@nanobpm/nano-workforce 0.103.0 → 0.105.0

package/app/service.test.ts

@@ -6,8 +6,11 @@
 // loop already guards in `startPlan`). Drives `submitPr` against an in-memory data layer with the
 // GitHub transport forced off so it is hermetic.
 import { test } from "node:test";
-import { assertEquals } from "#test-assert";
-import { parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr } from "./service.ts";
+import { assertEquals, assertRejects, assertStringIncludes } from "#test-assert";
+import { memDataFor } from "../test/worldDb.ts";
+import { DurableResumeRegistry } from "./durableResume.ts";
+import { WorldStore } from "./world/index.ts";
+import { abandonClosedPr, parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
 
 function memTable(rows: any[], key: string) {
   return {
@@ -519,6 +522,35 @@ test("repoEnvelopeVars emits commitSha only for a well-formed 40-hex SHA (world-
   assertEquals("commitSha" in none, false);
 });
 
+// Durable-resume enrolment gate (issue #325, ADR 0062 Slice 5/5): `worldRestoreSha` — the seam
+// `submitPr`/`startMerge` thread into `repoEnvelopeVars` — hands the harness the last push-checkpoint
+// ONLY when the enrolled fleet advertises `durable-resume`. With no participant it degrades to null,
+// so the round redrives from scratch (exactly as today). Proven against a REAL in-memory SQLite db
+// with the world (049) + enrolment (052) schemas applied.
+test("worldRestoreSha is gated on the durable-resume enrolment: participant → SHA, none → null", async () => {
+  const { data } = memDataFor(["049_world_checkpoint.sql", "052_worker_durable_resume.sql"]);
+  const PR = "owner/repo#7";
+  const sha = "77ee0993cc6ad4493da0f7551212ef16722135db";
+  await new WorldStore(data).recordCheckpoint({ prKey: PR, roundNo: 1, commitSha: sha });
+
+  // No participant enrolled yet — graceful degradation: no resume marker even though a checkpoint exists.
+  assertEquals(await worldRestoreSha(data, PR), null, "no participant → redrive from scratch");
+
+  // A non-participant enrolment still does not open the gate (a fleet of only non-participants).
+  await new DurableResumeRegistry(data).recordEnrolment("legacy-1", false);
+  assertEquals(await worldRestoreSha(data, PR), null, "only non-participants → still scratch");
+
+  // One participant makes the mixed fleet resume-capable: the checkpoint SHA is now emitted.
+  await new DurableResumeRegistry(data).recordEnrolment("modern-1", true);
+  assertEquals(await worldRestoreSha(data, PR), sha, "a participant → resume at the checkpoint SHA");
+});
+
+test("worldRestoreSha is null when a participant is enrolled but the PR has no checkpoint yet", async () => {
+  const { data } = memDataFor(["049_world_checkpoint.sql", "052_worker_durable_resume.sql"]);
+  await new DurableResumeRegistry(data).recordEnrolment("modern-1", true);
+  assertEquals(await worldRestoreSha(data, "owner/repo#8"), null, "nothing to reconstruct on a first activation");
+});
+
 // `parsePr` is total on any input: it is called unguarded from several workers (progress-check,
 // persist-round, persist-escalation, record-dependency) with a process variable that a regression
 // — or an older in-flight instance — could carry as a non-string. `.trim()` on a non-string throws,
@@ -723,7 +755,195 @@ test("pollWaveGatesImpl never releases the barrier on an unverifiable subscripti
   });
 });
 
