@nanobpm/nano-workforce 0.163.3 → 0.164.0

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.164.0](https://github.com/nanobpm/nano-workforce/compare/v0.163.3...v0.164.0) (2026-08-31)
+
+### Features
+
+* **merge-loop:** bound wait-mergeable with a timeout + stall probe ([#636](https://github.com/nanobpm/nano-workforce/issues/636)) ([#640](https://github.com/nanobpm/nano-workforce/issues/640)) ([e12dd04](https://github.com/nanobpm/nano-workforce/commit/e12dd0426d0c7b3defe24d339502397b24b9302c))
+
 ## [0.163.3](https://github.com/nanobpm/nano-workforce/compare/v0.163.2...v0.163.3) (2026-08-31)
 
 ### Bug Fixes

package/app/contracts.ts

@@ -124,6 +124,14 @@ export const ENV_CONTRACTS = {
     semantics: "Maximum transient base/head-moved merge-race retries per PR before escalating.",
     default: "5",
   },
+  NANO_PR_MAX_MERGE_STALL_ROUNDS: {
+    category: "env",
+    name: "NANO_PR_MAX_MERGE_STALL_ROUNDS",
+    owner: "app/service.ts",
+    semantics:
+      "Maximum mergeable-wait-timeout stall-probe re-derivations (dead-poller backstop, #636) before escalating; 0 escalates on the first stall.",
+    default: "3",
+  },
   NANO_PR_REVIEW_WAIT_TIMEOUT: {
     category: "env",
     name: "NANO_PR_REVIEW_WAIT_TIMEOUT",
@@ -143,6 +151,13 @@ export const ENV_CONTRACTS = {
     semantics:
       "How long the merge loop waits for a queued PR to actually land before escalating (FEEL/ISO-8601 duration).",
   },
+  NANO_PR_MERGEABLE_WAIT_TIMEOUT: {
+    category: "env",
+    name: "NANO_PR_MERGEABLE_WAIT_TIMEOUT",
+    owner: "app/service.ts",
+    semantics:
+      "How long the merge loop waits for the poller's `merge-ready` before the stall-probe timer arm fires (dead-poller backstop, #636; FEEL/ISO-8601 duration).",
+  },
   NANO_PR_AUTO_MERGE: {
     category: "env",
     name: "NANO_PR_AUTO_MERGE",

package/app/mergeLoopBehaviour.test.ts

@@ -42,6 +42,7 @@ const MODEL = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
 
 const AGENT_SLA_MS = 30 * 60 * 1000; // matches the PT30M we start instances with
 const LANDED_WAIT_MS = 30 * 60 * 1000; // matches the PT30M landedWaitTimeout we start instances with
+const MERGEABLE_WAIT_MS = 30 * 60 * 1000; // matches the PT30M mergeableWaitTimeout we start instances with
 
 type Output = Record<string, unknown>;
 type Responder = Output | Output[] | ((job: { variables: Record<string, unknown> }) => Output);
@@ -49,6 +50,7 @@ type Responder = Output | Output[] | ((job: { variables: Record<string, unknown>
 const ALL_JOB_TYPES = [
   "pr.arm-merge",
   "pr.merge",
+  "pr.merge-stall-probe",
   "pr.mark-merged",
   "senior:fix-ci",
   "senior:rebase",
@@ -82,6 +84,9 @@ const DEFAULT_VARS: Record<string, unknown> = {
   mergeRetryRound: 0,
   agentSlaTimeout: "PT30M",
   landedWaitTimeout: "PT30M",
+  mergeableWaitTimeout: "PT30M",
+  mergeStallRounds: 0,
+  mergeStallMax: 3,
   abandonBrief: null,
   failingChecksList: null,
   status: null,
@@ -238,6 +243,112 @@ test("answering the landing-timeout escalation re-arms the merge poller (#556)",
   assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
 });
 
+// ---------------------------------------------------------------------------
+// Mergeable-wait bounded-wait backstop (#636) — a stalled poller must never
+// wedge the instance at `waiting_merge` forever. The `gw-merge-wait` event-based
+// gateway races the poller's `merge-ready` message against a `mergeableWaitTimeout`
+// timer; on timeout `merge-stall-probe` re-derives mergeability and the existing
+// `gw-mergeable` routes to the correct arm — or, once `mergeStallMax` is exhausted,
+// to human escalation.
+// ---------------------------------------------------------------------------
+
+test("wait-mergeable races merge-ready against a timer (no bare catch) (#636)", async () => {
+  // After the poller arms the merge, the token forks the event-based gateway: it parks at BOTH the
+  // `merge-ready` catch and the timeout timer. Before the fix, `wait-mergeable` was a bare catch —
+  // no timer sibling — so a dead poller wedged it forever.
+  const engine = await boot();
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElements("wait-mergeable", "wait-mergeable-timeout");
+});
+
+test("a dead poller's PR is probed on timeout and advances to merge — never wedges (#636)", async () => {
+  // No `merge-ready` is EVER published (the poller is dead). RED (before the fix): the instance sits
+  // at `wait-mergeable` forever. GREEN: the timer fires, `merge-stall-probe` re-derives `ready`, and
+  // the existing `ready` arm merges the PR.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "ready", failingChecks: 0, failingChecksList: "" },
+      "pr.merge": { mergeStatus: "merged" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .hasCompleted()
+    .hasNoIncident()
+    .hasCompletedElements("merge-stall-probe", "attempt-merge", "mark-merged");
+});
+
+test("a CONFLICTING PR whose poller never signalled reaches the rebase arm via the timeout path (#636)", async () => {
+  // The incident that motivated #636: a `CONFLICTING`/`DIRTY` PR (base advanced under it) parked at
+  // `waiting_merge` because the poller never signalled — the auto-rebase arm was never reached. The
+  // timer path re-derives `conflict` and routes it to the bounded rebase agent.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("merge-stall-probe", "rebase") // reached the rebase arm via the timeout path
+    .hasVariable("rebaseRound", 1);
+});
+
+test("a blocked PR probed on timeout reaches the CI-fix arm via the timeout path (#636)", async () => {
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "blocked", failingChecks: 1, failingChecksList: "build" },
+      "senior:fix-ci": { status: "fixed" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("merge-stall-probe", "fix-ci")
+    .hasVariable("ciFixRound", 1);
+});
+
+test("the probe advances mergeStallRounds and re-arms within budget (#636)", async () => {
+  // A re-derived `conflict` re-arms after the rebase; the stall counter advanced so a still-dead
+  // poller cannot loop the probe forever — it is bounded by mergeStallMax.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).hasVariable("mergeStallRounds", 1);
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "a within-budget stall must NOT escalate");
+});
+
+test("the stall-round cap escalates to a human instead of looping forever (#636)", async () => {
+  // `mergeStallMax: 0` — escalate on the first stall. The probe runs once, `gw-merge-stall` finds the
+  // budget exhausted, and routes to `merge-esc-conflict` → the native `wait-merge-answer` user task
+  // rather than re-arming into another timeout round.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-stall-probe", "merge-esc-conflict");
+  assert(!completedElementIds(engine).has("mark-merged"), "an exhausted stall must not mark-merged");
+});
+
 test("an evicted queued merge re-arms the poller rather than completing", async () => {
   const engine = await boot({ responses: { "pr.merge": { mergeStatus: "queued" } } });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });

