Context (ORB round-2 adversarial audit)
src/queue/processors.ts:2735 (maybeCloseForContributorCapOnOpen) claims only the per-(repo, author) contributor-cap lock, not the per-PR actuation lock transient-locks.ts:7-15 documents as covering "every mutating PR pass". A sweep-fanned agent-regate-pr job holding the PR-actuation lock can plan/execute a different action for the SAME PR concurrently with the cap close.
Fix
Also claim the per-PR actuation lock around the cap-close's executeAgentMaintenanceActions (consistent nesting order: author lock outer, PR lock inner — document to avoid deadlock), or prove/test the namespaces can't race. Include the marker-comment TOCTOU sibling (src/github/comments.ts:100-139 — maybePostVisualFollowupComment at processors.ts:8140 is also unlocked; self-heals but can transiently double-post) in the same lock-coverage pass.
99%+ patch coverage, branch-counted.
Context (ORB round-2 adversarial audit)
src/queue/processors.ts:2735 (maybeCloseForContributorCapOnOpen) claims only the per-(repo, author) contributor-cap lock, not the per-PR actuation lock transient-locks.ts:7-15 documents as covering "every mutating PR pass". A sweep-fanned agent-regate-pr job holding the PR-actuation lock can plan/execute a different action for the SAME PR concurrently with the cap close.
Fix
Also claim the per-PR actuation lock around the cap-close's executeAgentMaintenanceActions (consistent nesting order: author lock outer, PR lock inner — document to avoid deadlock), or prove/test the namespaces can't race. Include the marker-comment TOCTOU sibling (src/github/comments.ts:100-139 — maybePostVisualFollowupComment at processors.ts:8140 is also unlocked; self-heals but can transiently double-post) in the same lock-coverage pass.
99%+ patch coverage, branch-counted.