-// ── pollCapabilityGatesImpl — the host half of the cross-repo capability edge (issue #289) ──────────
+// #352: a wave WEDGES forever at `wait-wave-merged` when one member PR is closed on GitHub WITHOUT
+// merging (abandoned / superseded / perpetually conflicting). The old gate released only when EVERY
+// wave-target PR reached `merged`, so a closed-unmerged member kept `allMerged = false` forever and
+// the epic could never advance. The fix classifies each target against live GitHub state and, for a
+// closed-unmerged one, (a) treats it as NON-blocking so the wave completes on its surviving merged
+// members and (b) reconciles it terminal — flipping BOTH the `pull_requests` row and its
+// `plan_tasks` row to `abandoned` so it drops out of `waveMergeTargets` and the epic read model.
+//
+// Forces token transport WITH a token and stubs `fetch` to answer both the single-PR GET (the closed
+// member reports state="closed", merged:false) and `/message-subscriptions/search` (barrier open).
+function closedMemberFetch(open: Set<string>, closedNumbers: Set<number>) {
+  return (url: string | URL | Request, init?: RequestInit): Promise<Response> => {
+    const u = typeof url === "string" ? url : url.toString();
+    const pullMatch = u.match(/\/repos\/[^/]+\/[^/]+\/pulls\/(\d+)$/);
+    if (pullMatch) {
+      const n = Number(pullMatch[1]);
+      const body = closedNumbers.has(n)
+        ? { merged: false, state: "closed", mergeable_state: "dirty" }
+        : { merged: true, state: "closed", mergeable_state: "clean" };
+      return Promise.resolve(
+        new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } }),
+      );
+    }
+    if (u.endsWith("/message-subscriptions/search")) {
+      const pik = (JSON.parse(String(init?.body ?? "{}")) as { filter?: { processInstanceKey?: string } })
+        .filter?.processInstanceKey ?? "";
+      const items = open.has(pik)
+        ? [{ messageName: "wave-merged", correlationKey: "owner/repo#67", messageSubscriptionState: "CREATED" }]
+        : [];
+      return Promise.resolve(
+        new Response(JSON.stringify({ items }), { status: 200, headers: { "content-type": "application/json" } }),
+      );
+    }
+    throw new Error(`unexpected fetch: ${u}`);
+  };
+}
+
+test("pollWaveGatesImpl releases the wave when a member PR is closed-unmerged and reconciles it terminal (#352)", async () => {
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevTok = process.env["GITHUB_TOKEN"];
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  process.env["GITHUB_TOKEN"] = "test-token"; // token present → fetchPrState hits the stubbed REST GET
+  try {
+    const PLAN_KEY = "owner/repo#67";
+    const PI = "PI-13794";
+    const plan = { plan_key: PLAN_KEY, process_key: PI, gate_wave: 2 as number | null, updated_at: "t0" };
+    const stores: Record<string, { rows: any[]; key: string }> = {
+      plans: { rows: [plan], key: "plan_key" },
+      plan_tasks: {
+        rows: [
+          // A surviving MERGED member (tracked row → no network) and a member whose PR was CLOSED
+          // on GitHub without merging while its task was still `opened` (never reached merge stage).
+          { id: "owner/repo#67:a", plan_key: PLAN_KEY, wave: 2, status: "opened", pr_key: "owner/repo#68" },
+          { id: "owner/repo#67:b", plan_key: PLAN_KEY, wave: 2, status: "opened", pr_key: "owner/repo#70" },
+        ],
+        key: "id",
+      },
+      pull_requests: {
+        rows: [
+          { pr_key: "owner/repo#68", status: "merged" },
+          { pr_key: "owner/repo#70", status: "converging" }, // not merged in the DB → falls to live GitHub read
+        ],
+        key: "pr_key",
+      },
+      merges: { rows: [], key: "id" },
+    };
+    const data = {
+      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    } as any;
+
+    const published: { name: string; correlationKey?: string }[] = [];
+    const engine = {
+      publishMessage: (input: { name: string; correlationKey?: string }) => {
+        published.push(input);
+        return Promise.resolve();
+      },
+    } as any;
+    const headers = { "content-type": "application/json" };
+    const prevFetch = globalThis.fetch;
+
+    globalThis.fetch = closedMemberFetch(new Set([PI]), new Set([70])) as typeof fetch;
+    try {
+      await pollWaveGatesImpl(data, engine, "test-token", "http://engine/v2", headers);
+    } finally {
+      globalThis.fetch = prevFetch;
+    }
+
+    // The barrier RELEASES — the closed-unmerged member no longer wedges the wave.
+    assertEquals(published.length, 1, "must publish wave-merged once the closed member is treated non-blocking");
+    assertEquals(published[0]?.name, "wave-merged");
+    assertEquals(published[0]?.correlationKey, PLAN_KEY);
+
+    // The closed member is reconciled terminal: PR row + its plan_tasks row flip to `abandoned`,
+    // and a terminal `merges` audit row is recorded (the canonical abandon writer).
+    const prRow = stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#70");
+    assertEquals(prRow?.status, "abandoned");
+    const taskRow = stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:b");
+    assertEquals(taskRow?.status, "abandoned");
+    assertEquals(stores.merges.rows.length, 1);
+    assertEquals((stores.merges.rows[0] as any).outcome, "abandoned");
