@nanobpm/nano-workforce 0.104.0 → 0.105.0

package/app/retro.test.ts

@@ -166,6 +166,17 @@ test("gatherRetro: separates learnings from notes and folds in deltas", async ()
   assertEquals(d.repo, "acme/widgets");
 });
 
+test("gatherRetro: uses pre-fetched blackboard entries instead of re-scanning", async () => {
+  const { data, stores } = memData();
+  seedPlan(stores);
+  // A learning lives in the store, but the caller passes an EMPTY pre-fetched snapshot — gatherRetro
+  // must honour what it was handed and not re-read the store.
+  await appendEntry(data, PLAN, { author_task: "t1", kind: "learning", body: "should be ignored" });
+  const d = await gatherRetro(data, PLAN, []);
+  assertEquals(d.counts.learnings, 0);
+  assertEquals(d.notes.length, 0);
+});
+
 test("gatherRetro: folds in the plan-review trace and task-outcome shape", async () => {
   const { data, stores } = memData();
   seedPlan(stores);
@@ -382,11 +393,13 @@ test("maybeStartRetro: bails while the plan is incomplete", async () => {
   assertEquals(stores["plans"][0].retro_started_at, null, "must not stamp an incomplete plan");
 });
 
-test("maybeStartRetro: complete but empty → records a skipped retro, does not start the process", async () => {
+test("maybeStartRetro: complete but nothing landed (PR abandoned) → records a skipped retro, does not start", async () => {
   const { data, stores } = memData();
   seedPlan(stores);
+  // The only task's PR was abandoned: the plan is complete (abandoned is terminal) but shipped no
+  // code, so there is neither reflection material nor an implementation to audit.
   seedTask(stores, { id: "t1", status: "opened", pr_key: "acme/widgets#10" });
-  seedPr(stores, "acme/widgets#10", "merged");
+  seedPr(stores, "acme/widgets#10", "abandoned");
   const { engine, started } = fakeEngine();
 
   const r = await maybeStartRetro(data, engine, "acme/widgets#10");
@@ -397,6 +410,23 @@ test("maybeStartRetro: complete but empty → records a skipped retro, does not
   assertEquals(stores["plan_retros"][0].status, "skipped");
 });
 
+test("maybeStartRetro: complete with landed code but no learnings → still starts (conformance has something to verify)", async () => {
+  const { data, stores } = memData();
+  seedPlan(stores);
+  // A merged PR but zero learnings/deltas/notes: the retro digest is empty, but there IS delivered
+  // implementation to audit for conformance — so the process must still start.
+  seedTask(stores, { id: "t1", status: "opened", pr_key: "acme/widgets#10" });
+  seedPr(stores, "acme/widgets#10", "merged");
+  const { engine, started } = fakeEngine();
+
+  const r = await maybeStartRetro(data, engine, "acme/widgets#10");
+  assertEquals(r.started, true);
+  assertEquals(r.planKey, PLAN);
+  assertEquals(started.length, 1);
+  assertEquals(started[0].processDefinitionId, "retro");
+  assert(stores["plans"][0].retro_started_at, "retro_started_at must be stamped");
+});
+
 test("maybeStartRetro: a rejected review round alone is enough to fire the retro", async () => {
   const { data, stores } = memData();
   seedPlan(stores);

package/app/retro.ts

@@ -14,7 +14,8 @@
 // Data access goes through the record gateway (`data.table`), never hand-written SQL — matching
 // app/plan.ts, app/blackboard.ts, and app/taskDelta.ts.
 import type { DataLayer, EngineClient, Logger } from "@nanobpm/urban";
-import { isUniqueViolation, readBlackboard } from "./blackboard.ts";
+import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
+import { hasDeliveredImplementationForPlan } from "./conformance.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
 import { planReviews, planTasks } from "./plan.ts";
 import { aggregateEpicDeltas } from "./taskDelta.ts";
@@ -110,14 +111,22 @@ export interface RetroDigest {
 /** Gather a plan's reflection material: the `learning` blackboard entries (the headline), plus the
  * task-delta rollup (contract changes, discovered constraints, cross-slice file touches), the
  * plan-review trace (rounds + rejection findings), the task-outcome shape, and any other
- * non-learning blackboard notes for colour. Reads only — no writes. */
-export async function gatherRetro(data: DataLayer, planKey: string): Promise<RetroDigest> {
+ * non-learning blackboard notes for colour. Reads only — no writes.
+ *
+ * `entries` lets a caller that has already scanned the blackboard for this plan (e.g.
+ * `pr.retro-gather`, which also runs {@link gatherConformance}) pass those entries in so the plan is
+ * scanned once, not once per gatherer — see workers/retro-gather. Omitted, it reads them itself. */
+export async function gatherRetro(
+  data: DataLayer,
+  planKey: string,
+  entries?: BlackboardEntry[],
+): Promise<RetroDigest> {
   const plan = await plansTbl(data).get(planKey);
-  const entries = await readBlackboard(data, planKey);
-  const learnings = entries
+  const bbEntries = entries ?? (await readBlackboard(data, planKey));
+  const learnings = bbEntries
     .filter((e) => e.kind === "learning")
     .map((e) => ({ author_task: e.author_task, body: e.body, created_at: e.created_at }));
-  const notes = entries
+  const notes = bbEntries
     .filter((e) => e.kind !== "learning")
     .map((e) => ({ author_task: e.author_task, kind: e.kind, body: e.body }));
   const deltas = await aggregateEpicDeltas(data, planKey);
@@ -310,12 +319,19 @@ export async function maybeStartRetro(
     if (!(await isPlanComplete(data, planKey))) return { started: false, planKey, reason: "incomplete" };
 