package/app/mergeableWait.test.ts

@@ -0,0 +1,39 @@
+// Unit coverage for the mergeable-wait liveness timeout policy. The value is baked into every
+// merge-loop instance's `mergeableWaitTimeout` process variable and evaluated by the
+// `wait-mergeable-timeout` timer catch (the timer arm of the `gw-merge-wait` event-based gateway),
+// so a malformed operator env must never deploy an uninterpretable `<bpmn:timeDuration>` — it falls
+// back to the default instead. Run with `node --test`.
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { DEFAULT_MERGEABLE_WAIT_TIMEOUT, mergeableWaitTimeout } from "./mergeableWait.ts";
+
+test("mergeableWaitTimeout: blank / absent / malformed → default", () => {
+  assert.equal(mergeableWaitTimeout(undefined), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
+  assert.equal(mergeableWaitTimeout(""), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
+  assert.equal(mergeableWaitTimeout("   "), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
+  assert.equal(mergeableWaitTimeout("30m"), DEFAULT_MERGEABLE_WAIT_TIMEOUT); // missing leading P/T
+  assert.equal(mergeableWaitTimeout("P"), DEFAULT_MERGEABLE_WAIT_TIMEOUT); // no component
+  assert.equal(mergeableWaitTimeout("PT"), DEFAULT_MERGEABLE_WAIT_TIMEOUT); // T with no time part
+  assert.equal(mergeableWaitTimeout("garbage"), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
+});
+
+test("mergeableWaitTimeout: a valid ISO-8601 duration is honoured and upper-cased", () => {
+  assert.equal(mergeableWaitTimeout("PT30M"), "PT30M");
+  assert.equal(mergeableWaitTimeout("pt2h"), "PT2H");
+  assert.equal(mergeableWaitTimeout("P1D"), "P1D");
+  assert.equal(mergeableWaitTimeout("  pt45m  "), "PT45M");
+});
+
+test("mergeableWaitTimeout: an explicit fallback is honoured for a bad value", () => {
+  assert.equal(mergeableWaitTimeout("nope", "PT10M"), "PT10M");
+  assert.equal(mergeableWaitTimeout("PT15M", "PT10M"), "PT15M");
+});
+
+test("the default is itself a well-formed ISO-8601 duration (never an uninterpretable timer)", () => {
+  // Validate the default against the grammar with a *distinct* fallback: if the default were
+  // malformed it would fall through to the sentinel, so equality to itself proves it parses.
+  const sentinel = "PT1S";
+  assert.notEqual(DEFAULT_MERGEABLE_WAIT_TIMEOUT, sentinel);
+  assert.equal(mergeableWaitTimeout(DEFAULT_MERGEABLE_WAIT_TIMEOUT, sentinel), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
+});

package/app/mergeableWait.ts

@@ -0,0 +1,38 @@
+// Mergeable-wait liveness policy — kept as a pure module (no env, no I/O) so it is trivially
+// testable, mirroring app/mergeLandedWait.ts. `app/service.ts` seeds the validated
+// `mergeableWaitTimeout` process variable when it starts the merge-loop; the merge-loop's
+// `wait-mergeable-timeout` timer catch (the timer arm of the `gw-merge-wait` event-based gateway,
+// racing the poller's `merge-ready` message) evaluates its `<bpmn:timeDuration>=mergeableWaitTimeout`
+// at timer creation (FEEL-expression timer durations, engine-native).
+//
+// This closes the mergeable-wait liveness gap (issue #636): `wait-mergeable` was the only long-lived
+// wait in the merge loop with NO bounded-wait timer — a bare `intermediateCatchEvent` woken *solely*
+// by the in-process poller's `merge-ready` message. If that poller stalls (dies across a redeploy,
+// errors on a PR, or skips a verdict) the instance parks at `waiting_merge` forever, with no timeout
+// and no escalation — the entire conflict/CI remediation machinery (`gw-mergeable` → rebase / CI-fix
+// / escalate) sits downstream of `wait-mergeable`, so it is never entered. Bounding the wait with a
+// timer arm makes that impossible: when the timeout elapses the token routes to `merge-stall-probe`,
+// which re-derives ground-truth mergeability from GitHub and feeds the existing `gw-mergeable` arms
+// (or, after the stall-round cap is exhausted, escalates to a human). It is a durable, in-process
+// backstop — no external watchdog required — mirroring the convergence loop's `wait-review-timeout`
+// and the merge loop's own `wait-landed-timeout`.
+
+import { isoDuration } from "./reviewWait.ts";
+
+/** Default mergeable-wait timeout (ISO-8601 duration): how long the merge loop waits for the poller
+ * to publish `merge-ready` before the timer arm of the `gw-merge-wait` event-based gateway fires and
+ * `merge-stall-probe` re-derives mergeability from ground truth. Deliberately short — a healthy
+ * poller signals within one poll interval, so a 30-minute silence means the poller is dead and the
+ * PR must be reconciled — while still generous enough not to fire against a merely-slow poll pass. */
+export const DEFAULT_MERGEABLE_WAIT_TIMEOUT = "PT30M";
+
+/** Validate the operator-supplied mergeable-wait timeout (env `NANO_PR_MERGEABLE_WAIT_TIMEOUT`,
+ * ISO-8601 duration), falling back to {@link DEFAULT_MERGEABLE_WAIT_TIMEOUT} when absent, blank, or
+ * malformed — a bad env value must never deploy an uninterpretable timer expression. Derives its
+ * validation from the single canonical {@link isoDuration}. */
+export function mergeableWaitTimeout(
+  raw: string | undefined,
+  def: string = DEFAULT_MERGEABLE_WAIT_TIMEOUT,
+): string {
+  return isoDuration(raw, def);
+}

package/app/service.ts

@@ -53,6 +53,7 @@ import {
 } from "./github.ts";
 import { activeStatusesFor, derivedTrackingTable } from "./instanceTracking.ts";
 import { pollLineage } from "./lineage.ts";
+import { mergeableWaitTimeout } from "./mergeableWait.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { mergeLandedWaitTimeout } from "./mergeLandedWait.ts";
 import {
@@ -143,6 +144,15 @@ export const MAX_REBASE_ROUNDS = clampCiFixBudget(process.env.NANO_PR_MAX_REBASE
  * retry (a race escalates immediately). Reuses the CI-fix budget clamp (allows 0 = disable). */
 export const MAX_MERGE_RETRIES = clampCiFixBudget(process.env.NANO_PR_MAX_MERGE_RETRIES, 5);
 
