@nanobpm/nano-workforce 0.101.1 → 0.102.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [0.102.1](https://github.com/nanobpm/nano-workforce/compare/v0.102.0...v0.102.1) (2026-08-19)
+
+
+### Bug Fixes
+
+* **merge-loop:** re-attempt merge for stale/transient CI instead of paging a human ([#348](https://github.com/nanobpm/nano-workforce/issues/348)) ([#350](https://github.com/nanobpm/nano-workforce/issues/350)) ([87ce2d6](https://github.com/nanobpm/nano-workforce/commit/87ce2d69e893b4b0f965f481d6c247fb8fcb84e8))
+
+# [0.102.0](https://github.com/nanobpm/nano-workforce/compare/v0.101.1...v0.102.0) (2026-08-19)
+
+
+### Features
+
+* **console:** merged-per-day burn-down/throughput chart ([#345](https://github.com/nanobpm/nano-workforce/issues/345)) ([d4b27a9](https://github.com/nanobpm/nano-workforce/commit/d4b27a9cad36217db7c8ffc49ef26e0f31fb688e)), closes [#344](https://github.com/nanobpm/nano-workforce/issues/344) [#290](https://github.com/nanobpm/nano-workforce/issues/290) [#337](https://github.com/nanobpm/nano-workforce/issues/337) [#339](https://github.com/nanobpm/nano-workforce/issues/339) [#340](https://github.com/nanobpm/nano-workforce/issues/340) [#338](https://github.com/nanobpm/nano-workforce/issues/338)
+
 ## [0.101.1](https://github.com/nanobpm/nano-workforce/compare/v0.101.0...v0.101.1) (2026-08-19)
 
 

package/SPEC.md

@@ -424,8 +424,30 @@ start ─► wait: deps merged ─► arm merge ─► wait: mergeable ─┬─
   check names ride `appendPrompt`) to green the checks on the branch, then re-arms the
   poller. It repeats while `ciFixRound < ciFixMax`
   (`NANO_PR_MAX_CI_FIX_ROUNDS`, default 3; `0` disables). Only when the budget is
-  exhausted, the agent reports `blocked`, or the branch is in `conflict` does it fall
-  through to the human escalation path.
+  exhausted, the agent reports `blocked` *and the PR is still blocked after a
+  ground-truth reconcile*, or the branch is in `conflict` does it fall through to the
+  human escalation path.
+
+- **Stale / transient checks — re-attempt, don't escalate** (issue #348) — GitHub's CI
+  concurrency **cancels** a superseded workflow run while a newer run on the *identical
+  head SHA* takes over. Both land in the head's `statusCheckRollup` under the same check
+  name — the stale one stamped `CANCELLED`, the live one green. This is a
+  **CI-concurrency-cancellation drift class**, not a code defect, defended at three
+  layers so it never pages a human:
+  - **Derivation (root cause)** — the merge poller's check derivation collapses the
+    rollup to the **newest run per `(headSha, checkName)`** (`latestRunPerCheck`) before
+    classifying, so a `CANCELLED` run superseded by a newer green run is **not** counted
+    as a failing gate. The phantom `blocked` never arises, so `fix-ci` is not even armed.
+  - **Agent verdict** — when `fix-ci` pushes nothing because the failing checks are
+    stale/transient (head already green), it returns `status: "reattempt"` (with
+    `pushed: false`). That routes to `arm-merge` — the merge is simply re-queued from
+    ground truth. The prompt reserves `blocked` for a genuine human decision (a missing
+    secret, an un-fixable failure), never a self-healing PR.
+  - **Reconcile-before-escalate guard** — even a *mislabelled* `blocked` self-heals: a
+    `blocked` verdict with no push (`pushed != true`) reconciles **once** via ground
+    truth (`gw-ci-blocked` → `ci-reconcile`, which re-arms the canonical merge poller and
+    sets `ciBlockedReconciled`), and escalates only if the PR is **still** blocked on the
+    re-derived state.
 