     const digest = await gatherRetro(data, planKey);
-    if (isDigestEmpty(digest)) {
+    // The retro digest can be empty (no learnings/deltas/notes, cleanly-approved plan) yet the epic
+    // still shipped real code — in which case conformance has something to verify even though the
+    // lessons agent has nothing to distil. So run whenever there is EITHER reflection material OR
+    // landed implementation to audit; only truly skip when there is neither. The landed-implementation
+    // probe is gathered lazily (only when the digest is empty) and via the lightweight
+    // hasDeliveredImplementationForPlan — which inspects only plan_tasks + PR status, with no
+    // blackboard scan — so we avoid discarded DB work on every terminal-PR event.
+    if (isDigestEmpty(digest) && !(await hasDeliveredImplementationForPlan(data, planKey))) {
       if (!(await claimRetroStart(data, planKey))) return { started: false, planKey, reason: "already-started" };
-      // Nothing to reflect on — stamp anyway so we don't re-check on every future terminal PR of a
-      // (now settled) plan, and record a skipped retro for visibility.
+      // Nothing to reflect on and nothing shipped to verify — stamp anyway so we don't re-check on
+      // every future terminal PR of a (now settled) plan, and record a skipped retro for visibility.
       await plansTbl(data).update(planKey, { retro_started_at: now(), updated_at: now() });
-      await recordRetro(data, planKey, { status: "skipped", summary: "No learnings, deltas, or notes to retrospect." });
+      await recordRetro(data, planKey, { status: "skipped", summary: "No learnings, deltas, notes, or landed implementation to retrospect." });
       return { started: false, planKey, reason: "nothing-to-retro" };
     }
 

package/app/service.test.ts

@@ -6,11 +6,11 @@
 // loop already guards in `startPlan`). Drives `submitPr` against an in-memory data layer with the
 // GitHub transport forced off so it is hermetic.
 import { test } from "node:test";
-import { assertEquals } from "#test-assert";
+import { assertEquals, assertRejects, assertStringIncludes } from "#test-assert";
 import { memDataFor } from "../test/worldDb.ts";
 import { DurableResumeRegistry } from "./durableResume.ts";
 import { WorldStore } from "./world/index.ts";
-import { parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
+import { abandonClosedPr, parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
 
 function memTable(rows: any[], key: string) {
   return {
@@ -755,7 +755,195 @@ test("pollWaveGatesImpl never releases the barrier on an unverifiable subscripti
   });
 });
 