+    assertEquals((stores.merges.rows[0] as any).method, "pr-closed");
+    // The surviving merged member is untouched.
+    assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:a")?.status, "opened");
+  } finally {
+    if (prevMode !== undefined) process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+    else delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    if (prevTok !== undefined) process.env["GITHUB_TOKEN"] = prevTok;
+    else delete process.env["GITHUB_TOKEN"];
+  }
+});
+
+// #352 review: `abandonClosedPr` must be genuinely idempotent. It is reached from BOTH observers of a
+// closed-unmerged member (merge worker + wave gate) and can be retried by the poller, so an
+// unconditional `merges` insert would spam the audit with duplicate `outcome:"abandoned"/method:
+// "pr-closed"` rows and skew reporting. Re-running it re-stamps the terminal status but writes the
+// audit row only once.
+test("abandonClosedPr is idempotent — the terminal merges audit row is written at most once (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [{ pr_key: "owner/repo#70", status: "converging" }], key: "pr_key" },
+    plan_tasks: { rows: [{ id: "owner/repo#67:b", plan_key: "owner/repo#67", wave: 2, status: "opened", pr_key: "owner/repo#70" }], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  await abandonClosedPr(data, "owner/repo#70", "closed without merging");
+  await abandonClosedPr(data, "owner/repo#70", "closed without merging"); // retry / second observer
+
+  // Terminal status re-stamped, but exactly one audit row despite two calls.
+  assertEquals(stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#70")?.status, "abandoned");
+  assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:b")?.status, "abandoned");
+  assertEquals(stores.merges.rows.length, 1, "no duplicate abandoned/pr-closed audit rows on retry");
+  assertEquals((stores.merges.rows[0] as any).method, "pr-closed");
+});
+
+// #352 review (suppressed advisory app/service.ts:863): `abandonClosedPr` writes the terminal
+// `merges` audit row — an FK child of `pull_requests.pr_key` — and must not assume the parent row
+// exists. The merge-worker caller pre-heals with `ensurePr`, but the wave-gate self-heal path
+// (`pollWaveGatesImpl`) does NOT, so in an engine/app.db desync the canonical writer could observe a
+// closed member whose `pull_requests` row is missing and hit a `FOREIGN KEY constraint failed`,
+// wedging the poller pass. The canonical writer must self-heal the parent (idempotent `ensurePr`)
+// before the FK-child insert, symmetrically for BOTH callers. Read-model witness: with a missing
+// parent row the old code's `prs.update` was a silent no-op, so the PR was never reconciled terminal.
+test("abandonClosedPr self-heals a missing pull_requests parent row before the FK-child audit insert (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [], key: "pr_key" }, // desync: parent row is MISSING
+    plan_tasks: { rows: [{ id: "owner/repo#67:c", plan_key: "owner/repo#67", wave: 3, status: "opened", pr_key: "owner/repo#71" }], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  await abandonClosedPr(data, "owner/repo#71", "closed without merging");
+
+  // The parent row is reconstructed AND flipped terminal, so the FK-child audit row has a parent.
+  const parent = stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#71");
+  assertEquals(parent?.status, "abandoned", "missing parent pull_requests row is self-healed and reconciled terminal");
+  assertEquals(parent?.repo, "owner/repo", "reconstructed parent carries the parsed repo");
+  assertEquals(parent?.number, 71, "reconstructed parent carries the parsed number");
+  assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:c")?.status, "abandoned");
+  assertEquals(stores.merges.rows.length, 1, "terminal audit row written once");
+});
+
+// #352 review (suppressed advisory app/service.ts:861): the self-heal only runs when `parsePr(prKey)`
+// succeeds, so a MALFORMED prKey (engine/app.db desync, a process-variable regression) would skip
+// the heal yet still reach `merges.insert` — which, with a missing parent, fails with an opaque
+// `FOREIGN KEY constraint failed`, the exact incident this helper exists to prevent. The canonical
+// writer must fail closed with a clear, actionable error naming the bad key, not leak an FK incident.
+test("abandonClosedPr rejects a malformed prKey with a clear error before any FK-child insert (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [], key: "pr_key" },
+    plan_tasks: { rows: [], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  const err = await assertRejects(() => abandonClosedPr(data, "not-a-valid-pr-key", "closed without merging"));
+  assertStringIncludes((err as Error).message, "malformed prKey");
+  assertStringIncludes((err as Error).message, "not-a-valid-pr-key");
+  // No audit row and no terminal side effects leaked before the guard fired.
+  assertEquals(stores.merges.rows.length, 0, "no FK-child audit insert attempted on a malformed prKey");
+  assertEquals(stores.pull_requests.rows.length, 0, "no parent row written on a malformed prKey");
+});
+
+
 //
 // plan-fanout parks a task with capability `needs` at the `wait-caps-resolved` message barrier. This
 // reconciler, on every pass, (a) starts the durable `readiness-gate` once per need, (b) does a single