 - **Discovered dependency** — a `senior:fix-ci` or `senior:rebase` agent may find that
   the PR cannot land because **another PR must merge first** (a required linked-issue

package/app/failingChecksSupersede.test.ts

@@ -0,0 +1,93 @@
+// Derivation-layer guard for the CI-concurrency-cancellation drift class (issue #348).
+//
+// GitHub's CI concurrency cancels a superseded workflow run while a newer run on the *identical
+// head SHA* takes over. Both land in the head's `statusCheckRollup` under the same check name — the
+// stale one stamped `CANCELLED`, the live one green. The merge poller's check derivation used to
+// count that stale `CANCELLED` as a failing required check, so a PR whose head is actually green
+// read as `blocked`, armed `senior:fix-ci`, which honestly pushed nothing and (pre-#348) returned
+// `blocked` → a human merge-escalation for a self-healing PR.
+//
+// The fix collapses the rollup to the NEWEST run per check before classifying, so a superseded
+// `CANCELLED` never counts. These are pure unit tests over the exported derivation helpers.
+
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { allCheckNames, failingCheckNames, latestRunPerCheck } from "./github.ts";
+
+test("a CANCELLED run superseded by a newer green run on the same head does not count as failing", () => {
+  const rollup = [
+    // The superseded run: GitHub CI concurrency cancelled it when a newer run started.
+    { name: "engine-core", conclusion: "CANCELLED", startedAt: "2024-01-01T00:00:00Z", completedAt: "2024-01-01T00:01:00Z" },
+    // The live run on the identical head SHA: green.
+    { name: "engine-core", conclusion: "SUCCESS", startedAt: "2024-01-01T00:02:00Z", completedAt: "2024-01-01T00:05:00Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), [], "the stale CANCELLED must not read as a failing gate");
+});
+
+test("every CANCELLED-superseded required check on one head SHA is dropped (the #348 instance)", () => {
+  // The exact PR #887 evidence: four required checks each with a superseded CANCELLED + a newer
+  // green run on the same head. None must count as failing.
+  const names = ["engine-core", "engine-wasm read-model wasm32 type-check", "processos", "server"];
+  const rollup = names.flatMap((name) => [
+    { name, conclusion: "CANCELLED", startedAt: "2024-01-01T00:00:00Z" },
+    { name, conclusion: "SUCCESS", startedAt: "2024-01-01T00:02:00Z" },
+  ]);
+  assertEquals(failingCheckNames(rollup), [], "no superseded CANCELLED may count as a failing check");
+});
+
+test("a genuine failure on the newest run still counts (no false-negative)", () => {
+  const rollup = [
+    { name: "engine-core", conclusion: "SUCCESS", startedAt: "2024-01-01T00:00:00Z" },
+    // Newest run genuinely failed — this must still be reported.
+    { name: "engine-core", conclusion: "FAILURE", startedAt: "2024-01-01T00:02:00Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), ["engine-core"], "a real failure on the newest run must count");
+});
+
+test("a lone CANCELLED with no superseding run still counts (nothing green replaced it)", () => {
+  const rollup = [{ name: "engine-core", conclusion: "CANCELLED", startedAt: "2024-01-01T00:00:00Z" }];
+  assertEquals(failingCheckNames(rollup), ["engine-core"], "an unsuperseded CANCELLED remains a failing gate");
+});
+
+test("ties (missing timestamps) prefer the non-CANCELLED run so the real result wins", () => {
+  // GitHub sometimes omits run times; a superseded CANCELLED alongside a completed run must not
+  // shadow the real conclusion even when neither carries a timestamp.
+  const cancelledFirst = [
+    { name: "server", conclusion: "CANCELLED" },
+    { name: "server", conclusion: "SUCCESS" },
+  ];
+  const successFirst = [
+    { name: "server", conclusion: "SUCCESS" },
+    { name: "server", conclusion: "CANCELLED" },
+  ];
+  assertEquals(failingCheckNames(cancelledFirst), [], "CANCELLED-first tie resolves to the real (green) result");
+  assertEquals(failingCheckNames(successFirst), [], "success-first tie keeps the real (green) result");
+});
+
+test("latestRunPerCheck keeps exactly one run per check name (newest)", () => {
+  const rollup = [
+    { name: "a", conclusion: "CANCELLED", startedAt: "2024-01-01T00:00:00Z" },
+    { name: "a", conclusion: "SUCCESS", startedAt: "2024-01-01T00:02:00Z" },
+    { name: "b", conclusion: "FAILURE", startedAt: "2024-01-01T00:00:00Z" },
+  ];
+  const latest = latestRunPerCheck(rollup);
+  assertEquals(latest.length, 2, "one run per distinct check name");
+  const a = latest.find((c) => c.name === "a");
+  assert(a && a.conclusion === "SUCCESS", "check `a` resolves to its newest (green) run");
+});
+
+test("allCheckNames dedupes superseded reruns to a single name", () => {
+  const rollup = [
+    { name: "engine-core", conclusion: "CANCELLED", startedAt: "2024-01-01T00:00:00Z" },
+    { name: "engine-core", conclusion: "SUCCESS", startedAt: "2024-01-01T00:02:00Z" },
+  ];
+  assertEquals(allCheckNames(rollup), ["engine-core"], "a superseded rerun must not double-list the check name");
+});
+
+test("legacy StatusContext (state + context) supersession is handled by createdAt", () => {
+  const rollup = [
+    { context: "ci/legacy", state: "ERROR", createdAt: "2024-01-01T00:00:00Z" },
+    { context: "ci/legacy", state: "SUCCESS", createdAt: "2024-01-01T00:02:00Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), [], "a superseded legacy status context is not a failing gate");
+});

