fix(queue): add a per-PR actuation mutex for the draft-dodge and reopen-reclose paths

[JSONbored]

What

Two different webhook deliveries for the same PR (e.g. a reopened event and a concurrent check_suite completed event) can be dequeued by separate queue workers at nearly the same time. Both read the same stale-but-still-"current" state, both pass their own freshness checks (neither has yet mutated the PR), and both independently fire a mutating GitHub call. The practical damage is usually duplicate audit events and close-comment spam rather than a corrupted final state, but it's a genuine TOCTOU window — nothing in the queue-claim layer acquires a per-PR mutex before evaluating gate state and firing a mutation.

Fix

Added a lightweight per-PR actuation mutex (claimPrActuationLock/releasePrActuationLock in src/queue/processors.ts) — a short-TTL claim on the same SELFHOST_TRANSIENT_CACHE already used for CI-completion coalescing, best-effort release. Wrapped the two mutating webhook-triggered paths that weren't already covered by a per-PR lock: the converted_to_draft draft-dodge close (extracted into maybeCloseDraftDodgeAttempt, mirroring the existing thin-wrapper pattern to avoid reindentation noise) and maybeRecloseDisallowedReopen. A lock-contended caller fails open (skips this pass) rather than blocking — the delivery holding the lock is evaluating the same PR, and the periodic sweep is the backstop if this specific trigger gets dropped.

Deliberately not the issue's suggested "lower-effort interim step" (extend the queue's coalesce lookup in sqlite-queue.ts/pg-queue.ts to also match status='processing' rows, not just pending): tracing through enqueue(), the "superseded prefix" and "standard coalesce key" branches do an in-place UPDATE on the matched row when they coalesce a new arrival. A worker that has already claimed a row read its payload once at claim time into memory and never re-reads the DB row — so an UPDATE against a processing row is invisible to whatever's currently executing, and gets permanently discarded when that worker deletes the row on completion. That's a coalesce that records a success metric while silently and irrecoverably dropping the new event's trigger, which is worse than the duplicate-processing bug it's meant to fix. The per-PR mutex avoids that failure mode entirely by never touching another job's row.

A full per-PR Durable Object (SubmissionLock) remains a separate, larger follow-up — already tracked as a TODO in env.d.ts, deliberately out of scope here.

Tests

• New test: the draft-dodge close is skipped (no PATCH, no audit event either way) when a concurrent delivery already holds the lock for that PR.
• New test: the reopen-reclose is skipped the same way when lock-contended.
• All pre-existing draft-dodge and reopen-reclose tests continue to pass unchanged, confirming the extraction didn't change behavior on the non-contended path.
• npx tsc --noEmit clean.
• Scoped: full queue.test.ts — 204 passed.
• Diff-range coverage-gap check on src/queue/processors.ts: fully covered.
• Full unsharded npm run test:coverage: 5602 passed, 4 skipped (pre-existing/unrelated), 0 failed.
• npm audit --audit-level=moderate: 0 vulnerabilities.

Advances #1936. Closes #2135.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 01:25:15 UTC}

2 files · 1 AI reviewer · no blockers · readiness 75/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change adds a per-PR transient-cache actuation mutex and threads it through the draft-dodge close and disallowed-reopen reclose paths, including the caller contract needed to stop a contended reopen from falling through into normal processing. The visible wiring is coherent: the lock is claimed before gate evaluation, released in finally, and tests cover free/held, missing-atomic-claim, contended, and concurrent draft-dodge cases. The remaining risk is operational hardening around stale releases and test brittleness, not a visible correctness break in the diff.

Nits — 7 non-blocking

• nit: src/queue/processors.ts:2305 documents that releasePrActuationLock can delete a later holder's live lock after TTL expiry, so this should be tracked tightly or moved to a tokened conditional release as soon as the cache adapter supports it.
• nit: test/unit/queue.test.ts:11825 and test/unit/queue.test.ts:12365 duplicate the private lock-key string, which makes the contention tests brittle if prActuationLockKey changes.
• nit: src/queue/processors.ts:3782 and src/queue/processors.ts:7865 silently skip lock-contended deliveries with no lightweight trace, making it harder to distinguish an intentional mutex skip from a dropped webhook during incident review.
• In test/unit/queue.test.ts:11825 and test/unit/queue.test.ts:12365, pre-claim with claimPrActuationLock(env, "JSONbored/gittensory", 42) instead of hard-coding pr-actuation-lock:feat(mcp): add local workspace intelligence v2 #42.
• In src/queue/processors.ts:2305, add a follow-up issue reference or TODO next to the stale-release limitation so the known correctness gap does not disappear into a long comment.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2135
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 563 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 563 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 563 issue(s).
• Related work: Items reference the same linked issue fix(github): webhook deliveries for the same PR have no per-PR mutual exclusion #2135. (issue #2135)
• Related work: Open PR work references issue fix(github): webhook deliveries for the same PR have no per-PR mutual exclusion #2135. (issue #2135)

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.91%. Comparing base (881910b) to head (1e70418).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2399   +/-   ##
=======================================
  Coverage   95.91%   95.91%           
=======================================
  Files         224      224           
  Lines       25221    25236   +15     
  Branches     9172     9175    +3     
=======================================
+ Hits        24190    24206   +16     
+ Misses        418      417    -1     
  Partials      613      613           

Files with missing lines	Coverage Δ
src/queue/processors.ts	91.75% <100.00%> (+0.11%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.