package/app/service.ts

@@ -9,7 +9,7 @@
 // `Table<T>` surface), not hand-written SQL. Row shapes are declared inline here.
 import { readFileSync } from "node:fs";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
-import { abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
+import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
 import { agentSlaTimeout } from "./agentSla.ts";
 import {
   CAPS_RESOLVED_MESSAGE,
@@ -21,7 +21,9 @@ import {
   renderResolvedDepsBrief,
   UnresolvableCapabilityRefError,
 } from "./capabilityNeed.ts";
+import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
+import { fleetSupportsDurableResume } from "./durableResume.ts";
 import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
 import {
   classifyMergeability,
@@ -441,6 +443,19 @@ async function lastPushedSha(data: DataLayer, prKey: string): Promise<string | n
   }
 }
 
+/** The world-restore SHA to emit into the repo-provisioning envelope for a PR, GATED on the
+ * `durable-resume` enrolment (issue #325, ADR 0062 Slice 5/5). Only when the enrolled fleet includes a
+ * durable-resume participant (`fleetSupportsDurableResume`) do we hand the harness the last
+ * push-checkpoint so a replacement activation RESUMES by reconstructing the exact pushed tree
+ * (inverting `git push` → `git fetch && git checkout <sha>`). With no participant the marker is
+ * omitted (`null`), so the round redrives from scratch — graceful degradation, exactly as today.
+ * Resume is purely additive: gating on the enrolment attribute, not a sequence flow, keeps the
+ * engine/C8 job protocol untouched (ADR 0056 boundary). */
+export async function worldRestoreSha(data: DataLayer, prKey: string): Promise<string | null> {
+  if (!(await fleetSupportsDurableResume(data))) return null;
+  return lastPushedSha(data, prKey);
+}
+
 /** Register a PR row (if new) and start the convergence process. Idempotent on prKey. Optional
  * `dependsOn` (explicit refs) is unioned with any `Depends-on:` line parsed from the PR body and
  * recorded as the PR's merge-stage dependency set. */
@@ -547,9 +562,11 @@ export async function submitPr(
   const abUrl = abandonUrl(abandonToken);
   // World-restore (issue #324, ADR 0062 Slice 4/5): a re-run of convergence for a PR that already
   // pushed is a resume — carry its last durable push-checkpoint so a replacement activation on a
-  // fresh worktree reconstructs the tree to the EXACT pushed SHA. Absent (null) on a first submit,
-  // which leaves the envelope unchanged.
-  const worldSha = await lastPushedSha(data, parsed.prKey);
+  // fresh worktree reconstructs the tree to the EXACT pushed SHA. GATED (issue #325, Slice 5/5) on the
+  // fleet advertising `durable-resume`: with no participant it stays null, so the round redrives from
+  // scratch (graceful degradation). Absent (null) on a first submit, which leaves the envelope
+  // unchanged.
+  const worldSha = await worldRestoreSha(data, parsed.prKey);
   const { processInstanceKey } = await engine.createInstance({
     processDefinitionId: PROCESS_ID,
     variables: {
@@ -623,8 +640,10 @@ export async function startMerge(
     console.warn(`[startMerge] ${pr.prKey} head branch unresolved — merge-agent workspace won't be provisioned`);
   }
   // World-restore (issue #324): the merge stage runs on the same durable working tree; carry the
-  // last push-checkpoint so a replacement fix-ci/rebase activation reconstructs the exact SHA.
-  const worldSha = await lastPushedSha(data, pr.prKey);
+  // last push-checkpoint so a replacement fix-ci/rebase activation reconstructs the exact SHA. GATED
+  // (issue #325, Slice 5/5) on the fleet advertising `durable-resume` — otherwise null, so the merge
+  // agents redrive from scratch (graceful degradation).
+  const worldSha = await worldRestoreSha(data, pr.prKey);
   const { processInstanceKey } = await engine.createInstance({
     processDefinitionId: MERGE_PROCESS_ID,
     variables: {
@@ -826,6 +845,110 @@ async function isDepMerged(data: DataLayer, depKey: string, token: string): Prom
   }
 }
 