package/app/github.ts

@@ -521,17 +521,78 @@ interface RollupEntry {
   name?: string;
   context?: string;
   workflowName?: string;
+  /** CheckRun timestamps (GraphQL `statusCheckRollup`). A superseded run and the newer run that
+   * replaced it carry the same check name but different times, so they order the runs of one check.
+   * StatusContext carries `createdAt` instead. All are ISO-8601 or absent. */
+  startedAt?: string;
+  completedAt?: string;
+  createdAt?: string;
 }
+
+/** The canonical identity of a check across its reruns: its name (CheckRun) or context
+ * (StatusContext), falling back to its `workflowName` and finally the sentinel `"check"` when
+ * neither is present. GitHub CI concurrency can leave several runs of the SAME check on one head
+ * commit — a superseded run plus the newer run that replaced it — so this is what we group by. */
+function checkKey(c: RollupEntry): string {
+  return c.name || c.context || c.workflowName || "check";
+}
+
+/** A run's ordering timestamp (newest wins): its completion, else its start, else its creation.
+ * `0` when none is present (the shape carries no time) so a timed run always outranks an untimed
+ * one. */
+function runOrder(c: RollupEntry): number {
+  const t = c.completedAt || c.startedAt || c.createdAt;
+  if (!t) return 0;
+  const ms = Date.parse(t);
+  return Number.isNaN(ms) ? 0 : ms;
+}
+
+/** True when a run's conclusion is `CANCELLED` — the state GitHub CI concurrency stamps on a run it
+ * supersedes with a newer run on the identical head SHA (a stale/transient cancellation, not a code
+ * defect). */
+function isCancelled(c: RollupEntry): boolean {
+  return (c.conclusion || c.state || "").toUpperCase() === "CANCELLED";
+}
+
+/** Collapse a head's rollup to the **newest run per check**. GitHub's CI-concurrency cancellation
+ * (issue #348) leaves BOTH a superseded run (stamped `CANCELLED`) and the newer run that replaced
+ * it on the *same head SHA*, under the same check name. Counting the stale `CANCELLED` as a failure
+ * escalates a self-healing PR whose head is actually green. The rollup is already scoped to the head
+ * commit, so grouping by check name and keeping the newest run per name yields one ground-truth
+ * conclusion per `(headSha, checkName)`. Ties (equal/absent timestamps) prefer a non-`CANCELLED`
+ * run, so a superseded cancellation never shadows the real result even when GitHub omits times. */
+export function latestRunPerCheck(rollup: RollupEntry[]): RollupEntry[] {
+  const newest = new Map<string, RollupEntry>();
+  for (const c of rollup) {
+    const key = checkKey(c);
+    const prev = newest.get(key);
+    if (prev === undefined) {
+      newest.set(key, c);
+      continue;
+    }
+    const dt = runOrder(c) - runOrder(prev);
+    if (dt > 0) {
+      newest.set(key, c);
+    } else if (dt === 0 && isCancelled(prev) && !isCancelled(c)) {
+      // Same/unknown time: a CANCELLED run is the superseded one — the real result wins.
+      newest.set(key, c);
+    }
+  }
+  return [...newest.values()];
+}
+
 /** Names of the checks whose result is a hard failure (as opposed to pending/success). Covers
  * both the CheckRun shape (`conclusion` + `name`/`workflowName`) and the legacy StatusContext
  * shape (`state` + `context`). The names are what the CI-fix agent is handed so it knows which
- * gates to make green; `failingChecks` (the count) is derived from this list. */
-function failingCheckNames(rollup: RollupEntry[]): string[] {
+ * gates to make green; `failingChecks` (the count) is derived from this list. Derivation is over the
+ * **newest run per check** (`latestRunPerCheck`) so a `CANCELLED` run superseded by a newer green
+ * run on the identical head SHA is not counted as a failing gate (issue #348). */
+export function failingCheckNames(rollup: RollupEntry[]): string[] {
   const bad = new Set(["FAILURE", "TIMED_OUT", "CANCELLED", "ACTION_REQUIRED", "STARTUP_FAILURE", "ERROR"]);
   const names: string[] = [];
-  for (const c of rollup) {
+  for (const c of latestRunPerCheck(rollup)) {
     const v = (c.conclusion || c.state || "").toUpperCase();
-    if (bad.has(v)) names.push(c.name || c.context || c.workflowName || "check");
+    if (bad.has(v)) names.push(checkKey(c));
   }
   return names;
 }
@@ -539,10 +600,11 @@ function failingCheckNames(rollup: RollupEntry[]): string[] {
 /** Names of every head check present, regardless of state. Covers both the CheckRun shape
  * (`name`/`workflowName`) and the legacy StatusContext shape (`context`). Used to test whether a
  * repo's *required* checks are present on the head — so an unrelated always-on check (e.g.
- * Mergify's "Merge Queue") doesn't masquerade as the required CI run having already happened. */
-function allCheckNames(rollup: RollupEntry[]): string[] {
+ * Mergify's "Merge Queue") doesn't masquerade as the required CI run having already happened.
+ * Deduped to the newest run per check so a superseded rerun doesn't list a check name twice. */
+export function allCheckNames(rollup: RollupEntry[]): string[] {
   const names: string[] = [];
-  for (const c of rollup) {
+  for (const c of latestRunPerCheck(rollup)) {
     const name = c.name || c.context || c.workflowName;
     if (name) names.push(name);
   }