-// ── pollCapabilityGatesImpl — the host half of the cross-repo capability edge (issue #289) ──────────
+// #352: a wave WEDGES forever at `wait-wave-merged` when one member PR is closed on GitHub WITHOUT
+// merging (abandoned / superseded / perpetually conflicting). The old gate released only when EVERY
+// wave-target PR reached `merged`, so a closed-unmerged member kept `allMerged = false` forever and
+// the epic could never advance. The fix classifies each target against live GitHub state and, for a
+// closed-unmerged one, (a) treats it as NON-blocking so the wave completes on its surviving merged
+// members and (b) reconciles it terminal — flipping BOTH the `pull_requests` row and its
+// `plan_tasks` row to `abandoned` so it drops out of `waveMergeTargets` and the epic read model.
+//
+// Forces token transport WITH a token and stubs `fetch` to answer both the single-PR GET (the closed
+// member reports state="closed", merged:false) and `/message-subscriptions/search` (barrier open).
+function closedMemberFetch(open: Set<string>, closedNumbers: Set<number>) {
+  return (url: string | URL | Request, init?: RequestInit): Promise<Response> => {
+    const u = typeof url === "string" ? url : url.toString();
+    const pullMatch = u.match(/\/repos\/[^/]+\/[^/]+\/pulls\/(\d+)$/);
+    if (pullMatch) {
+      const n = Number(pullMatch[1]);
+      const body = closedNumbers.has(n)
+        ? { merged: false, state: "closed", mergeable_state: "dirty" }
+        : { merged: true, state: "closed", mergeable_state: "clean" };
+      return Promise.resolve(
+        new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } }),
+      );
+    }
+    if (u.endsWith("/message-subscriptions/search")) {
+      const pik = (JSON.parse(String(init?.body ?? "{}")) as { filter?: { processInstanceKey?: string } })
+        .filter?.processInstanceKey ?? "";
+      const items = open.has(pik)
+        ? [{ messageName: "wave-merged", correlationKey: "owner/repo#67", messageSubscriptionState: "CREATED" }]
+        : [];
+      return Promise.resolve(
+        new Response(JSON.stringify({ items }), { status: 200, headers: { "content-type": "application/json" } }),
+      );
+    }
+    throw new Error(`unexpected fetch: ${u}`);
+  };
+}
+
+test("pollWaveGatesImpl releases the wave when a member PR is closed-unmerged and reconciles it terminal (#352)", async () => {
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevTok = process.env["GITHUB_TOKEN"];
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  process.env["GITHUB_TOKEN"] = "test-token"; // token present → fetchPrState hits the stubbed REST GET
+  try {
+    const PLAN_KEY = "owner/repo#67";
+    const PI = "PI-13794";
+    const plan = { plan_key: PLAN_KEY, process_key: PI, gate_wave: 2 as number | null, updated_at: "t0" };
+    const stores: Record<string, { rows: any[]; key: string }> = {
+      plans: { rows: [plan], key: "plan_key" },
+      plan_tasks: {
+        rows: [
+          // A surviving MERGED member (tracked row → no network) and a member whose PR was CLOSED
+          // on GitHub without merging while its task was still `opened` (never reached merge stage).
+          { id: "owner/repo#67:a", plan_key: PLAN_KEY, wave: 2, status: "opened", pr_key: "owner/repo#68" },
+          { id: "owner/repo#67:b", plan_key: PLAN_KEY, wave: 2, status: "opened", pr_key: "owner/repo#70" },
+        ],
+        key: "id",
+      },
+      pull_requests: {
+        rows: [
+          { pr_key: "owner/repo#68", status: "merged" },
+          { pr_key: "owner/repo#70", status: "converging" }, // not merged in the DB → falls to live GitHub read
+        ],
+        key: "pr_key",
+      },
+      merges: { rows: [], key: "id" },
+    };
+    const data = {
+      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    } as any;
+
+    const published: { name: string; correlationKey?: string }[] = [];
+    const engine = {
+      publishMessage: (input: { name: string; correlationKey?: string }) => {
+        published.push(input);
+        return Promise.resolve();
+      },
+    } as any;
+    const headers = { "content-type": "application/json" };
+    const prevFetch = globalThis.fetch;
+
+    globalThis.fetch = closedMemberFetch(new Set([PI]), new Set([70])) as typeof fetch;
+    try {
+      await pollWaveGatesImpl(data, engine, "test-token", "http://engine/v2", headers);
+    } finally {
+      globalThis.fetch = prevFetch;
+    }
+
+    // The barrier RELEASES — the closed-unmerged member no longer wedges the wave.
+    assertEquals(published.length, 1, "must publish wave-merged once the closed member is treated non-blocking");
+    assertEquals(published[0]?.name, "wave-merged");
+    assertEquals(published[0]?.correlationKey, PLAN_KEY);
+
+    // The closed member is reconciled terminal: PR row + its plan_tasks row flip to `abandoned`,
+    // and a terminal `merges` audit row is recorded (the canonical abandon writer).
+    const prRow = stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#70");
+    assertEquals(prRow?.status, "abandoned");
+    const taskRow = stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:b");
+    assertEquals(taskRow?.status, "abandoned");
+    assertEquals(stores.merges.rows.length, 1);
+    assertEquals((stores.merges.rows[0] as any).outcome, "abandoned");
+    assertEquals((stores.merges.rows[0] as any).method, "pr-closed");