+/** Canonically retire a **closed-unmerged** PR's read model. Writes the terminal `merges` audit row
+ * and flips BOTH the `pull_requests` row and every `plan_tasks` row keyed to the PR to `abandoned`.
+ *
+ * This is the ONE canonical abandon implementation, reached from BOTH entry points that observe a
+ * wave/merge member closed on GitHub without merging (#352):
+ *   • the merge stage — `workers/merge` `attempt-merge` closed short-circuit (#342), and
+ *   • the wave-merge gate — `pollWaveGatesImpl`'s self-heal for a PR closed out-of-band while its
+ *     task was still `opened` (never reached the merge stage, so `pollMerges` never saw it).
+ *
+ * Flipping the **task** row (not only the PR row) is essential: `waveMergeTargets` keys on
+ * `plan_tasks.status`, so a still-`opened` task keeps a dead PR in the blocking set and wedges the
+ * wave barrier forever; an `abandoned` task drops out (the wave completes on its surviving merged
+ * members) and stops `isPlanComplete`/the Epics table counting a phantom open task. Idempotent for a
+ * poller retry (or the two observers — merge worker + wave gate — racing the same closed PR):
+ * re-running just re-stamps the same terminal status, and the terminal `merges` audit row is written
+ * only once: the fast-path guard skips the insert when an `abandoned`/`pr-closed` row already exists,
+ * and — because that check-then-insert is racy under the two observers (merge worker + wave gate)
+ * racing the same closed PR — a DB-level partial UNIQUE fence (`ux_merges_abandon_pr_closed`,
+ * migration 053) rejects a concurrent duplicate, which we swallow as the same idempotent outcome. So
+ * retries (sequential OR concurrent) can't spam the audit with duplicate rows and skew reporting.
+ *
+ * Self-heals the FK parent first: the `merges` audit row is an FK child of `pull_requests.pr_key`, so
+ * before writing it we ensure the parent row exists via the idempotent {@link ensurePr}. The merge
+ * worker already pre-heals, but the wave-gate self-heal path does not — and in an engine/app.db
+ * desync (the exact class `ensurePr` heals) it can observe a closed member whose `pull_requests` row
+ * is missing. Healing inside the ONE canonical writer covers BOTH callers symmetrically, so the
+ * FK-child insert can never hit `FOREIGN KEY constraint failed` and wedge the poller pass. */
+export async function abandonClosedPr(data: DataLayer, prKey: string, detail: string): Promise<void> {
+  const ts = now();
+  const parsed = parsePr(prKey);
+  // Self-heal the FK parent, but ONLY when `prKey` is well-formed. A malformed key can't be healed
+  // (there's no repo/number to `ensurePr`), and silently skipping the heal would let the downstream
+  // `merges.insert` fail with an opaque `FOREIGN KEY constraint failed` — the exact incident this
+  // helper exists to prevent. Fail closed with a clear, actionable error instead.
+  if (!parsed) {
+    throw new Error(`abandonClosedPr: malformed prKey ${JSON.stringify(prKey)} — cannot self-heal the pull_requests FK parent`);
+  }
+  await ensurePr(data, { prKey, repo: parsed.repo, number: parsed.number });
+  const merges = data.table("merges", "id");
+  const alreadyAudited =
+    (await merges.findOne({ pr_key: prKey, outcome: "abandoned", method: "pr-closed" })) !== null;
+  if (!alreadyAudited) {
+    try {
+      await merges.insert({
+        pr_key: prKey,
+        outcome: "abandoned",
+        method: "pr-closed",
+        detail,
+        at: ts,
+      });
+    } catch (err) {
+      // The `find`-then-`insert` guard above is racy: the merge worker and the wave-gate self-heal
+      // path can both observe "no row" and both insert. The partial UNIQUE fence
+      // (`ux_merges_abandon_pr_closed`, migration 053) rejects the loser — tolerate that collision as
+      // the SAME idempotent outcome the guard intends, and only that. Any other error rethrows.
+      if (!isUniqueConstraintFence(err)) throw err;
+    }
+  }
+  await prs(data).update(prKey, { status: ABANDONED_STATUS, updated_at: ts });
+  const tasks = planTasks(data);
+  for (const t of await tasks.find({ pr_key: prKey })) {
+    await tasks.update(t.id, { status: ABANDONED_STATUS, updated_at: ts });
+  }
+}
+
+/** Classify a wave-merge target PR against GitHub ground truth for the wave gate (#352):
+ *   • `cleared` — merged (tracked `merged` row, an out-of-band `merged` live state, or an
+ *     already-`abandoned` tracked row / non-PR ref that can never block) → non-blocking.
+ *   • `closed`  — live GitHub state is closed WITHOUT merging → non-blocking, and the caller must
+ *     reconcile it terminal via {@link abandonClosedPr} so it leaves the target set.
+ *   • `pending` — still open, or read successfully but in an ambiguous (`unknown`) live state → still
+ *     blocks the wave. A *thrown* transport error (network/5xx) is NOT swallowed here: it rethrows so
+ *     the poller pass logs and retries — behaviourally identical for the barrier (it stays armed and
+ *     re-checks next pass), and canonical with {@link isDepMerged}, which rethrows transient failures
+ *     the same way. Only a `not-a-pull-request` error is caught (→ `cleared`).
+ *
+ * Mirrors {@link isDepMerged} (tracked-row fast path, then a live read, `not-a-pull-request` treated
+ * as cleared, transient errors rethrown) but adds the closed-unmerged branch the wave barrier lacked
+ * — the direct analogue of the merge stage's `classifyPrLiveness === "closed"` abandon. Conservative:
+ * an unreadable PR never resolves to a terminal `cleared`/`closed`, so a false negative only costs a
+ * retry while a false positive that would drop a live member is impossible. */
+async function classifyWaveTarget(
+  data: DataLayer,
+  prKey: string,
+  token: string,
+): Promise<"cleared" | "closed" | "pending"> {
+  const tracked = await prs(data).get(prKey);
+  if (tracked && tracked.status === "merged") return "cleared";
+  if (tracked && tracked.status === ABANDONED_STATUS) return "cleared"; // already reconciled terminal → non-blocking, no re-reconcile needed
+  const parsed = parsePr(prKey);
+  if (!parsed) return "cleared"; // unparseable ref can't be checked → never wedge the barrier
+  let st: Awaited<ReturnType<typeof fetchPrState>>;
+  try {
+    st = await fetchPrState(parsed.repo, parsed.number, token);
+  } catch (err) {
+    if (isNotAPullRequestError(err)) return "cleared"; // an issue/missing number can never merge
+    throw err;
+  }
+  const liveness = classifyPrLiveness(st);
+  if (liveness === "merged") return "cleared";
+  if (liveness === "closed") return "closed";
+  return "pending"; // read OK but open or ambiguous (`unknown`) live state → stay conservative and keep blocking
+}
+
 /** Flip a PR into the transient `merging` status and publish the correlating message, reverting
  * to `prevStatus` if the publish fails. `merging` is deliberately a status no poll branch scans
  * (so a slow pass can't double-signal), which means a publish failure *after* the flip would
@@ -1391,7 +1514,23 @@ export async function pollWaveGatesImpl(
       let allMerged = true;
       const tasks = await planTasks(data).find({ plan_key: planKey });
       for (const prKey of waveMergeTargets(tasks, gateWave)) {
-        if (!(await isDepMerged(data, prKey, token))) {
+        const state = await classifyWaveTarget(data, prKey, token);
+        if (state === "closed") {
+          // Self-heal (#352): a wave-target PR closed on GitHub WITHOUT merging (abandoned /
+          // superseded / perpetually conflicting) can never reach `merged`, so it must NOT keep the
+          // barrier armed forever. Retire it through the canonical abandon writer — flipping the
+          // `plan_tasks` row terminal so it drops out of `waveMergeTargets` and the epic read model —
+          // and treat it as non-blocking: the wave completes on its surviving merged members. This is
+          // the wave-gate reach of the SAME abandon path the merge stage uses for a closed member.
+          await abandonClosedPr(
+            data,
+            prKey,
+            "wave-target PR was closed on GitHub without merging — reconciling terminal so the wave gate can advance",
+          );
+          console.log(`[poller] wave-target closed without merging -> ${prKey}`);
+          continue;
+        }
+        if (state === "pending") {
           allMerged = false;
           break;
         }