package/app/mergeCiReattempt.test.ts

@@ -0,0 +1,138 @@
+// Structural regression guard for the CI-concurrency-cancellation drift class (issue #348).
+//
+// The merge loop escalated a human whenever `senior:fix-ci` returned `blocked` — even when the
+// failing required checks were STALE/TRANSIENT (CANCELLED runs superseded by a newer green run on
+// the identical head SHA) and the agent honestly pushed nothing. The `fix-ci` prompt actively
+// funnelled that self-healing case into `blocked`, and `blocked` routed straight to the merge
+// escalation user task. A phantom-blocked, self-healing merge paged a human.
+//
+// The fix adds a first-class re-attempt path and a reconcile-before-escalate guard:
+//
+//   1. `status = "reattempt"` (a first-class fix-ci verdict for stale/transient checks) routes to
+//      `arm-merge`, re-queuing the merge from ground truth — no human, and declared explicitly
+//      beside the `f_ci_reconcile` empty-status default rather than relying on the fall-through.
+//   2. A `blocked` verdict with no push (`pushed != true`) reconciles ONCE via ground truth
+//      (`gw-ci-blocked` → `ci-reconcile` → re-arm the poller) and escalates only if it is STILL
+//      blocked — so even a mislabelled `blocked` self-heals.
+//
+// Pure text assertions over the committed BPMN (no engine), matching the repo's lightweight
+// model-guard style (see mergeEscalationQuestion.test.ts, mergeRebaseArm.test.ts).
+
+import { test } from "node:test";
+import { assert, assertStringIncludes } from "#test-assert";
+import { readFileSync } from "node:fs";
+
+const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
+// Collapse whitespace so attribute-order / line-wrapping churn doesn't make the assertions brittle.
+const flat = bpmn.replace(/\s+/g, " ");
+
+function flowElement(id: string): string | null {
+  const re = new RegExp(
+    `<bpmn:sequenceFlow\\b[^>]*?\\bid="${id}"[^>]*?(?:/>|>(?:(?!<bpmn:sequenceFlow\\b).)*?</bpmn:sequenceFlow>)`,
+  );
+  const m = flat.match(re);
+  return m ? m[0] : null;
+}
+
+function flowHasId(id: string, source: string, target: string): boolean {
+  const el = flowElement(id);
+  if (!el) return false;
+  return el.includes(`sourceRef="${source}"`) && el.includes(`targetRef="${target}"`);
+}
+
+function serviceTask(id: string): string | null {
+  const m = flat.match(new RegExp(`<bpmn:serviceTask\\b[^>]*\\bid="${id}"[\\s\\S]*?</bpmn:serviceTask>`));
+  return m ? m[0].replace(/&#34;/g, '"').replace(/&amp;/g, "&").replace(/&#10;/g, "\n") : null;
+}
+
+test("a first-class `reattempt` verdict re-attempts the merge (arm-merge), not escalation", () => {
+  // gw-ci-result must carry an explicit `status = "reattempt"` arm to arm-merge, declared beside
+  // (not folded into) the empty-status `f_ci_reconcile` default.
+  const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="gw-ci-result"[\s\S]*?<\/bpmn:exclusiveGateway>/);
+  assert(gw, "gw-ci-result gateway must exist");
+  assertStringIncludes(gw![0], "f_ci_reattempt", "gw-ci-result must declare the reattempt outgoing arm");
+
+  const reattempt = flowElement("f_ci_reattempt");
+  assert(reattempt, "f_ci_reattempt flow missing");
+  assert(
+    flowHasId("f_ci_reattempt", "gw-ci-result", "arm-merge"),
+    "a reattempt verdict must re-arm the merge poller (arm-merge), never escalate",
+  );
+  assertStringIncludes(reattempt!, 'status = "reattempt"', "the reattempt arm must be gated on status = reattempt");
+  // It must be an EXPLICIT labelled flow, not the empty-status default.
+  assert(!/default="f_ci_reattempt"/.test(flat), "reattempt must be an explicit arm, not the gateway default");
+});
+
+test("a fix-ci `reattempt` result does NOT create a merge escalation", () => {
+  // No flow originating from the reattempt classification may reach the merge-escalation task.
+  assert(
+    !flowHasId("f_ci_reattempt", "gw-ci-result", "merge-esc-attempt"),