+    // The surviving merged member is untouched.
+    assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:a")?.status, "opened");
+  } finally {
+    if (prevMode !== undefined) process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+    else delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    if (prevTok !== undefined) process.env["GITHUB_TOKEN"] = prevTok;
+    else delete process.env["GITHUB_TOKEN"];
+  }
+});
+
+// #352 review: `abandonClosedPr` must be genuinely idempotent. It is reached from BOTH observers of a
+// closed-unmerged member (merge worker + wave gate) and can be retried by the poller, so an
+// unconditional `merges` insert would spam the audit with duplicate `outcome:"abandoned"/method:
+// "pr-closed"` rows and skew reporting. Re-running it re-stamps the terminal status but writes the
+// audit row only once.
+test("abandonClosedPr is idempotent — the terminal merges audit row is written at most once (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [{ pr_key: "owner/repo#70", status: "converging" }], key: "pr_key" },
+    plan_tasks: { rows: [{ id: "owner/repo#67:b", plan_key: "owner/repo#67", wave: 2, status: "opened", pr_key: "owner/repo#70" }], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  await abandonClosedPr(data, "owner/repo#70", "closed without merging");
+  await abandonClosedPr(data, "owner/repo#70", "closed without merging"); // retry / second observer
+
+  // Terminal status re-stamped, but exactly one audit row despite two calls.
+  assertEquals(stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#70")?.status, "abandoned");
+  assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:b")?.status, "abandoned");
+  assertEquals(stores.merges.rows.length, 1, "no duplicate abandoned/pr-closed audit rows on retry");
+  assertEquals((stores.merges.rows[0] as any).method, "pr-closed");
+});
+
+// #352 review (suppressed advisory app/service.ts:863): `abandonClosedPr` writes the terminal
+// `merges` audit row — an FK child of `pull_requests.pr_key` — and must not assume the parent row
+// exists. The merge-worker caller pre-heals with `ensurePr`, but the wave-gate self-heal path
+// (`pollWaveGatesImpl`) does NOT, so in an engine/app.db desync the canonical writer could observe a
+// closed member whose `pull_requests` row is missing and hit a `FOREIGN KEY constraint failed`,
+// wedging the poller pass. The canonical writer must self-heal the parent (idempotent `ensurePr`)
+// before the FK-child insert, symmetrically for BOTH callers. Read-model witness: with a missing
+// parent row the old code's `prs.update` was a silent no-op, so the PR was never reconciled terminal.
+test("abandonClosedPr self-heals a missing pull_requests parent row before the FK-child audit insert (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [], key: "pr_key" }, // desync: parent row is MISSING
+    plan_tasks: { rows: [{ id: "owner/repo#67:c", plan_key: "owner/repo#67", wave: 3, status: "opened", pr_key: "owner/repo#71" }], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  await abandonClosedPr(data, "owner/repo#71", "closed without merging");
+
+  // The parent row is reconstructed AND flipped terminal, so the FK-child audit row has a parent.
+  const parent = stores.pull_requests.rows.find((r) => r.pr_key === "owner/repo#71");
+  assertEquals(parent?.status, "abandoned", "missing parent pull_requests row is self-healed and reconciled terminal");
+  assertEquals(parent?.repo, "owner/repo", "reconstructed parent carries the parsed repo");
+  assertEquals(parent?.number, 71, "reconstructed parent carries the parsed number");
+  assertEquals(stores.plan_tasks.rows.find((r) => r.id === "owner/repo#67:c")?.status, "abandoned");
+  assertEquals(stores.merges.rows.length, 1, "terminal audit row written once");
+});
+
+// #352 review (suppressed advisory app/service.ts:861): the self-heal only runs when `parsePr(prKey)`
+// succeeds, so a MALFORMED prKey (engine/app.db desync, a process-variable regression) would skip
+// the heal yet still reach `merges.insert` — which, with a missing parent, fails with an opaque
+// `FOREIGN KEY constraint failed`, the exact incident this helper exists to prevent. The canonical
+// writer must fail closed with a clear, actionable error naming the bad key, not leak an FK incident.
+test("abandonClosedPr rejects a malformed prKey with a clear error before any FK-child insert (#352)", async () => {
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [], key: "pr_key" },
+    plan_tasks: { rows: [], key: "id" },
+    merges: { rows: [], key: "id" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+  } as any;
+
+  const err = await assertRejects(() => abandonClosedPr(data, "not-a-valid-pr-key", "closed without merging"));
+  assertStringIncludes((err as Error).message, "malformed prKey");
+  assertStringIncludes((err as Error).message, "not-a-valid-pr-key");
+  // No audit row and no terminal side effects leaked before the guard fired.
+  assertEquals(stores.merges.rows.length, 0, "no FK-child audit insert attempted on a malformed prKey");
+  assertEquals(stores.pull_requests.rows.length, 0, "no parent row written on a malformed prKey");
+});
+
+
 //
 // plan-fanout parks a task with capability `needs` at the `wait-caps-resolved` message barrier. This
 // reconciler, on every pass, (a) starts the durable `readiness-gate` once per need, (b) does a single

