fix(miner): fail closed when referencing PR has missing authorLogin (#7794)

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: RealDiligent

packages/loopover-miner/lib/submission-freshness-check.js

@@ -143,7 +143,9 @@ export async function checkSubmissionFreshness(
   const minerLoginKey = minerLogin.toLowerCase();
   const referencingPrs = Array.isArray(snapshot.referencingPrs) ? snapshot.referencingPrs : [];
   const addressedByAnotherAuthor = referencingPrs.some(
-    (pr) => typeof pr.authorLogin === "string" && pr.authorLogin.trim().toLowerCase() !== minerLoginKey && (pr.state === "merged" || pr.state === "open"),
+    (pr) =>
+      (pr.state === "merged" || pr.state === "open") &&
+      (typeof pr.authorLogin !== "string" || pr.authorLogin.trim().toLowerCase() !== minerLoginKey),
   );
   if (addressedByAnotherAuthor) {
     return abort(eventLedger, repoFullName, candidate.issueNumber, "already_addressed");

packages/loopover-miner/lib/submission-freshness-check.ts

@@ -162,7 +162,23 @@ describe("checkSubmissionFreshness (#3007)", () => {
     expect(result).toEqual({ fresh: false, reason: "already_addressed" });
   });
 
-  it("a referencing PR with a non-string authorLogin is ignored rather than crashing or false-flagging", async () => {
+  it("REGRESSION: a merged referencing PR with a missing authorLogin counts as already-addressed (fail-closed)", async () => {
+    const { claimLedger } = stubClaimLedger([activeClaim]);
+    const { eventLedger } = stubEventLedger();
+    const fetchLiveIssueSnapshot = vi.fn(async () => ({
+      state: "open" as const,
+      referencingPrs: [{ number: 99, state: "merged" as const, authorLogin: null as unknown as string, createdAt: null }],
+    }));
+
+    const result = await checkSubmissionFreshness(
+      { repoFullName: "acme/widgets", issueNumber: 42, minerLogin: "miner-bot" },
+      { claimLedger, fetchLiveIssueSnapshot, eventLedger },
+    );
+
+    expect(result).toEqual({ fresh: false, reason: "already_addressed" });
+  });
+
+  it("a referencing PR with a non-string authorLogin counts as already-addressed instead of being ignored", async () => {
     const { claimLedger } = stubClaimLedger([activeClaim]);
     const { eventLedger } = stubEventLedger();
     const fetchLiveIssueSnapshot = vi.fn(async () => ({
@@ -175,7 +191,7 @@ describe("checkSubmissionFreshness (#3007)", () => {
       { claimLedger, fetchLiveIssueSnapshot, eventLedger },
     );
 
-    expect(result).toEqual({ fresh: true });
+    expect(result).toEqual({ fresh: false, reason: "already_addressed" });
   });
 
   it("a CLOSED (not merged) referencing PR from another author does not count as already-addressed", async () => {