+/** How many times the mergeable-wait timeout backstop (`merge-stall-probe`) will re-derive
+ * mergeability from ground truth and re-arm the merge stage before giving up and escalating to a
+ * human. Bounds the timer arm of the `gw-merge-wait` event-based gateway so a dead in-process poller
+ * (the #636 wedge) can never loop the probe forever: once the cap is exhausted, `gw-merge-stall`
+ * routes to `merge-esc-conflict` (human escalation) instead of re-arming. Default 3; set
+ * `NANO_PR_MAX_MERGE_STALL_ROUNDS=0` to escalate on the first stall. Reuses the CI-fix budget clamp
+ * (allows 0 = escalate immediately, ceiling-capped). */
+export const MAX_MERGE_STALL_ROUNDS = clampCiFixBudget(process.env.NANO_PR_MAX_MERGE_STALL_ROUNDS, 3);
+
 /** How long a merge-loop AGENT service task (rebase / fix-ci) may sit without completing before its
  * interrupting timer boundary fires and the PR escalates for human attention. Seeded as the
  * `agentSlaTimeout` process variable at merge start and evaluated by those tasks' boundary timers.
@@ -170,6 +180,19 @@ export const MERGE_LANDED_WAIT_TIMEOUT = mergeLandedWaitTimeout(
   process.env.NANO_PR_MERGE_LANDED_WAIT_TIMEOUT,
 );
 
+/** How long the merge loop waits for the in-process poller to publish `merge-ready` before the timer
+ * arm of the `gw-merge-wait` event-based gateway fires and `merge-stall-probe` re-derives
+ * mergeability from ground truth. Seeded as the `mergeableWaitTimeout` process variable at merge
+ * start and evaluated by the merge-loop's `wait-mergeable-timeout` timer catch. `wait-mergeable` was
+ * the only long-lived wait in the merge loop with NO bounded-wait timer, so a stalled poller (dead
+ * across a redeploy, errored on a PR, or a skipped verdict) parked the instance at `waiting_merge`
+ * forever with no timeout and no escalation (issue #636). ISO-8601 duration; a malformed
+ * `NANO_PR_MERGEABLE_WAIT_TIMEOUT` falls back to the default so an uninterpretable timer is never
+ * deployed. */
+export const MERGEABLE_WAIT_TIMEOUT = mergeableWaitTimeout(
+  process.env.NANO_PR_MERGEABLE_WAIT_TIMEOUT,
+);
+
 /** Cooldown (ms) between the poller's automatic Copilot re-request nudges for a single waiting PR.
  * Copilot dismisses re-requests, so the poller retries — but not on every tick; this throttles it
  * to one attempt per window. Set via `NANO_PR_REVIEW_NUDGE_MINUTES` (minutes). */
@@ -723,6 +746,9 @@ export async function startMerge(
       mergeRetryMax: MAX_MERGE_RETRIES,
       agentSlaTimeout: AGENT_SLA_TIMEOUT,
       landedWaitTimeout: MERGE_LANDED_WAIT_TIMEOUT,
+      mergeableWaitTimeout: MERGEABLE_WAIT_TIMEOUT,
+      mergeStallRounds: 0,
+      mergeStallMax: MAX_MERGE_STALL_ROUNDS,
       // Lineage (issue #245): thread the origin identity onto the merge instance (see startMerge).
       rootRequestKey,
       abandonUrl: abUrl,

package/nano.app.json

@@ -144,6 +144,10 @@
       "taskType": "pr.mark-merged",
       "handler": "workers/mark-merged/worker.ts"
     },
+    {
+      "taskType": "pr.merge-stall-probe",
+      "handler": "workers/merge-stall-probe/worker.ts"
+    },
     {
       "taskType": "pr.record-dependency",
       "handler": "workers/record-dependency/worker.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.163.3",
+  "version": "0.164.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/merge-loop.bpmn