package/app/service.ts

@@ -9,7 +9,7 @@
 // `Table<T>` surface), not hand-written SQL. Row shapes are declared inline here.
 import { readFileSync } from "node:fs";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
-import { abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
+import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
 import { agentSlaTimeout } from "./agentSla.ts";
 import {
   CAPS_RESOLVED_MESSAGE,
@@ -21,6 +21,7 @@ import {
   renderResolvedDepsBrief,
   UnresolvableCapabilityRefError,
 } from "./capabilityNeed.ts";
+import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
 import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
@@ -844,6 +845,110 @@ async function isDepMerged(data: DataLayer, depKey: string, token: string): Prom
   }
 }
 
+/** Canonically retire a **closed-unmerged** PR's read model. Writes the terminal `merges` audit row
+ * and flips BOTH the `pull_requests` row and every `plan_tasks` row keyed to the PR to `abandoned`.
+ *
+ * This is the ONE canonical abandon implementation, reached from BOTH entry points that observe a
+ * wave/merge member closed on GitHub without merging (#352):
+ *   • the merge stage — `workers/merge` `attempt-merge` closed short-circuit (#342), and
+ *   • the wave-merge gate — `pollWaveGatesImpl`'s self-heal for a PR closed out-of-band while its
+ *     task was still `opened` (never reached the merge stage, so `pollMerges` never saw it).
+ *
+ * Flipping the **task** row (not only the PR row) is essential: `waveMergeTargets` keys on
+ * `plan_tasks.status`, so a still-`opened` task keeps a dead PR in the blocking set and wedges the
+ * wave barrier forever; an `abandoned` task drops out (the wave completes on its surviving merged
+ * members) and stops `isPlanComplete`/the Epics table counting a phantom open task. Idempotent for a
+ * poller retry (or the two observers — merge worker + wave gate — racing the same closed PR):
+ * re-running just re-stamps the same terminal status, and the terminal `merges` audit row is written
+ * only once: the fast-path guard skips the insert when an `abandoned`/`pr-closed` row already exists,
+ * and — because that check-then-insert is racy under the two observers (merge worker + wave gate)
+ * racing the same closed PR — a DB-level partial UNIQUE fence (`ux_merges_abandon_pr_closed`,
+ * migration 053) rejects a concurrent duplicate, which we swallow as the same idempotent outcome. So
+ * retries (sequential OR concurrent) can't spam the audit with duplicate rows and skew reporting.
+ *
+ * Self-heals the FK parent first: the `merges` audit row is an FK child of `pull_requests.pr_key`, so
+ * before writing it we ensure the parent row exists via the idempotent {@link ensurePr}. The merge
+ * worker already pre-heals, but the wave-gate self-heal path does not — and in an engine/app.db
+ * desync (the exact class `ensurePr` heals) it can observe a closed member whose `pull_requests` row
+ * is missing. Healing inside the ONE canonical writer covers BOTH callers symmetrically, so the
+ * FK-child insert can never hit `FOREIGN KEY constraint failed` and wedge the poller pass. */
+export async function abandonClosedPr(data: DataLayer, prKey: string, detail: string): Promise<void> {
+  const ts = now();
+  const parsed = parsePr(prKey);
+  // Self-heal the FK parent, but ONLY when `prKey` is well-formed. A malformed key can't be healed
+  // (there's no repo/number to `ensurePr`), and silently skipping the heal would let the downstream
+  // `merges.insert` fail with an opaque `FOREIGN KEY constraint failed` — the exact incident this
+  // helper exists to prevent. Fail closed with a clear, actionable error instead.
+  if (!parsed) {
+    throw new Error(`abandonClosedPr: malformed prKey ${JSON.stringify(prKey)} — cannot self-heal the pull_requests FK parent`);
+  }
+  await ensurePr(data, { prKey, repo: parsed.repo, number: parsed.number });
+  const merges = data.table("merges", "id");
+  const alreadyAudited =
+    (await merges.findOne({ pr_key: prKey, outcome: "abandoned", method: "pr-closed" })) !== null;
+  if (!alreadyAudited) {
+    try {
+      await merges.insert({
+        pr_key: prKey,
+        outcome: "abandoned",
+        method: "pr-closed",
+        detail,
+        at: ts,
+      });
+    } catch (err) {
+      // The `find`-then-`insert` guard above is racy: the merge worker and the wave-gate self-heal
+      // path can both observe "no row" and both insert. The partial UNIQUE fence
+      // (`ux_merges_abandon_pr_closed`, migration 053) rejects the loser — tolerate that collision as
