fix(merge-queue): keep the signing gate off the GraphQL budget + rate-gate

The signing gate (added in 292a532) called fetchUnsignedCommitCount — a
GraphQL call — every tick a signing-repo head reached the clean path, INCLUDING
while a re-sign run was already in flight. On PostHog (a huge, chronically
rate-limited account) that meant a signature GraphQL call every 10s per head,
which helped exhaust the App's GraphQL primary point budget (~25-min backoff) and
stall the queue; the calls also sit behind waitIfBlocked, so on a mid-tick
backoff they'd sleep up to 60s each and stack into a 5-min tick wedge.

Guard the gate the same way the rest of the queue defers:
- isBlocked(account) → defer the head (don't sleep behind waitIfBlocked).
- run already in flight → hold 'fixing' without re-polling signatures every tick
  (the main budget drain).
- graphqlBudget.shouldDefer → skip the signature fetch until the window recovers.
- 403 net's signature lookup guarded by isBlocked too.

The account still recovers its budget GitHub-side (~25 min); this stops the queue
from re-exhausting it via per-tick signature polling.

Author: Gilbert09

packages/backend/src/__tests__/mergeQueueProcessor.test.ts

@@ -1016,6 +1016,20 @@ describe('mergeQueueProcessor', () => {
       expect(state.resignAttempts).toBe(1); // not bumped — didn't pile on a second run
       expect(await countTasks(db)).toBe(1); // still just the in-flight one
       expect(mergeSpy).not.toHaveBeenCalled();
+      expect(mockUnsignedCount).not.toHaveBeenCalled(); // no per-tick signature poll while a run is in flight
+    });
+
+    it('defers the signing check (no signature fetch, no merge) when the GraphQL budget is in reserve', async () => {
+      mockRequiresSigning.mockResolvedValue(true);
+      mockUnsignedCount.mockResolvedValue(2);
+      vi.spyOn(graphqlBudget, 'shouldDefer').mockReturnValue(true); // budget in reserve
+      const prId = await insertPr(db, { summary: cleanSummary() });
+
+      await mergeQueueProcessor.runOnce();
+
+      expect(mockUnsignedCount).not.toHaveBeenCalled(); // didn't spend a scarce point on signatures
+      expect(mergeSpy).not.toHaveBeenCalled(); // and didn't attempt the doomed merge
+      expect((await getPr(db, prId)).state).toBe('open'); // deferred to a later tick
     });
 
     it('blocks with the signing reason once the re-sign budget is spent', async () => {

packages/backend/src/services/mergeQueueProcessor.ts

@@ -777,14 +777,19 @@ class MergeQueueProcessor {
           // unsigned commits, the refusal is (at least partly) unsigned commits —
           // re-sign via the fix task, and record the requirement so every future
           // PR on this branch is handled proactively (learn-from-403).
+          // Skip the signature lookup when the account is in a rate-limit backoff
+          // (it would sleep behind waitIfBlocked / burn a scarce point) — fall
+          // through to the normal refusal handling; a later tick re-derives it.
           let unsignedNow = 0;
           try {
-            unsignedNow = await fetchUnsignedCommitCount({
-              workspaceId: row.workspaceId,
-              owner: row.owner,
-              repo: row.repo,
-              number: row.number,
-            });
+            if (!githubRateGate.isBlocked(githubService.accountKeyFor(row.workspaceId))) {
+              unsignedNow = await fetchUnsignedCommitCount({
+                workspaceId: row.workspaceId,
+                owner: row.owner,
+                repo: row.repo,
+                number: row.number,
+              });
+            }
           } catch {
             // ignore — fall through to the normal refusal handling below
           }
@@ -972,10 +977,29 @@ class MergeQueueProcessor {
     position: number,
     runActive: boolean
   ): Promise<HeadVerdict | null> {
+    const accountKey = githubService.accountKeyFor(row.workspaceId);
+    // Hard rate-limit backoff: the signature GraphQL call AND the merge that
+    // follows would each sleep up to MAX_GATE_WAIT_MS behind `waitIfBlocked`,
+    // and stacking those inside one head is what wedged the tick. Defer the head
+    // to a later tick (mirrors processGroup's between-heads rate-gate deferral).
+    if (githubRateGate.isBlocked(accountKey)) return 'advance';
+
     const base = baseBranchOf(row);
     if (!(await requiresSignedCommits(row.workspaceId, row.owner, row.repo, base))) {
       return null; // repo/branch doesn't require signed commits — merge as normal
     }
+    // A re-sign run is already in flight — don't re-poll signatures every tick
+    // (a needless GraphQL call per tick, on a budget-starved account). Hold the
+    // badge at 'fixing' and let the run finish; the next no-run tick re-checks.
+    if (runActive) {
+      await this.ensureStatus(row, state, 'fixing', position);
+      return 'advance';
+    }
+    // GraphQL budget in reserve — don't spend a scarce point on the signature
+    // fetch (or the doomed merge it gates). Defer until the window recovers; this
+    // is what keeps the queue's signing checks from tipping the account over.
+    if (graphqlBudget.shouldDefer(accountKey)) return 'advance';
+
     let unsigned: number;
     try {
       unsigned = await fetchUnsignedCommitCount({