@@ -44,6 +44,16 @@
         <nano:shape id="MarkMergedIn" name="Mark merged — input">
           <nano:extend name="prKey" type="string" />
         </nano:shape>
+        <nano:shape id="MergeStallProbeIn" name="Merge stall probe — input">
+          <nano:extend name="prKey" type="string" />
+          <nano:extend name="repo" type="string" />
+          <nano:extend name="prNumber" type="integer" />
+        </nano:shape>
+        <nano:shape id="MergeStallProbeOut" name="Merge stall probe — result">
+          <nano:extend name="mergeState" type="string" />
+          <nano:extend name="failingChecks" type="integer" optional="true" />
+          <nano:extend name="failingChecksList" type="string" optional="true" />
+        </nano:shape>
         <nano:shape id="MergeReady" name="merge-ready message payload">
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
@@ -111,14 +121,50 @@
       <bpmn:incoming>f_mr_go</bpmn:incoming>
       <bpmn:outgoing>f_m_arm</bpmn:outgoing>
     </bpmn:serviceTask>
-    <bpmn:intermediateCatchEvent id="wait-mergeable" name="Wait: mergeable">
+    <bpmn:exclusiveGateway id="gw-merge-entry" name="enter merge wait">
       <bpmn:incoming>f_m_arm</bpmn:incoming>
       <bpmn:incoming>f_ci_recheck</bpmn:incoming>
+      <bpmn:outgoing>f_me_wait</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
+    <bpmn:eventBasedGateway id="gw-merge-wait" name="mergeable or timeout?">
+      <bpmn:incoming>f_me_wait</bpmn:incoming>
+      <bpmn:outgoing>f_mw_ready</bpmn:outgoing>
+      <bpmn:outgoing>f_mw_timeout</bpmn:outgoing>
+    </bpmn:eventBasedGateway>
+    <bpmn:intermediateCatchEvent id="wait-mergeable" name="Wait: mergeable">
+      <bpmn:incoming>f_mw_ready</bpmn:incoming>
       <bpmn:outgoing>f_m_ready</bpmn:outgoing>
       <bpmn:messageEventDefinition id="med_mergeReady" messageRef="Message_mergeReady" />
     </bpmn:intermediateCatchEvent>
+    <bpmn:intermediateCatchEvent id="wait-mergeable-timeout" name="Wait: mergeable timeout">
+      <bpmn:incoming>f_mw_timeout</bpmn:incoming>
+      <bpmn:outgoing>f_mw_stall</bpmn:outgoing>
+      <bpmn:timerEventDefinition id="ted_mergeableTimeout">
+        <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=mergeableWaitTimeout</bpmn:timeDuration>
+      </bpmn:timerEventDefinition>
+    </bpmn:intermediateCatchEvent>
+    <bpmn:serviceTask id="merge-stall-probe" name="Probe mergeability (poller stalled)">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.merge-stall-probe" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="MergeStallProbeIn" />
+          <zeebe:property name="io.nanobpm.dataEnvelope.out" value="MergeStallProbeOut" />
+        </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:output source="=mergeStallRounds + 1" target="mergeStallRounds" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_mw_stall</bpmn:incoming>
+      <bpmn:outgoing>f_msp_gate</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:exclusiveGateway id="gw-merge-stall" name="stall rounds within budget?" default="f_msp_giveup">
+      <bpmn:incoming>f_msp_gate</bpmn:incoming>
+      <bpmn:outgoing>f_msp_rederive</bpmn:outgoing>
+      <bpmn:outgoing>f_msp_giveup</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
     <bpmn:exclusiveGateway id="gw-mergeable" name="mergeable?" default="f_m_mBlocked">
       <bpmn:incoming>f_m_ready</bpmn:incoming>
+      <bpmn:incoming>f_msp_rederive</bpmn:incoming>
       <bpmn:outgoing>f_m_mReady</bpmn:outgoing>
       <bpmn:outgoing>f_m_mCiFix</bpmn:outgoing>
       <bpmn:outgoing>f_m_mRebase</bpmn:outgoing>
@@ -208,6 +254,7 @@
       <bpmn:incoming>f_ci_giveup</bpmn:incoming>
       <bpmn:incoming>f_reb_giveup</bpmn:incoming>
       <bpmn:incoming>f_reb_escConflict</bpmn:incoming>
+      <bpmn:incoming>f_msp_giveup</bpmn:incoming>
       <bpmn:outgoing>f_m_escC</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:serviceTask id="merge-esc-attempt" name="Escalate: merge blocked">
@@ -424,7 +471,7 @@
       <bpmn:outgoing>f_ci_escAttempt</bpmn:outgoing>
       <bpmn:outgoing>f_ci_rearm</bpmn:outgoing>
     </bpmn:exclusiveGateway>
-    <bpmn:sequenceFlow id="f_ci_recheck" name="reconciled — re-check" sourceRef="gw-ci-outcome" targetRef="wait-mergeable">
+    <bpmn:sequenceFlow id="f_ci_recheck" name="reconciled — re-check" sourceRef="gw-ci-outcome" targetRef="gw-merge-entry">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=ciOutcome = "recheck"</bpmn:conditionExpression>
     </bpmn:sequenceFlow>
     <bpmn:sequenceFlow id="f_ci_waitDep" name="waits on another PR" sourceRef="gw-ci-outcome" targetRef="record-merge-dep">
@@ -560,7 +607,16 @@
     </bpmn:serviceTask>
     <bpmn:sequenceFlow id="f_m_start" sourceRef="MergeStart" targetRef="wait-deps" />
     <bpmn:sequenceFlow id="f_m_deps" sourceRef="wait-deps" targetRef="arm-merge" />
-    <bpmn:sequenceFlow id="f_m_arm" sourceRef="arm-merge" targetRef="wait-mergeable" />
+    <bpmn:sequenceFlow id="f_m_arm" sourceRef="arm-merge" targetRef="gw-merge-entry" />
+    <bpmn:sequenceFlow id="f_me_wait" sourceRef="gw-merge-entry" targetRef="gw-merge-wait" />
+    <bpmn:sequenceFlow id="f_mw_ready" sourceRef="gw-merge-wait" targetRef="wait-mergeable" />
+    <bpmn:sequenceFlow id="f_mw_timeout" sourceRef="gw-merge-wait" targetRef="wait-mergeable-timeout" />
+    <bpmn:sequenceFlow id="f_mw_stall" sourceRef="wait-mergeable-timeout" targetRef="merge-stall-probe" />
+    <bpmn:sequenceFlow id="f_msp_gate" sourceRef="merge-stall-probe" targetRef="gw-merge-stall" />
+    <bpmn:sequenceFlow id="f_msp_rederive" name="re-derived — route to arm" sourceRef="gw-merge-stall" targetRef="gw-mergeable">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=mergeStallRounds &lt;= mergeStallMax</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_msp_giveup" name="stall budget exhausted" sourceRef="gw-merge-stall" targetRef="merge-esc-conflict" />
     <bpmn:sequenceFlow id="f_m_ready" sourceRef="wait-mergeable" targetRef="gw-mergeable" />
     <bpmn:sequenceFlow id="f_m_mReady" name="ready" sourceRef="gw-mergeable" targetRef="attempt-merge">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=mergeState = "ready"</bpmn:conditionExpression>
@@ -635,125 +691,152 @@
       <bpmndi:BPMNShape id="BPMNShape_arm-merge" bpmnElement="arm-merge">
         <dc:Bounds x="352" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-merge-entry" bpmnElement="gw-merge-entry" isMarkerVisible="true">
+        <dc:Bounds x="552" y="255" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="537" y="222" width="81" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-merge-wait" bpmnElement="gw-merge-wait" isMarkerVisible="true">
+        <dc:Bounds x="702" y="255" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="683" y="222" width="88" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-mergeable" bpmnElement="wait-mergeable">
-        <dc:Bounds x="552" y="262" width="36" height="36" />
+        <dc:Bounds x="852" y="262" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="535" y="229" width="70" height="28" />
+          <dc:Bounds x="835" y="303" width="70" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_wait-mergeable-timeout" bpmnElement="wait-mergeable-timeout">
+        <dc:Bounds x="852" y="422" width="36" height="36" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="835" y="463" width="70" height="42" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_merge-stall-probe" bpmnElement="merge-stall-probe">