+      // the SAME idempotent outcome the guard intends, and only that. Any other error rethrows.
+      if (!isUniqueConstraintFence(err)) throw err;
+    }
+  }
+  await prs(data).update(prKey, { status: ABANDONED_STATUS, updated_at: ts });
+  const tasks = planTasks(data);
+  for (const t of await tasks.find({ pr_key: prKey })) {
+    await tasks.update(t.id, { status: ABANDONED_STATUS, updated_at: ts });
+  }
+}
+
+/** Classify a wave-merge target PR against GitHub ground truth for the wave gate (#352):
+ *   • `cleared` — merged (tracked `merged` row, an out-of-band `merged` live state, or an
+ *     already-`abandoned` tracked row / non-PR ref that can never block) → non-blocking.
+ *   • `closed`  — live GitHub state is closed WITHOUT merging → non-blocking, and the caller must
+ *     reconcile it terminal via {@link abandonClosedPr} so it leaves the target set.
+ *   • `pending` — still open, or read successfully but in an ambiguous (`unknown`) live state → still
+ *     blocks the wave. A *thrown* transport error (network/5xx) is NOT swallowed here: it rethrows so
+ *     the poller pass logs and retries — behaviourally identical for the barrier (it stays armed and
+ *     re-checks next pass), and canonical with {@link isDepMerged}, which rethrows transient failures
+ *     the same way. Only a `not-a-pull-request` error is caught (→ `cleared`).
+ *
+ * Mirrors {@link isDepMerged} (tracked-row fast path, then a live read, `not-a-pull-request` treated
+ * as cleared, transient errors rethrown) but adds the closed-unmerged branch the wave barrier lacked
+ * — the direct analogue of the merge stage's `classifyPrLiveness === "closed"` abandon. Conservative:
+ * an unreadable PR never resolves to a terminal `cleared`/`closed`, so a false negative only costs a
+ * retry while a false positive that would drop a live member is impossible. */
+async function classifyWaveTarget(
+  data: DataLayer,
+  prKey: string,
+  token: string,
+): Promise<"cleared" | "closed" | "pending"> {
+  const tracked = await prs(data).get(prKey);
+  if (tracked && tracked.status === "merged") return "cleared";
+  if (tracked && tracked.status === ABANDONED_STATUS) return "cleared"; // already reconciled terminal → non-blocking, no re-reconcile needed
+  const parsed = parsePr(prKey);
+  if (!parsed) return "cleared"; // unparseable ref can't be checked → never wedge the barrier
+  let st: Awaited<ReturnType<typeof fetchPrState>>;
+  try {
+    st = await fetchPrState(parsed.repo, parsed.number, token);
+  } catch (err) {
+    if (isNotAPullRequestError(err)) return "cleared"; // an issue/missing number can never merge
+    throw err;
+  }
+  const liveness = classifyPrLiveness(st);
+  if (liveness === "merged") return "cleared";
+  if (liveness === "closed") return "closed";
+  return "pending"; // read OK but open or ambiguous (`unknown`) live state → stay conservative and keep blocking
+}
+
 /** Flip a PR into the transient `merging` status and publish the correlating message, reverting
  * to `prevStatus` if the publish fails. `merging` is deliberately a status no poll branch scans
  * (so a slow pass can't double-signal), which means a publish failure *after* the flip would
@@ -1409,7 +1514,23 @@ export async function pollWaveGatesImpl(
       let allMerged = true;
       const tasks = await planTasks(data).find({ plan_key: planKey });
       for (const prKey of waveMergeTargets(tasks, gateWave)) {
-        if (!(await isDepMerged(data, prKey, token))) {
+        const state = await classifyWaveTarget(data, prKey, token);
+        if (state === "closed") {
+          // Self-heal (#352): a wave-target PR closed on GitHub WITHOUT merging (abandoned /
+          // superseded / perpetually conflicting) can never reach `merged`, so it must NOT keep the
+          // barrier armed forever. Retire it through the canonical abandon writer — flipping the
+          // `plan_tasks` row terminal so it drops out of `waveMergeTargets` and the epic read model —
+          // and treat it as non-blocking: the wave completes on its surviving merged members. This is
+          // the wave-gate reach of the SAME abandon path the merge stage uses for a closed member.
+          await abandonClosedPr(
+            data,
+            prKey,
+            "wave-target PR was closed on GitHub without merging — reconciling terminal so the wave gate can advance",
+          );
+          console.log(`[poller] wave-target closed without merging -> ${prKey}`);
+          continue;
+        }
+        if (state === "pending") {
           allMerged = false;
           break;
         }

