fix: invalidate stale canonical close verdicts

[steipete]

Summary

• live-check canonical PR state before duplicate/superseded verdict comment sync and again at the comment mutation boundary
• atomically downgrade closed-unmerged canonical verdicts to conservative keep-open reports/comments with scheduler-visible, canonical-bound retries
• preserve a non-promotable corrected state and route exact changed-since-review duplicate records through production comment-sync batches
• keep dry-run and real comment-sync suppression behavior aligned when a changed report has no durable comment

Root cause

Comment-only sync bypassed the live canonical guard used by final close apply, so it could refresh an old trusted close verdict after the canonical PR closed unmerged.

Tests

• pnpm run build:all
• node --test --test-concurrency=1 test/apply-pr-duplicate-proof.test.ts test/apply-pr-duplicate-ref-proof.test.ts test/repair/workflow-utils.test.ts test/apply-label-sync.test.ts test/apply-pr-coverage-proof-close.test.ts test/apply-pr-promotion.test.ts (105/105)
• pnpm run test:repair (664/664)
• pnpm run lint
• pnpm run format:check
• autoreview clean
• source-blind behavior contract: 6/6 clauses passed, including independent dry-run/real-mode repetition

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d883a6ca65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check every canonical close target

When root_cause_cluster.canonicalRef is present, this returns that single PR and never inspects the refs that actually appear in the close recommendation/comment. If a report has a structured canonical PR #400 but the durable close verdict says the PR is superseded by #401, and #401 later closes unmerged, the new comment-sync guard only probes #400 and can still refresh the stale close verdict for #401. Please include the signaled close-comment/work-cluster refs in this guard rather than short-circuiting on the structured field.

Useful? React with 👍 / 👎.