+        <dc:Bounds x="988" y="400" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-merge-stall" bpmnElement="gw-merge-stall" isMarkerVisible="true">
+        <dc:Bounds x="1188" y="415" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1191" y="470" width="85" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-mergeable" bpmnElement="gw-mergeable" isMarkerVisible="true">
-        <dc:Bounds x="688" y="255" width="50" height="50" />
+        <dc:Bounds x="1338" y="255" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="675" y="236" width="77" height="14" />
+          <dc:Bounds x="1325" y="236" width="77" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_attempt-merge" bpmnElement="attempt-merge">
-        <dc:Bounds x="838" y="240" width="100" height="80" />
+        <dc:Bounds x="1488" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge" bpmnElement="gw-merge" isMarkerVisible="true">
-        <dc:Bounds x="1063" y="255" width="50" height="50" />
+        <dc:Bounds x="1713" y="255" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1062" y="222" width="53" height="28" />
+          <dc:Bounds x="1712" y="350" width="53" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-retry" bpmnElement="gw-merge-retry" isMarkerVisible="true">
-        <dc:Bounds x="1238" y="735" width="50" height="50" />
+        <dc:Bounds x="1888" y="735" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1259" y="810" width="88" height="28" />
+          <dc:Bounds x="1869" y="830" width="88" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_eg-landed" bpmnElement="eg-landed" isMarkerVisible="true">
-        <dc:Bounds x="1238" y="415" width="50" height="50" />
+        <dc:Bounds x="1888" y="415" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1231" y="490" width="64" height="28" />
+          <dc:Bounds x="1881" y="490" width="64" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-landed" bpmnElement="wait-landed">
-        <dc:Bounds x="1420" y="422" width="36" height="36" />
+        <dc:Bounds x="2070" y="422" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1416" y="483" width="85" height="28" />
+          <dc:Bounds x="2066" y="483" width="85" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-evicted" bpmnElement="wait-evicted">
-        <dc:Bounds x="1420" y="582" width="36" height="36" />
+        <dc:Bounds x="2070" y="582" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1461" y="579" width="88" height="42" />
+          <dc:Bounds x="2111" y="579" width="88" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-landed-timeout" bpmnElement="wait-landed-timeout">
-        <dc:Bounds x="1420" y="102" width="36" height="36" />
+        <dc:Bounds x="2070" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1331" y="92" width="84" height="56" />
+          <dc:Bounds x="1981" y="92" width="84" height="56" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_mark-merged" bpmnElement="mark-merged">
-        <dc:Bounds x="1588" y="240" width="100" height="80" />
+        <dc:Bounds x="2238" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeEnd" bpmnElement="MergeEnd">
-        <dc:Bounds x="1795" y="262" width="36" height="36" />
+        <dc:Bounds x="2445" y="262" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1788" y="303" width="50" height="14" />
+          <dc:Bounds x="2438" y="303" width="50" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeAbandoned" bpmnElement="MergeAbandoned">
-        <dc:Bounds x="1245" y="902" width="36" height="36" />
+        <dc:Bounds x="1895" y="902" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1222" y="943" width="82" height="28" />
+          <dc:Bounds x="1872" y="943" width="82" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-conflict" bpmnElement="merge-esc-conflict">
-        <dc:Bounds x="1388" y="1040" width="100" height="80" />
+        <dc:Bounds x="2038" y="1040" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-attempt" bpmnElement="merge-esc-attempt">
-        <dc:Bounds x="1388" y="720" width="100" height="80" />
+        <dc:Bounds x="2038" y="720" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-escalated" bpmnElement="gw-merge-escalated" isMarkerVisible="true">
-        <dc:Bounds x="1788" y="95" width="50" height="50" />
+        <dc:Bounds x="2438" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1756" y="150" width="74" height="28" />
+          <dc:Bounds x="2406" y="150" width="74" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-landed" bpmnElement="merge-esc-landed">
-        <dc:Bounds x="1588" y="80" width="100" height="80" />
+        <dc:Bounds x="2238" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-merge-answer" bpmnElement="wait-merge-answer">
-        <dc:Bounds x="1938" y="80" width="100" height="80" />
+        <dc:Bounds x="2588" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-merge-answer" bpmnElement="record-merge-answer">
-        <dc:Bounds x="2138" y="80" width="100" height="80" />
+        <dc:Bounds x="2788" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-ci-fix" bpmnElement="gw-ci-fix" isMarkerVisible="true">
-        <dc:Bounds x="863" y="1055" width="50" height="50" />
+        <dc:Bounds x="1513" y="1055" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="904" y="1110" width="89" height="14" />
+          <dc:Bounds x="1494" y="1036" width="89" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_SP_cifix" bpmnElement="SP_cifix">
-        <dc:Bounds x="1038" y="1200" width="100" height="80" />
+        <dc:Bounds x="1688" y="1200" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-ci-outcome" bpmnElement="gw-ci-outcome" isMarkerVisible="true">
-        <dc:Bounds x="1238" y="1215" width="50" height="50" />
+        <dc:Bounds x="1888" y="1215" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1232" y="1310" width="63" height="28" />
+          <dc:Bounds x="1882" y="1310" width="63" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-rebase" bpmnElement="gw-rebase" isMarkerVisible="true">
-        <dc:Bounds x="863" y="415" width="50" height="50" />
+        <dc:Bounds x="1513" y="415" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="844" y="370" width="88" height="14" />
+          <dc:Bounds x="1494" y="470" width="88" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_SP_rebase" bpmnElement="SP_rebase">
-        <dc:Bounds x="1038" y="1360" width="100" height="80" />
+        <dc:Bounds x="1688" y="1360" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-rebase-outcome" bpmnElement="gw-rebase-outcome" isMarkerVisible="true">
-        <dc:Bounds x="1238" y="1375" width="50" height="50" />
+        <dc:Bounds x="1888" y="1375" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1272" y="1430" width="63" height="28" />
+          <dc:Bounds x="1922" y="1430" width="63" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-merge-dep" bpmnElement="record-merge-dep">
-        <dc:Bounds x="1388" y="1200" width="100" height="80" />
+        <dc:Bounds x="2038" y="1200" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_start" bpmnElement="f_m_start">
         <di:waypoint x="116" y="280" />
@@ -767,321 +850,360 @@
         <di:waypoint x="452" y="280" />