package/app/waves.test.ts

@@ -127,3 +127,15 @@ test("waveMergeTargets → a wave with no opened PRs clears vacuously (empty)",
   ];
   assertEquals(waveMergeTargets(tasks, 0), []);
 });
+
+// #352: a wave member whose PR was closed-unmerged is reconciled to the terminal `abandoned`
+// status. Such a task must NOT stay in the blocking set — a dead PR can never reach `merged`, so
+// leaving it in would wedge the wave-merge barrier forever. The surviving merged member is the only
+// target the gate waits on.
+test("waveMergeTargets → an abandoned (closed-unmerged) wave member drops out of the blocking set", () => {
+  const tasks: WaveGateTask[] = [
+    { wave: 0, status: "opened", pr_key: "o/r#1" },
+    { wave: 0, status: "abandoned", pr_key: "o/r#2" }, // PR closed without merging → reconciled terminal
+  ];
+  assertEquals(waveMergeTargets(tasks, 0), ["o/r#1"]);
+});

package/app/world/store.ts

@@ -10,6 +10,7 @@
 // duplicated (AGENTS.md "derivation over duplication": the tree is derived from `remote SHA +
 // effect-tail`, never snapshot into a log).
 import type { DataLayer, Table } from "@nanobpm/urban";
+import { isUniqueConstraintFence } from "../dbFence.ts";
 import type { Effect, EffectKind, Fence } from "./effect-ledger.ts";
 
 /** A persisted push-checkpoint row (`world_checkpoints`). */
@@ -104,13 +105,12 @@ export class WorldStore {
    * concurrent/duplicate writer inserted the row BETWEEN our `findOne` and our `insert`. Every insert
    * in this store guards a UNIQUE constraint (`UNIQUE(pr_key, commit_sha)` / `(pr_key, checkpoint_offset)`
    * on checkpoints, `UNIQUE(pr_key, idempotency_key)` on effects), so a check-then-insert is inherently
-   * racy under the at-least-once persist-round delivery + a distributed fleet. This is the ONE place the
-   * store classifies a fence collision, so the three insert sites below turn it into the SAME intended
-   * idempotent outcome instead of each re-encoding the driver's error shape (a drift surface). Matched on
-   * the message substring the RAD `Table` surface propagates verbatim — the same one the schema tests
-   * assert on — because that surface hides the concrete driver error type. */
+   * racy under the at-least-once persist-round delivery + a distributed fleet. Delegates to the ONE
+   * canonical classifier ({@link isUniqueConstraintFence}) so this store, `abandonClosedPr`, and any
+   * future fence site share a single implementation instead of each re-encoding the driver's error
+   * shape (AGENTS.md: "no drift surfaces"). */
   static #isFenceCollision(err: unknown): boolean {
-    return err instanceof Error && /UNIQUE constraint failed/i.test(err.message);
+    return isUniqueConstraintFence(err);
   }
 
   /** Reconcile an existing ledger row's `applied` flag toward a LATER record's knowledge: flip a

package/db/migrations/004_planning.sql

@@ -26,7 +26,7 @@ CREATE TABLE plan_tasks (
   task_id     TEXT NOT NULL,               -- planner-supplied slug (or "t<index>")
   title       TEXT,
   prompt      TEXT,
-  status      TEXT NOT NULL,               -- pending | opened | blocked | skipped
+  status      TEXT NOT NULL,               -- pending | opened | blocked | skipped | escalated | waiting-for-lane | abandoned
   pr_key      TEXT,                         -- the PR this slice produced ("<owner>/<repo>#<n>")
   summary     TEXT,
   created_at  TEXT NOT NULL,