+    "reattempt must never route to merge-esc-attempt",
+  );
+});
+
+test("a blocked-with-no-push verdict reconciles once from ground truth before escalating", () => {
+  // The `blocked` arm no longer flows straight into the escalation: it passes through gw-ci-blocked.
+  assert(
+    flowHasId("f_ci_blocked", "gw-ci-result", "gw-ci-blocked"),
+    "a blocked verdict must route through gw-ci-blocked, not straight to merge-esc-attempt",
+  );
+
+  const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="gw-ci-blocked"[^>]*>/);
+  assert(gw, "gw-ci-blocked gateway must exist");
+  // Default is escalate (still blocked), so a missing/true reconcile flag never wedges.
+  assertStringIncludes(gw![0], 'default="f_cib_esc"', "gw-ci-blocked must default to escalation");
+
+  // The reconcile-once arm: pushed nothing AND not yet reconciled → re-derive via ci-reconcile.
+  const recon = flowElement("f_cib_recon");
+  assert(recon, "f_cib_recon flow missing");
+  assert(flowHasId("f_cib_recon", "gw-ci-blocked", "ci-reconcile"), "reconcile arm must target ci-reconcile");
+  assertStringIncludes(recon!, "pushed != true", "reconcile only when the agent pushed nothing");
+  assertStringIncludes(recon!, "ciBlockedReconciled != true", "reconcile at most once");
+
+  // The escalate arm (default): still blocked → the human merge escalation.
+  assert(flowHasId("f_cib_esc", "gw-ci-blocked", "merge-esc-attempt"), "the still-blocked arm must escalate");
+  assert(
+    !/conditionExpression/.test(flowElement("f_cib_esc") ?? ""),
+    "f_cib_esc is the default arm and must not carry a conditionExpression",
+  );
+});
+
+test("ci-reconcile re-arms the canonical merge poller and marks the reconcile as spent", () => {
+  const el = serviceTask("ci-reconcile");
+  assert(el, "ci-reconcile service task must exist");
+  // Reuses the canonical arm-merge worker — one poller implementation, no second poller pass.
+  assertStringIncludes(el!, 'type="pr.arm-merge"', "ci-reconcile must reuse the canonical pr.arm-merge worker");
+  // Marks the reconcile spent so the SECOND blocked (still blocked after re-derivation) escalates.
+  const outs = el!.match(/<zeebe:output\b[^>]*\/>/g) ?? [];
+  assert(
+    outs.some((t) => t.includes('target="ciBlockedReconciled"') && t.includes('source="=true"')),
+    "ci-reconcile must set ciBlockedReconciled = true so a still-blocked PR escalates on the next pass",
+  );
+  // Re-derivation flows back through the mergeable wait (re-runs the ground-truth mergeable gate).
+  assert(flowHasId("f_cib_armed", "ci-reconcile", "wait-mergeable"), "ci-reconcile must re-enter wait-mergeable");
+});
+
+test("arm-merge clears the reconcile flag each loop so a fresh block episode gets its own reconcile", () => {
+  const el = serviceTask("arm-merge");
+  assert(el, "arm-merge service task must exist");
+  const outs = el!.match(/<zeebe:output\b[^>]*\/>/g) ?? [];
+  assert(
+    outs.some((t) => t.includes('target="ciBlockedReconciled"') && t.includes('source="=null"')),
+    "arm-merge must reset ciBlockedReconciled each loop so a later, unrelated block still reconciles once",
+  );
+});
+
+test("regression: a stale/transient fix-ci result can no longer page a human", () => {
+  // The old wedge: `status = "blocked"` flowing directly into merge-esc-attempt. The blocked
+  // verdict now routes through gw-ci-blocked (reconcile-before-escalate), never straight to the
+  // escalation.
+  assert(
+    !flowHasId("f_ci_blocked", "gw-ci-result", "merge-esc-attempt"),
+    "the blocked verdict must not route directly into merge-esc-attempt (the #348 phantom escalation)",
+  );
+  // The blocked arm targets the reconcile gateway; the reattempt arm re-arms the poller. Neither
+  // gw-ci-result arm may target the escalation directly.
+  assertStringIncludes(flowElement("f_ci_blocked") ?? "", 'targetRef="gw-ci-blocked"');
+  assertStringIncludes(flowElement("f_ci_reattempt") ?? "", 'targetRef="arm-merge"');
+});