         <di:waypoint x="552" y="280" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_me_wait" bpmnElement="f_me_wait">
+        <di:waypoint x="602" y="280" />
+        <di:waypoint x="702" y="280" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_mw_ready" bpmnElement="f_mw_ready">
+        <di:waypoint x="752" y="280" />
+        <di:waypoint x="852" y="280" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_ready" bpmnElement="f_m_ready">
-        <di:waypoint x="588" y="280" />
-        <di:waypoint x="688" y="280" />
+        <di:waypoint x="888" y="280" />
+        <di:waypoint x="1338" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_mReady" bpmnElement="f_m_mReady">
-        <di:waypoint x="738" y="280" />
-        <di:waypoint x="838" y="280" />
+        <di:waypoint x="1388" y="280" />
+        <di:waypoint x="1488" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="769" y="258" width="39" height="14" />
+          <dc:Bounds x="1419" y="258" width="39" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_attempt" bpmnElement="f_m_attempt">
-        <di:waypoint x="938" y="280" />
-        <di:waypoint x="1063" y="280" />
+        <di:waypoint x="1588" y="280" />
+        <di:waypoint x="1713" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gMerged" bpmnElement="f_m_gMerged">
-        <di:waypoint x="1113" y="280" />
-        <di:waypoint x="1588" y="280" />
+        <di:waypoint x="1763" y="280" />
+        <di:waypoint x="2238" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1401" y="258" width="49" height="14" />
+          <dc:Bounds x="2051" y="258" width="49" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_done" bpmnElement="f_m_done">
-        <di:waypoint x="1688" y="280" />
-        <di:waypoint x="1795" y="280" />
+        <di:waypoint x="2338" y="280" />
+        <di:waypoint x="2445" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_rearm" bpmnElement="f_ci_rearm">
-        <di:waypoint x="1263" y="1265" />
-        <di:waypoint x="1263" y="1300" />
+        <di:waypoint x="1913" y="1265" />
+        <di:waypoint x="1913" y="1300" />
         <di:waypoint x="402" y="1300" />
         <di:waypoint x="402" y="320" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="442" y="1239" width="88" height="56" />
+          <dc:Bounds x="446" y="1239" width="88" height="56" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_rearm" bpmnElement="f_reb_rearm">
-        <di:waypoint x="1263" y="1425" />
-        <di:waypoint x="1263" y="1460" />
+        <di:waypoint x="1913" y="1425" />
+        <di:waypoint x="1913" y="1460" />
         <di:waypoint x="402" y="1460" />
         <di:waypoint x="402" y="320" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="794" y="1413" width="78" height="42" />
+          <dc:Bounds x="1119" y="1413" width="78" height="42" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_msp_giveup" bpmnElement="f_msp_giveup">
+        <di:waypoint x="1238" y="440" />
+        <di:waypoint x="1258" y="440" />
+        <di:waypoint x="1258" y="465" />
+        <di:waypoint x="1651" y="465" />
+        <di:waypoint x="1651" y="1060" />
+        <di:waypoint x="2038" y="1060" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1378" y="470" width="85" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_giveup" bpmnElement="f_ci_giveup">
-        <di:waypoint x="913" y="1080" />
-        <di:waypoint x="1388" y="1080" />
+        <di:waypoint x="1563" y="1080" />
+        <di:waypoint x="2038" y="1080" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1127" y="1085" width="67" height="28" />
+          <dc:Bounds x="1757" y="1085" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_giveup" bpmnElement="f_reb_giveup">
-        <di:waypoint x="913" y="440" />
-        <di:waypoint x="933" y="440" />
-        <di:waypoint x="933" y="465" />
-        <di:waypoint x="1163" y="465" />
-        <di:waypoint x="1163" y="1060" />
-        <di:waypoint x="1388" y="1060" />
+        <di:waypoint x="1563" y="440" />
+        <di:waypoint x="1583" y="440" />
+        <di:waypoint x="1583" y="465" />
+        <di:waypoint x="1813" y="465" />
+        <di:waypoint x="1813" y="1060" />
+        <di:waypoint x="2038" y="1060" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1035" y="432" width="67" height="28" />
+          <dc:Bounds x="1699" y="432" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_giveup" bpmnElement="f_mr_giveup">
-        <di:waypoint x="1288" y="760" />
-        <di:waypoint x="1388" y="760" />
+        <di:waypoint x="1938" y="760" />
+        <di:waypoint x="2038" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1285" y="687" width="67" height="28" />
+          <dc:Bounds x="1935" y="687" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_landed" bpmnElement="f_eg_landed">
-        <di:waypoint x="1288" y="440" />
-        <di:waypoint x="1420" y="440" />
+        <di:waypoint x="1938" y="440" />
+        <di:waypoint x="2070" y="440" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_landed" bpmnElement="f_m_landed">
-        <di:waypoint x="1456" y="440" />
-        <di:waypoint x="1638" y="440" />
-        <di:waypoint x="1638" y="320" />
+        <di:waypoint x="2106" y="440" />
+        <di:waypoint x="2288" y="440" />
+        <di:waypoint x="2288" y="320" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escC" bpmnElement="f_m_escC">
-        <di:waypoint x="1488" y="1080" />
-        <di:waypoint x="1988" y="1080" />
-        <di:waypoint x="1988" y="160" />
+        <di:waypoint x="2138" y="1080" />
+        <di:waypoint x="2638" y="1080" />
+        <di:waypoint x="2638" y="160" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escA" bpmnElement="f_m_escA">
-        <di:waypoint x="1488" y="760" />
-        <di:waypoint x="1851" y="760" />
-        <di:waypoint x="1851" y="145" />
-        <di:waypoint x="1858" y="145" />
-        <di:waypoint x="1858" y="120" />
-        <di:waypoint x="1838" y="120" />
+        <di:waypoint x="2138" y="760" />
+        <di:waypoint x="2501" y="760" />
+        <di:waypoint x="2501" y="145" />
+        <di:waypoint x="2508" y="145" />
+        <di:waypoint x="2508" y="120" />
+        <di:waypoint x="2488" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escReenter" bpmnElement="f_m_escReenter">
-        <di:waypoint x="1813" y="95" />
-        <di:waypoint x="1813" y="60" />
+        <di:waypoint x="2463" y="95" />
+        <di:waypoint x="2463" y="60" />
         <di:waypoint x="402" y="60" />
         <di:waypoint x="402" y="240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1071" y="13" width="74" height="42" />
+          <dc:Bounds x="1396" y="13" width="74" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answerRecord" bpmnElement="f_m_answerRecord">
-        <di:waypoint x="2038" y="120" />
-        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2688" y="120" />
+        <di:waypoint x="2788" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answer" bpmnElement="f_m_answer">
-        <di:waypoint x="2188" y="160" />
-        <di:waypoint x="2188" y="340" />
+        <di:waypoint x="2838" y="160" />
+        <di:waypoint x="2838" y="340" />
         <di:waypoint x="402" y="340" />
         <di:waypoint x="402" y="320" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_escAttempt" bpmnElement="f_ci_escAttempt">