package/db/migrations/052_plan_conformance.sql

@@ -0,0 +1,28 @@
+-- Spec-conformance review — the post-completion "did we build what the spec asked for?" stage.
+--
+-- It rides the same `retro` process that already fires exactly once when an epic's LAST PR reaches
+-- a terminal state (see 016_plan_retro.sql / app/retro.ts). Before the retro agent distils lessons,
+-- a `senior:conformance` agent EXAMINES THE ACTUAL IMPLEMENTATION — it reads the delivered PR diffs,
+-- the code, and the tests (not just what agents claimed) — and checks each item of the spec (the
+-- epic issue + every slice's `prompt`) against what was really shipped. It posts a conformance
+-- report as a comment on the epic issue and emits per-item acceptance verdicts plus the two classes
+-- of deviation: those RAISED during implementation (`scope-change` blackboard entries) and those it
+-- found itself that were NEVER raised. This table records that result.
+--
+-- Advisory, like the retro it accompanies: it gates no delivery control flow (the epic already
+-- merged). One row per epic, keyed on plan_key.
+CREATE TABLE plan_conformance (
+  plan_key             TEXT PRIMARY KEY REFERENCES plans(plan_key),
+  status               TEXT NOT NULL,               -- filed | skipped | blocked (the agent's result status)
+  comment_url          TEXT,                         -- the conformance report comment the agent posted on the epic issue, or NULL
+  slices_met           INTEGER NOT NULL DEFAULT 0,  -- items fully delivered as specified
+  slices_reduced       INTEGER NOT NULL DEFAULT 0,  -- items delivered in a reduced/partial form, incl. met-in-unit-only (unit-tested but not proven live-wired)
+  slices_not_verified  INTEGER NOT NULL DEFAULT 0,  -- items the agent could not confirm from the implementation (e.g. no live wiring / synthetic only)
+  deviations_raised    INTEGER NOT NULL DEFAULT 0,  -- scope deviations agents flagged during implementation (`scope-change` entries)
+  deviations_unraised  INTEGER NOT NULL DEFAULT 0,  -- scope deviations the agent found by examining the code that were NEVER flagged
+  has_deviations       INTEGER NOT NULL DEFAULT 0,  -- 1 when anything is reduced / not-verified / an unraised deviation exists (drives escalation in a later slice)
+  summary              TEXT,                         -- the agent's human-readable conformance summary
+  report               TEXT,                         -- the full conformance report / transcript (nullable)
+  created_at           TEXT NOT NULL,
+  updated_at           TEXT NOT NULL
+);

package/db/migrations/053_merges_abandon_dedupe.sql

@@ -0,0 +1,29 @@
+-- Enforce the abandon-audit invariant at the DB level (#352, PR #354 review — suppressed advisory on
+-- app/service.ts:867). `abandonClosedPr`'s "write the terminal `merges` audit row only once" guard was
+-- a NON-ATOMIC find-then-insert: the two observers that reconcile a closed-unmerged member — the merge
+-- worker's `attempt-merge` closed short-circuit and the wave-gate self-heal in `pollWaveGatesImpl` —
+-- can run concurrently, so both observe "no row" between the `find` and the `insert` and both write an
+-- `abandoned`/`pr-closed` row for the same `pr_key`. Sequential-idempotency tests pass, but the guard
+-- is only best-effort under a real concurrent race.
+--
+-- Make the invariant a DB constraint (the canonical durable-fence idiom — cf. the `UNIQUE` fences on
+-- `world_effects`/`world_checkpoints` in 049): AT MOST ONE (outcome='abandoned', method='pr-closed')
+-- `merges` row per `pr_key`. The writer keeps its fast-path `find` guard (so the common retry never
+-- throws) but now tolerates the UNIQUE fence as the SAME idempotent outcome (see `app/dbFence.ts`).
+--
+-- Expand phase (additive, forward-only): first collapse any duplicates a pre-fence race already wrote
+-- — keep the earliest row (`MIN(id)`) per `pr_key` — so the partial UNIQUE index can be created on an
+-- already-populated database, then add the index. Only `abandoned`/`pr-closed` rows are touched;
+-- `merged`/`queued`/`blocked` audit rows are untouched and may still repeat per `pr_key`.
+DELETE FROM merges
+WHERE outcome = 'abandoned'
+  AND method = 'pr-closed'
+  AND id NOT IN (
+    SELECT MIN(id) FROM merges
+    WHERE outcome = 'abandoned' AND method = 'pr-closed'
+    GROUP BY pr_key
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_merges_abandon_pr_closed
+  ON merges (pr_key)
+  WHERE outcome = 'abandoned' AND method = 'pr-closed';

package/nano.app.json

@@ -162,6 +162,10 @@
       "taskType": "pr.retro-record",
       "handler": "workers/retro-record/worker.ts"
     },
+    {
+      "taskType": "pr.conformance-record",
+      "handler": "workers/conformance-record/worker.ts"
+    },
     {
       "taskType": "pr.progress-check",
       "handler": "workers/progress-check/worker.ts"
@@ -183,7 +187,8 @@
     "senior:plan-review",
     "senior:feature",
     "senior:trial-merge",
-    "senior:retro"
+    "senior:retro",
+    "senior:conformance"
   ],
   "surfaces": {
     "taskInbox": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.104.0",
+  "version": "0.105.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",