Hold matching until a site passes review, as /terms promises (#1)

autoPair filtered its candidates to active sites but never looked at the
status of the site it was pairing FOR. Both submit surfaces call it right
after commitSite, while the listing is still pending_review, so an
unreviewed site could be proposed to a real member (and both sides
emailed) before anyone had looked at it. /terms says exactly the
opposite, and so did the comment in setSiteStatus.

A non-active site now reports a pending_review reason instead of
pairing, and both submit surfaces explain that matching starts on
approval. Approval already re-runs autoPair, so nothing changes there.

Author: nyyhao

next-app/src/app/submit/actions.ts

@@ -268,6 +268,13 @@ async function describeAutoPair(site: Parameters<typeof autoPair>[0]): Promise<{
                 outcome: `You already have a match: ${pair.partner.category}, DR ${dr}. It is waiting for you to accept or decline.`,
             };
         }
+        if (pair.reason === "pending_review") {
+            return {
+                matched: false,
+                outcome:
+                    "Matching starts the moment a human approves the listing. If a partner is waiting in your category, you will hear by email right then.",
+            };
+        }
         if (pair.reason === "first_in_category") {
             return {
                 matched: false,

next-app/src/lib/mcp/tools.ts

@@ -280,9 +280,11 @@ export function registerTools(server: McpServer, ctx: ToolContext): void {
             const pair = await autoPair(site);
             const tail = pair.matched
                 ? `\n\nYou already have a match: ${pair.partner.category}, DR ${pair.partner.domainRating ?? "unrated"}. Say "show my matches" to see it.`
-                : pair.reason === "first_in_category"
-                  ? `\n\nYou are the first site in ${pair.category}. That is a good position: the next member to join it is matched with you immediately.`
-                  : "\n\nNo partner available right now. You will be matched as soon as a suitable one joins.";
+                : pair.reason === "pending_review"
+                  ? "\n\nMatching starts the moment a human approves the listing. If a partner is waiting in your category, you will hear by email right then."
+                  : pair.reason === "first_in_category"
+                    ? `\n\nYou are the first site in ${pair.category}. That is a good position: the next member to join it is matched with you immediately.`
+                    : "\n\nNo partner available right now. You will be matched as soon as a suitable one joins.";
 
             return text(`${site.domain} is listed and pending review.${tail}`);
         }),

next-app/src/lib/services/matches.ts

@@ -101,7 +101,7 @@ export async function searchPartners(input: {
 
 export type AutoPairResult =
     | { matched: true; match: ExchangeMatch; partner: MaskedPartner }
-    | { matched: false; reason: "first_in_category" | "no_eligible_partner"; category: Category };
+    | { matched: false; reason: "first_in_category" | "no_eligible_partner" | "pending_review"; category: Category };
 
 /**
  * Finds and proposes the best available partner for a site, right now.
@@ -114,6 +114,17 @@ export type AutoPairResult =
 export async function autoPair(site: ExchangeSite): Promise<AutoPairResult> {
     const category = site.category;
 
+    // Only an active site may be proposed to anyone. Every filter below checks
+    // the status of the CANDIDATES, so without this guard the subject slips
+    // through: the submit flow calls autoPair the moment a listing is written,
+    // while it is still `pending_review`, and a match with an unreviewed site
+    // would go out (with both match-proposed emails) before a human had looked
+    // at it. /terms says that never happens, so it must not. Approval re-runs
+    // autoPair (see `setSiteStatus`), which is where a fresh site really pairs.
+    if (site.status !== "active") {
+        return { matched: false, reason: "pending_review", category };
+    }
+
     const [active] = await db()
         .select({ n: count() })
         .from(exchangeSites)

next-app/src/lib/services/sites.ts

@@ -226,10 +226,11 @@ export async function listSitesForReview(status?: SiteStatus): Promise<SiteForRe
  * since the first migration and had no reader or writer until now.
  *
  * Approving MATCHES IMMEDIATELY. `autoPair` already runs on submit, but at that
- * point the site is `pending_review` and invisible to the matcher, so this is
- * the first moment it can actually pair with anyone. Without the call here an
- * approved site would sit idle until the Tuesday cron, which is a week of
- * silence at exactly the moment the member has just been told they are live.
+ * point the site is `pending_review` and autoPair declines to pair it (that is
+ * the review promise in /terms), so this is the first moment it can actually
+ * pair with anyone. Without the call here an approved site would sit idle until
+ * the Tuesday cron, which is a week of silence at exactly the moment the member
+ * has just been told they are live.
  *
  * Pairing is awaited rather than fired and forgotten, because its own
  * `match-proposed` email should land after the approval email rather than