-        <di:waypoint x="1263" y="1215" />
-        <di:waypoint x="1263" y="1195" />
-        <di:waypoint x="843" y="1195" />
-        <di:waypoint x="843" y="402" />
-        <di:waypoint x="1218" y="402" />
-        <di:waypoint x="1218" y="478" />
-        <di:waypoint x="1368" y="478" />
-        <di:waypoint x="1368" y="740" />
-        <di:waypoint x="1388" y="740" />
-        <bpmndi:BPMNLabel>
-          <dc:Bounds x="1023" y="1173" width="60" height="14" />
+        <di:waypoint x="1913" y="1215" />
+        <di:waypoint x="1913" y="1195" />
+        <di:waypoint x="1168" y="1195" />
+        <di:waypoint x="1168" y="402" />
+        <di:waypoint x="1868" y="402" />
+        <di:waypoint x="1868" y="478" />
+        <di:waypoint x="2018" y="478" />
+        <di:waypoint x="2018" y="740" />
+        <di:waypoint x="2038" y="740" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1551" y="1203" width="60" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_waitDep" bpmnElement="f_reb_waitDep">
-        <di:waypoint x="1288" y="1400" />
-        <di:waypoint x="1438" y="1400" />
-        <di:waypoint x="1438" y="1280" />
+        <di:waypoint x="1938" y="1400" />
+        <di:waypoint x="2088" y="1400" />
+        <di:waypoint x="2088" y="1280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1346" y="1405" width="75" height="28" />
+          <dc:Bounds x="1996" y="1405" width="75" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_escAttempt" bpmnElement="f_reb_escAttempt">
-        <di:waypoint x="1263" y="1375" />
-        <di:waypoint x="1263" y="1355" />
-        <di:waypoint x="843" y="1355" />
-        <di:waypoint x="843" y="402" />
-        <di:waypoint x="1218" y="402" />
-        <di:waypoint x="1218" y="478" />
-        <di:waypoint x="1368" y="478" />
-        <di:waypoint x="1368" y="740" />
-        <di:waypoint x="1388" y="740" />
-        <bpmndi:BPMNLabel>
-          <dc:Bounds x="774" y="1234" width="64" height="42" />
+        <di:waypoint x="1913" y="1375" />
+        <di:waypoint x="1913" y="1355" />
+        <di:waypoint x="1168" y="1355" />
+        <di:waypoint x="1168" y="402" />
+        <di:waypoint x="1868" y="402" />
+        <di:waypoint x="1868" y="478" />
+        <di:waypoint x="2018" y="478" />
+        <di:waypoint x="2018" y="740" />
+        <di:waypoint x="2038" y="740" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1173" y="1234" width="64" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_escConflict" bpmnElement="f_reb_escConflict">
-        <di:waypoint x="1288" y="1400" />
-        <di:waypoint x="1368" y="1400" />
-        <di:waypoint x="1368" y="1080" />
-        <di:waypoint x="1388" y="1080" />
+        <di:waypoint x="1938" y="1400" />
+        <di:waypoint x="2018" y="1400" />
+        <di:waypoint x="2018" y="1080" />
+        <di:waypoint x="2038" y="1080" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1303" y="1246" width="60" height="28" />
+          <dc:Bounds x="1953" y="1246" width="60" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_mw_timeout" bpmnElement="f_mw_timeout">
+        <di:waypoint x="727" y="305" />
+        <di:waypoint x="727" y="440" />
+        <di:waypoint x="852" y="440" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_msp_rederive" bpmnElement="f_msp_rederive">
+        <di:waypoint x="1213" y="415" />
+        <di:waypoint x="1213" y="280" />
+        <di:waypoint x="1338" y="280" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1218" y="354" width="85" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_mCiFix" bpmnElement="f_m_mCiFix">
-        <di:waypoint x="713" y="305" />
-        <di:waypoint x="713" y="1080" />
-        <di:waypoint x="863" y="1080" />
+        <di:waypoint x="1363" y="305" />
+        <di:waypoint x="1363" y="1080" />
+        <di:waypoint x="1513" y="1080" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="718" y="758" width="60" height="42" />
+          <dc:Bounds x="1368" y="739" width="60" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_mRebase" bpmnElement="f_m_mRebase">
-        <di:waypoint x="713" y="305" />
-        <di:waypoint x="713" y="440" />
-        <di:waypoint x="863" y="440" />
+        <di:waypoint x="1363" y="305" />
+        <di:waypoint x="1363" y="440" />
+        <di:waypoint x="1513" y="440" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="758" y="418" width="60" height="14" />
+          <dc:Bounds x="1408" y="418" width="60" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_mBlocked" bpmnElement="f_m_mBlocked">
-        <di:waypoint x="713" y="305" />
-        <di:waypoint x="713" y="478" />
-        <di:waypoint x="933" y="478" />
-        <di:waypoint x="933" y="1080" />
-        <di:waypoint x="1388" y="1080" />
+        <di:waypoint x="1363" y="305" />
+        <di:waypoint x="1363" y="325" />
+        <di:waypoint x="1875" y="325" />
+        <di:waypoint x="1875" y="805" />
+        <di:waypoint x="2126" y="805" />
+        <di:waypoint x="2126" y="1040" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="741" y="456" width="85" height="14" />
+          <dc:Bounds x="1880" y="558" width="85" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_go" bpmnElement="f_ci_go">
-        <di:waypoint x="888" y="1105" />
-        <di:waypoint x="888" y="1240" />
-        <di:waypoint x="1038" y="1240" />
+        <di:waypoint x="1538" y="1105" />
+        <di:waypoint x="1538" y="1240" />
+        <di:waypoint x="1688" y="1240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="893" y="1159" width="49" height="28" />
+          <dc:Bounds x="1543" y="1159" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_go" bpmnElement="f_reb_go">
-        <di:waypoint x="913" y="440" />
-        <di:waypoint x="1018" y="440" />
-        <di:waypoint x="1018" y="1400" />
-        <di:waypoint x="1038" y="1400" />
+        <di:waypoint x="1563" y="440" />
+        <di:waypoint x="1668" y="440" />
+        <di:waypoint x="1668" y="1400" />
+        <di:waypoint x="1688" y="1400" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1023" y="906" width="49" height="28" />
+          <dc:Bounds x="1673" y="906" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gQueued" bpmnElement="f_m_gQueued">
-        <di:waypoint x="1113" y="280" />
-        <di:waypoint x="1263" y="280" />
-        <di:waypoint x="1263" y="415" />
+        <di:waypoint x="1763" y="280" />
+        <di:waypoint x="1913" y="280" />
+        <di:waypoint x="1913" y="415" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1268" y="361" width="46" height="14" />
+          <dc:Bounds x="1918" y="361" width="46" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gRetry" bpmnElement="f_m_gRetry">
-        <di:waypoint x="1113" y="280" />
-        <di:waypoint x="1218" y="280" />
-        <di:waypoint x="1218" y="760" />
-        <di:waypoint x="1238" y="760" />
+        <di:waypoint x="1763" y="280" />
+        <di:waypoint x="1868" y="280" />
+        <di:waypoint x="1868" y="760" />
+        <di:waypoint x="1888" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1135" y="419" width="78" height="28" />
+          <dc:Bounds x="1785" y="419" width="78" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_evicted" bpmnElement="f_eg_evicted">
-        <di:waypoint x="1288" y="440" />
-        <di:waypoint x="1400" y="440" />