package/app/waves.test.ts

@@ -127,3 +127,15 @@ test("waveMergeTargets → a wave with no opened PRs clears vacuously (empty)",
   ];
   assertEquals(waveMergeTargets(tasks, 0), []);
 });
+
+// #352: a wave member whose PR was closed-unmerged is reconciled to the terminal `abandoned`
+// status. Such a task must NOT stay in the blocking set — a dead PR can never reach `merged`, so
+// leaving it in would wedge the wave-merge barrier forever. The surviving merged member is the only
+// target the gate waits on.
+test("waveMergeTargets → an abandoned (closed-unmerged) wave member drops out of the blocking set", () => {
+  const tasks: WaveGateTask[] = [
+    { wave: 0, status: "opened", pr_key: "o/r#1" },
+    { wave: 0, status: "abandoned", pr_key: "o/r#2" }, // PR closed without merging → reconciled terminal
+  ];
+  assertEquals(waveMergeTargets(tasks, 0), ["o/r#1"]);
+});

package/app/world/store.ts

@@ -10,6 +10,7 @@
 // duplicated (AGENTS.md "derivation over duplication": the tree is derived from `remote SHA +
 // effect-tail`, never snapshot into a log).
 import type { DataLayer, Table } from "@nanobpm/urban";
+import { isUniqueConstraintFence } from "../dbFence.ts";
 import type { Effect, EffectKind, Fence } from "./effect-ledger.ts";
 
 /** A persisted push-checkpoint row (`world_checkpoints`). */
@@ -104,13 +105,12 @@ export class WorldStore {
    * concurrent/duplicate writer inserted the row BETWEEN our `findOne` and our `insert`. Every insert
    * in this store guards a UNIQUE constraint (`UNIQUE(pr_key, commit_sha)` / `(pr_key, checkpoint_offset)`
    * on checkpoints, `UNIQUE(pr_key, idempotency_key)` on effects), so a check-then-insert is inherently
-   * racy under the at-least-once persist-round delivery + a distributed fleet. This is the ONE place the
-   * store classifies a fence collision, so the three insert sites below turn it into the SAME intended
-   * idempotent outcome instead of each re-encoding the driver's error shape (a drift surface). Matched on
-   * the message substring the RAD `Table` surface propagates verbatim — the same one the schema tests
-   * assert on — because that surface hides the concrete driver error type. */
+   * racy under the at-least-once persist-round delivery + a distributed fleet. Delegates to the ONE
+   * canonical classifier ({@link isUniqueConstraintFence}) so this store, `abandonClosedPr`, and any
+   * future fence site share a single implementation instead of each re-encoding the driver's error
+   * shape (AGENTS.md: "no drift surfaces"). */
   static #isFenceCollision(err: unknown): boolean {
-    return err instanceof Error && /UNIQUE constraint failed/i.test(err.message);
+    return isUniqueConstraintFence(err);
   }
 