package/app/mergeRebaseArm.test.ts

@@ -118,11 +118,14 @@ test("ci-fix result: a missing/ambiguous status reconciles from ground truth, no
     flowHasId("f_ci_reconcile", "gw-ci-result", "arm-merge"),
     "f_ci_reconcile must default gw-ci-result → arm-merge (reconcile)",
   );
-  // Escalation reserved for the agent's explicit `blocked` verdict.
+  // Escalation reserved for the agent's explicit `blocked` verdict — but now via a
+  // reconcile-before-escalate guard (issue #348): a `blocked` with no push reconciles once from
+  // ground truth, and only a still-blocked PR reaches the human escalation.
   const ciBlocked = flat.match(/<bpmn:sequenceFlow[^>]*id="f_ci_blocked"[\s\S]*?<\/bpmn:sequenceFlow>/);
   assert(ciBlocked, "f_ci_blocked flow missing");
   assertStringIncludes(ciBlocked![0], 'status = "blocked"');
-  assert(hasFlow("gw-ci-result", "merge-esc-attempt"), "gw-ci-result → merge-esc-attempt (blocked) missing");
+  assert(hasFlow("gw-ci-result", "gw-ci-blocked"), "blocked verdict must pass through gw-ci-blocked (reconcile-before-escalate)");
+  assert(hasFlow("gw-ci-blocked", "merge-esc-attempt"), "gw-ci-blocked → merge-esc-attempt (still blocked) missing");
 });
 
 test("regression: the conflict verdict passes through the rebase actor, not straight to escalation", () => {

