection.ts (refactor(queue): extract AI-slop-advisory gating/orchestration into its own module #4946).
• Moves the 5 review-evasion / one-shot-close guards -- draft-dodge, reopen-reclose, review-evasion self-close, review-evasion draft-conversion, repeated draft-cycling -- plus their shared scaffolding (withPrActuationLock, evaluateCloseEnforcementGate, hasMaintainerOrOwnerPermission) into src/queue/review-evasion.ts. Pure mechanical move, no behavior change. This is the largest and most self-contained cluster in the split so far: none of these 11 functions had a caller outside this exact block in the original file, and none were exported, so no re-export shim was needed for backward compatibility -- only the 5 top-level entry points are exported now, for processors.ts's own 5 webhook-handler call sites.
• Two real, previously-invisible coverage gaps surfaced by isolating this code in its own file (both were buried inside processors.ts's overall coverage before):
  • 8 best-effort .catch(() => undefined) handlers (label-application, review-tracking cleanup, courtesy comments, audit writes) had no v8 ignore marker, unlike their identically-shaped siblings elsewhere in the same functions. Added the same marker these siblings already use, matching the established convention for this class of fail-safe catch.
  • The bot's-own-reopen exemption in the one-shot-reopen guard (reopener === botLogin) had no test at all. Added one that exercises the real behavior (a gittensory[bot] reopen is allowed, no reclose) rather than suppressing the gap.

Part of #4013 (more extraction steps remain in the sequence — not closing the tracking issue).

Test plan

• npx tsc --noEmit -p . — zero errors
• npx vitest run test/unit test/integration — 696/697 files passed (1 skipped, pre-existing)
• npm run test:coverage (unsharded) — 94.46% statements / 93.42% branches / 93.69% functions / 95.03% lines, no threshold failures; review-evasion.ts itself is 100% line + branch + function covered
• npm run docs:drift-check, npm run manifest:drift-check, npm run engine-parity:drift-check — all ok
• npm audit --audit-level=moderate — 0 vulnerabilities

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.25%. Comparing base (6954202) to head (b0e265b).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4957   +/-   ##
=======================================
  Coverage   94.24%   94.25%           
=======================================
  Files         445      446    +1     
  Lines       38869    38855   -14     
  Branches    14157    14153    -4     
=======================================
- Hits        36633    36623   -10     
+ Misses       1577     1575    -2     
+ Partials      659      657    -2     

Flag	Coverage Δ
shard-1	46.48% <4.08%> (-0.27%)	⬇️
shard-2	33.58% <4.08%> (+0.28%)	⬆️
shard-3	31.57% <0.51%> (+0.15%)	⬆️
shard-4	32.50% <100.00%> (-0.50%)	⬇️
shard-5	34.41% <0.51%> (+0.93%)	⬆️
shard-6	45.48% <4.59%> (+0.25%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.45% <ø> (-0.17%)	⬇️
src/queue/review-evasion.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-11 03:07:15 UTC}

3 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · unstable

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Review summary
This is a mechanical, well-scoped extraction of the 5 review-evasion/close-enforcement guards (draft-dodge, reopen-reclose, self-close, draft-conversion, repeated draft-cycling) plus their shared scaffolding (withPrActuationLock, evaluateCloseEnforcementGate, hasMaintainerOrOwnerPermission) out of processors.ts into review-evasion.ts, part of the #4013 module-split sequence. The move preserves each guard's exact pre-existing behavior including two intentionally-preserved gaps (no permission-readiness check on reopen-reclose, no paused-audit on draft-dodge), and the diff itself demonstrates the import surface in processors.ts was trimmed consistently with what moved (getGateBlockOutcome, hasActiveReviewForHeadSha, resolveAgentPermissionReadiness, DEFAULT_REVIEW_EVASION_LABEL, resolveNullableLabel, and the pr-actions close/reopen/getLastCloser/getLastReopener imports all removed and re-imported only in the new file). The two genuine additions — v8-ignore markers on 8 previously-unmarked best-effort catches, and a new test for the bot's-own-reopen exemption — are honest, targeted coverage fixes rather than fabricated tests, and CI (including codecov/patch) is green.

Nits — 5 non-blocking

• src/queue/review-evasion.ts: hasMaintainerOrOwnerPermission duplicates the logic of recloseDisallowedReopenIfNeeded's own hasMaintainerPermission closure almost verbatim (acknowledged in the comment, but still worth a shared helper if a third caller ever needs it).
• src/queue/review-evasion.ts:134 (evaluateCloseEnforcementGate) sits at control-flow depth 5 — pre-existing from the move, but worth flattening with early returns if this file gets touched again.
• The externally-flagged 'secret' at test/unit/queue-lifecycle-guards.test.ts:797 is generateRsaPrivateKeyPem() test fixture material, not a real credential — no action needed but worth confirming that's the only match.
• review-evasion.ts is a large (1048-line) single file for a 'no further behavior change' extraction; given it's described as the last/largest cluster in the split, consider whether the 3 near-identical enforcement bodies (self-close/draft-conversion/repeated-cycling) could share more than the gate scaffolding in a follow-up.
• Consider factoring the repeated close+comment+label+audit+terminalize+moderation-escalation tail (identical across closeReviewEvasionSelfCloseIfActive, closeReviewEvasionDraftConversionIfActive, and closeRepeatedDraftCyclingIfDetected) into one shared helper in a future step, since all three now live in the same file.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 312 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 312 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 312 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review