   /** Reconcile an existing ledger row's `applied` flag toward a LATER record's knowledge: flip a

package/db/migrations/004_planning.sql

@@ -26,7 +26,7 @@ CREATE TABLE plan_tasks (
   task_id     TEXT NOT NULL,               -- planner-supplied slug (or "t<index>")
   title       TEXT,
   prompt      TEXT,
-  status      TEXT NOT NULL,               -- pending | opened | blocked | skipped
+  status      TEXT NOT NULL,               -- pending | opened | blocked | skipped | escalated | waiting-for-lane | abandoned
   pr_key      TEXT,                         -- the PR this slice produced ("<owner>/<repo>#<n>")
   summary     TEXT,
   created_at  TEXT NOT NULL,

package/db/migrations/052_plan_conformance.sql

@@ -0,0 +1,28 @@
+-- Spec-conformance review — the post-completion "did we build what the spec asked for?" stage.
+--
+-- It rides the same `retro` process that already fires exactly once when an epic's LAST PR reaches
+-- a terminal state (see 016_plan_retro.sql / app/retro.ts). Before the retro agent distils lessons,
+-- a `senior:conformance` agent EXAMINES THE ACTUAL IMPLEMENTATION — it reads the delivered PR diffs,
+-- the code, and the tests (not just what agents claimed) — and checks each item of the spec (the
+-- epic issue + every slice's `prompt`) against what was really shipped. It posts a conformance
+-- report as a comment on the epic issue and emits per-item acceptance verdicts plus the two classes
+-- of deviation: those RAISED during implementation (`scope-change` blackboard entries) and those it
+-- found itself that were NEVER raised. This table records that result.
+--
+-- Advisory, like the retro it accompanies: it gates no delivery control flow (the epic already
+-- merged). One row per epic, keyed on plan_key.
+CREATE TABLE plan_conformance (
+  plan_key             TEXT PRIMARY KEY REFERENCES plans(plan_key),
+  status               TEXT NOT NULL,               -- filed | skipped | blocked (the agent's result status)
+  comment_url          TEXT,                         -- the conformance report comment the agent posted on the epic issue, or NULL
+  slices_met           INTEGER NOT NULL DEFAULT 0,  -- items fully delivered as specified
+  slices_reduced       INTEGER NOT NULL DEFAULT 0,  -- items delivered in a reduced/partial form, incl. met-in-unit-only (unit-tested but not proven live-wired)
+  slices_not_verified  INTEGER NOT NULL DEFAULT 0,  -- items the agent could not confirm from the implementation (e.g. no live wiring / synthetic only)
+  deviations_raised    INTEGER NOT NULL DEFAULT 0,  -- scope deviations agents flagged during implementation (`scope-change` entries)
+  deviations_unraised  INTEGER NOT NULL DEFAULT 0,  -- scope deviations the agent found by examining the code that were NEVER flagged
+  has_deviations       INTEGER NOT NULL DEFAULT 0,  -- 1 when anything is reduced / not-verified / an unraised deviation exists (drives escalation in a later slice)
+  summary              TEXT,                         -- the agent's human-readable conformance summary
+  report               TEXT,                         -- the full conformance report / transcript (nullable)
+  created_at           TEXT NOT NULL,
+  updated_at           TEXT NOT NULL
+);