package/app/mergesPerDay.test.ts

@@ -0,0 +1,173 @@
+// Read-model derivation + projection test for the merged-per-day throughput chart (issue #344).
+//
+// `deriveMergesPerDay` is the single source of truth behind the denormalised `merges_per_day` table
+// the Velocity page reads. It must: count DISTINCT PRs per calendar day (a PR with several `merged`
+// audit rows on one day — an `already-merged` short-circuit or a retry — counts once); ignore
+// `queued`/`blocked` attempts entirely; order days ascending; carry a running burn-up `cumulative`;
+// and scale each day's `bar` against the busiest day. `pollMergesPerDay` must project that onto the
+// read table idempotently — a steady-state re-run writes nothing, and a day dropped from the audit is
+// pruned.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import type { DataLayer } from "@nanobpm/urban";
+import { deriveMergesPerDay, type MergeAuditRow, pollMergesPerDay } from "./mergesPerDay.ts";
+
+// A tiny in-memory record gateway (all/find/insert/update/delete), mirroring the fake-app style used
+// across the app tests (see app/delivery.test.ts), enough to exercise the `pollMergesPerDay`
+// projection.
+function memData(): { data: DataLayer; stores: Record<string, any[]>; writes: () => number } {
+  const stores: Record<string, any[]> = {};
+  let writes = 0;
+  function tbl(name: string, pk = "id") {
+    const rows = (stores[name] ??= [] as any[]);
+    return {
+      async all() {
+        return rows.slice();
+      },
+      async get(id: any) {
+        return rows.find((r) => r[pk] === id);
+      },
+      async find(where: any = {}) {
+        return rows.filter((r) => Object.entries(where).every(([k, v]) => r[k] === v));
+      },
+      async insert(row: any) {
+        writes++;
+        rows.push({ ...row });
+        return row[pk];
+      },
+      async update(id: any, patch: any) {
+        writes++;
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+        return 1;
+      },
+      async delete(id: any) {
+        const i = rows.findIndex((row) => row[pk] === id);
+        if (i >= 0) {
+          writes++;
+          rows.splice(i, 1);
+        }
+        return 1;
+      },
+    };
+  }
+  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  return { data, stores, writes: () => writes };
+}
+
+const merged = (pr_key: string, at: string): MergeAuditRow => ({ pr_key, outcome: "merged", at });
+
+test("counts DISTINCT merged PRs per calendar day", () => {
+  const days = deriveMergesPerDay([
+    merged("o/r#1", "2026-01-01T09:00:00Z"),
+    merged("o/r#2", "2026-01-01T18:30:00Z"),
+    merged("o/r#3", "2026-01-02T10:00:00Z"),
+  ]);
+  assertEquals(days.map((d) => [d.day, d.merged]), [
+    ["2026-01-01", 2],
+    ["2026-01-02", 1],
+  ]);
+});
+
+test("dedupes duplicate merged rows for the same PR on the same day (COUNT DISTINCT pr_key)", () => {
+  const days = deriveMergesPerDay([
+    merged("o/r#1", "2026-01-01T09:00:00Z"),
+    merged("o/r#1", "2026-01-01T09:00:05Z"), // retry / already-merged short-circuit
+    merged("o/r#1", "2026-01-01T23:59:00Z"),
+  ]);
+  assertEquals(days.length, 1);
+  assertEquals(days[0].merged, 1);
+});
+
+test("the same PR merged on two different days counts once per day", () => {
+  // A defensive case: distinctness is per-day, not global.
+  const days = deriveMergesPerDay([
+    merged("o/r#1", "2026-01-01T09:00:00Z"),
+    merged("o/r#1", "2026-01-02T09:00:00Z"),
+  ]);
+  assertEquals(days.map((d) => [d.day, d.merged]), [
+    ["2026-01-01", 1],
+    ["2026-01-02", 1],
+  ]);
+});
+
+test("ignores queued and blocked attempts", () => {