package/db/migrations/052_worker_durable_resume.sql

@@ -0,0 +1,35 @@
+-- 052_worker_durable_resume.sql — issue #325 (ADR 0062, Slice 5/5): the ENROLMENT GATE for durable
+-- agent-session resume. Slices 1–4 built the mind (harness conversation) and world (git tree + effect
+-- ledger) halves; this slice wires them into the running orchestration behind a `durable-resume`
+-- enrolment gate so a re-leased `senior:pr-review` round RESUMES at the last push-checkpoint on a
+-- participating harness, and gracefully DEGRADES (redriven from scratch, exactly as today) on one
+-- that does not advertise it.
+--
+-- `durable-resume` is a WORKER ATTRIBUTE declared at enrolment (ADR 0056 §7 — capability gates
+-- enrolment, it is NEVER in the routing token `network.role#seat`). The registry records, per worker
+-- instance, whether that worker's harness advertises durable-resume (the probe result from Slice
+-- 2/3). The world-restore `commitSha` is emitted into the repo-provisioning envelope ONLY when the
+-- fleet includes a participant; a fleet with no participant emits no resume marker and clones the
+-- head branch tip — the pre-#324 behaviour. Resume is purely additive, never a new sequence-flow
+-- gate (ADR 0056 boundary): the engine/C8 job protocol is untouched.
+--
+-- One FK-free table keyed by the worker instance (`register.instance` / the enrol `instance`). It is
+-- FK-free by design — enrolment is per-worker and connection-agnostic, with no `pull_requests`/`plans`
+-- parent to reference. EXPAND (additive) phase: one new table + its index; nothing is dropped or
+-- renamed. Numbered after the current highest prefix on origin/main (051). The runner wraps each file
+-- in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+
+CREATE TABLE IF NOT EXISTS worker_durable_resume (
+  instance       TEXT PRIMARY KEY,            -- the worker instance id (enrol `instance` / register.instance)
+  durable_resume INTEGER NOT NULL DEFAULT 0,  -- 1 when the worker's harness advertises durable-resume, else 0
+  updated_at     TEXT NOT NULL,
+  -- `durable_resume` is a strict boolean domain — the gate reads it as "does this worker participate?",
+  -- so a stray value (a future writer bug, a corrupt row on this externalised enrolment boundary) would
+  -- make the gate mis-decide whether to emit the resume marker. Pin it to {0,1} at the schema.
+  CHECK (durable_resume IN (0, 1))
+);
+
+-- The gate asks "does the fleet include a durable-resume participant?" — an existence probe over the
+-- participants. Index the flag so that lookup is a covered scan, not a table walk.
+CREATE INDEX IF NOT EXISTS idx_worker_durable_resume_flag
+  ON worker_durable_resume(durable_resume);

package/db/migrations/053_merges_abandon_dedupe.sql

@@ -0,0 +1,29 @@
+-- Enforce the abandon-audit invariant at the DB level (#352, PR #354 review — suppressed advisory on
+-- app/service.ts:867). `abandonClosedPr`'s "write the terminal `merges` audit row only once" guard was
+-- a NON-ATOMIC find-then-insert: the two observers that reconcile a closed-unmerged member — the merge
+-- worker's `attempt-merge` closed short-circuit and the wave-gate self-heal in `pollWaveGatesImpl` —
+-- can run concurrently, so both observe "no row" between the `find` and the `insert` and both write an
+-- `abandoned`/`pr-closed` row for the same `pr_key`. Sequential-idempotency tests pass, but the guard
+-- is only best-effort under a real concurrent race.
+--
+-- Make the invariant a DB constraint (the canonical durable-fence idiom — cf. the `UNIQUE` fences on
+-- `world_effects`/`world_checkpoints` in 049): AT MOST ONE (outcome='abandoned', method='pr-closed')
+-- `merges` row per `pr_key`. The writer keeps its fast-path `find` guard (so the common retry never
+-- throws) but now tolerates the UNIQUE fence as the SAME idempotent outcome (see `app/dbFence.ts`).
+--
+-- Expand phase (additive, forward-only): first collapse any duplicates a pre-fence race already wrote
+-- — keep the earliest row (`MIN(id)`) per `pr_key` — so the partial UNIQUE index can be created on an
+-- already-populated database, then add the index. Only `abandoned`/`pr-closed` rows are touched;
+-- `merged`/`queued`/`blocked` audit rows are untouched and may still repeat per `pr_key`.
+DELETE FROM merges
+WHERE outcome = 'abandoned'
+  AND method = 'pr-closed'
+  AND id NOT IN (
+    SELECT MIN(id) FROM merges
+    WHERE outcome = 'abandoned' AND method = 'pr-closed'
+    GROUP BY pr_key
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_merges_abandon_pr_closed
+  ON merges (pr_key)
+  WHERE outcome = 'abandoned' AND method = 'pr-closed';

package/nano.app.json

@@ -162,6 +162,10 @@
       "taskType": "pr.retro-record",
       "handler": "workers/retro-record/worker.ts"
     },
+    {
+      "taskType": "pr.conformance-record",
+      "handler": "workers/conformance-record/worker.ts"
+    },
     {
       "taskType": "pr.progress-check",
       "handler": "workers/progress-check/worker.ts"
@@ -183,7 +187,8 @@
     "senior:plan-review",
     "senior:feature",
     "senior:trial-merge",
-    "senior:retro"
+    "senior:retro",
+    "senior:conformance"
   ],
   "surfaces": {
     "taskInbox": {