+  const days = deriveMergesPerDay([
+    merged("o/r#1", "2026-01-01T09:00:00Z"),
+    { pr_key: "o/r#2", outcome: "queued", at: "2026-01-01T09:10:00Z" },
+    { pr_key: "o/r#3", outcome: "blocked", at: "2026-01-01T09:20:00Z" },
+  ]);
+  assertEquals(days.length, 1);
+  assertEquals(days[0].merged, 1);
+});
+
+test("orders days ascending and carries a running burn-up cumulative", () => {
+  const days = deriveMergesPerDay([
+    merged("o/r#5", "2026-01-03T10:00:00Z"),
+    merged("o/r#1", "2026-01-01T10:00:00Z"),
+    merged("o/r#2", "2026-01-01T11:00:00Z"),
+    merged("o/r#4", "2026-01-02T10:00:00Z"),
+  ]);
+  assertEquals(days.map((d) => d.day), ["2026-01-01", "2026-01-02", "2026-01-03"]);
+  assertEquals(days.map((d) => d.merged), [2, 1, 1]);
+  assertEquals(days.map((d) => d.cumulative), [2, 3, 4]);
+});
+
+test("bar scales against the busiest day: full for the max, non-empty for a lone merge, empty for zero", () => {
+  const days = deriveMergesPerDay([
+    // day A: 4 merges (the max) → widest bar
+    merged("o/r#1", "2026-01-01T01:00:00Z"),
+    merged("o/r#2", "2026-01-01T02:00:00Z"),
+    merged("o/r#3", "2026-01-01T03:00:00Z"),
+    merged("o/r#4", "2026-01-01T04:00:00Z"),
+    // day B: 1 merge → short but visible bar
+    merged("o/r#5", "2026-01-02T01:00:00Z"),
+  ]);
+  const [a, b] = days;
+  assert(a.bar.length > b.bar.length, "the busier day must draw a longer bar");
+  assert(b.bar.length >= 1, "a day with any merge must draw at least one glyph");
+  assert(a.bar.length <= 30, "the busiest bar must not exceed the configured width");
+});
+
+test("empty audit yields no days", () => {
+  assertEquals(deriveMergesPerDay([]), []);
+});
+
+test("pollMergesPerDay projects the aggregate onto merges_per_day", async () => {
+  const { data, stores } = memData();
+  stores.merges = [
+    { id: 1, pr_key: "o/r#1", outcome: "merged", at: "2026-01-01T09:00:00Z" },
+    { id: 2, pr_key: "o/r#1", outcome: "merged", at: "2026-01-01T09:05:00Z" }, // dup same day
+    { id: 3, pr_key: "o/r#2", outcome: "merged", at: "2026-01-02T09:00:00Z" },
+    { id: 4, pr_key: "o/r#3", outcome: "queued", at: "2026-01-02T09:10:00Z" }, // ignored
+  ];
+  await pollMergesPerDay(data);
+  const rows = (stores.merges_per_day ?? []).slice().sort((x, y) => x.day.localeCompare(y.day));
+  assertEquals(rows.map((r) => [r.day, r.merged, r.cumulative]), [
+    ["2026-01-01", 1, 1],
+    ["2026-01-02", 1, 2],
+  ]);
+  for (const r of rows) assert(typeof r.updated_at === "string" && r.updated_at.length > 0);
+});
+
+test("pollMergesPerDay is idempotent — a steady-state re-run writes nothing", async () => {
+  const { data, stores, writes } = memData();
+  stores.merges = [{ id: 1, pr_key: "o/r#1", outcome: "merged", at: "2026-01-01T09:00:00Z" }];
+  await pollMergesPerDay(data);
+  const afterFirst = writes();
+  assert(afterFirst > 0, "the first pass must project at least one row");
+  await pollMergesPerDay(data);
+  assertEquals(writes(), afterFirst, "a steady-state re-run must not write");
+});
+
+test("pollMergesPerDay prunes a day that no longer derives from the audit", async () => {
+  const { data, stores } = memData();
+  stores.merges_per_day = [
+    { day: "2025-12-31", merged: 3, cumulative: 3, bar: "███", updated_at: "old" },
+  ];
+  stores.merges = [{ id: 1, pr_key: "o/r#1", outcome: "merged", at: "2026-01-01T09:00:00Z" }];
+  await pollMergesPerDay(data);
+  const days = (stores.merges_per_day ?? []).map((r: any) => r.day);
+  assert(!days.includes("2025-12-31"), "a stale day must be pruned");
+  assert(days.includes("2026-01-01"), "the derived day must be present");
+});