-        <di:waypoint x="1400" y="600" />
-        <di:waypoint x="1420" y="600" />
+        <di:waypoint x="1938" y="440" />
+        <di:waypoint x="2050" y="440" />
+        <di:waypoint x="2050" y="600" />
+        <di:waypoint x="2070" y="600" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_landedTimeout" bpmnElement="f_eg_landedTimeout">
-        <di:waypoint x="1288" y="440" />
-        <di:waypoint x="1308" y="440" />
-        <di:waypoint x="1308" y="415" />
-        <di:waypoint x="1420" y="415" />
-        <di:waypoint x="1420" y="478" />
-        <di:waypoint x="1858" y="478" />
-        <di:waypoint x="1858" y="235" />
-        <di:waypoint x="1420" y="235" />
-        <di:waypoint x="1420" y="158" />
-        <di:waypoint x="1438" y="158" />
-        <di:waypoint x="1438" y="138" />
+        <di:waypoint x="1938" y="440" />
+        <di:waypoint x="1958" y="440" />
+        <di:waypoint x="1958" y="415" />
+        <di:waypoint x="2070" y="415" />
+        <di:waypoint x="2070" y="478" />
+        <di:waypoint x="2508" y="478" />
+        <di:waypoint x="2508" y="235" />
+        <di:waypoint x="2070" y="235" />
+        <di:waypoint x="2070" y="158" />
+        <di:waypoint x="2088" y="158" />
+        <di:waypoint x="2088" y="138" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gBlocked" bpmnElement="f_m_gBlocked">
-        <di:waypoint x="1113" y="280" />
-        <di:waypoint x="1133" y="280" />
-        <di:waypoint x="1133" y="305" />
-        <di:waypoint x="1218" y="305" />
-        <di:waypoint x="1218" y="805" />
-        <di:waypoint x="1368" y="805" />
-        <di:waypoint x="1368" y="780" />
-        <di:waypoint x="1388" y="780" />
+        <di:waypoint x="1763" y="280" />
+        <di:waypoint x="1783" y="280" />
+        <di:waypoint x="1783" y="305" />
+        <di:waypoint x="1868" y="305" />
+        <di:waypoint x="1868" y="820" />
+        <di:waypoint x="2018" y="820" />
+        <di:waypoint x="2018" y="780" />
+        <di:waypoint x="2038" y="780" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1309" y="783" width="53" height="14" />
+          <dc:Bounds x="1977" y="828" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gAbandoned" bpmnElement="f_m_gAbandoned">
-        <di:waypoint x="1113" y="280" />
-        <di:waypoint x="1133" y="280" />
-        <di:waypoint x="1133" y="305" />
-        <di:waypoint x="1225" y="305" />
-        <di:waypoint x="1225" y="805" />
-        <di:waypoint x="1245" y="805" />
-        <di:waypoint x="1245" y="882" />
-        <di:waypoint x="1263" y="882" />
-        <di:waypoint x="1263" y="902" />
+        <di:waypoint x="1738" y="255" />
+        <di:waypoint x="1738" y="242" />
+        <di:waypoint x="2126" y="242" />
+        <di:waypoint x="2126" y="220" />
+        <di:waypoint x="2568" y="220" />
+        <di:waypoint x="2568" y="920" />
+        <di:waypoint x="1931" y="920" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1230" y="541" width="82" height="28" />
+          <dc:Bounds x="2306" y="187" width="82" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_waitDep" bpmnElement="f_ci_waitDep">
-        <di:waypoint x="1288" y="1240" />
-        <di:waypoint x="1388" y="1240" />
+        <di:waypoint x="1938" y="1240" />
+        <di:waypoint x="2038" y="1240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1281" y="1167" width="75" height="28" />
+          <dc:Bounds x="1931" y="1167" width="75" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_mw_stall" bpmnElement="f_mw_stall">
+        <di:waypoint x="888" y="440" />
+        <di:waypoint x="988" y="440" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_msp_gate" bpmnElement="f_msp_gate">
+        <di:waypoint x="1088" y="440" />
+        <di:waypoint x="1188" y="440" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_spdone" bpmnElement="f_ci_spdone">
-        <di:waypoint x="1138" y="1240" />
-        <di:waypoint x="1238" y="1240" />
+        <di:waypoint x="1788" y="1240" />
+        <di:waypoint x="1888" y="1240" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_spdone" bpmnElement="f_reb_spdone">
-        <di:waypoint x="1138" y="1400" />
-        <di:waypoint x="1238" y="1400" />
+        <di:waypoint x="1788" y="1400" />
+        <di:waypoint x="1888" y="1400" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
-        <di:waypoint x="1456" y="120" />
-        <di:waypoint x="1588" y="120" />
+        <di:waypoint x="2106" y="120" />
+        <di:waypoint x="2238" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
-        <di:waypoint x="1688" y="120" />
-        <di:waypoint x="1788" y="120" />
+        <di:waypoint x="2338" y="120" />
+        <di:waypoint x="2438" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escWait" bpmnElement="f_m_escWait">
-        <di:waypoint x="1838" y="120" />
-        <di:waypoint x="1938" y="120" />
+        <di:waypoint x="2488" y="120" />
+        <di:waypoint x="2588" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_recheck" bpmnElement="f_ci_recheck">
-        <di:waypoint x="1263" y="1265" />
-        <di:waypoint x="1263" y="1300" />
-        <di:waypoint x="570" y="1300" />
-        <di:waypoint x="570" y="298" />
+        <di:waypoint x="1913" y="1265" />
+        <di:waypoint x="1913" y="1300" />
+        <di:waypoint x="577" y="1300" />
+        <di:waypoint x="577" y="305" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="575" y="765" width="85" height="28" />
+          <dc:Bounds x="582" y="769" width="85" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_dep_rewait" bpmnElement="f_dep_rewait">
-        <di:waypoint x="1438" y="1280" />
-        <di:waypoint x="1438" y="1480" />
+        <di:waypoint x="2088" y="1280" />
+        <di:waypoint x="2088" y="1480" />
         <di:waypoint x="234" y="1480" />
         <di:waypoint x="234" y="298" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_go" bpmnElement="f_mr_go">
-        <di:waypoint x="1263" y="785" />
-        <di:waypoint x="1263" y="805" />
+        <di:waypoint x="1913" y="785" />
+        <di:waypoint x="1913" y="805" />
         <di:waypoint x="402" y="805" />
         <di:waypoint x="402" y="320" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="786" y="810" width="49" height="28" />
+          <dc:Bounds x="1114" y="772" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_evicted" bpmnElement="f_m_evicted">
-        <di:waypoint x="1438" y="618" />
-        <di:waypoint x="1438" y="638" />
+        <di:waypoint x="2088" y="618" />
+        <di:waypoint x="2088" y="638" />
         <di:waypoint x="402" y="638" />
         <di:waypoint x="402" y="320" />
       </bpmndi:BPMNEdge>

package/workers/merge-stall-probe/worker.ts

@@ -0,0 +1,66 @@
+// pr.merge-stall-probe — the mergeable-wait timer fired: the in-process poller never published
+// `merge-ready` within `mergeableWaitTimeout` (it died across a redeploy, errored on this PR, or
+// skipped the verdict), so the instance would otherwise sit wedged at `waiting_merge` forever with
+// no timeout and no escalation (issue #636). This is the bounded-wait backstop: re-derive
+// ground-truth mergeability directly from GitHub — reusing the poller's own classifier
+// (`classifyMergeability` over a fresh `fetchPrState`, protocol-aware via `loadMergeProtocol`) — and
+// emit `mergeState` so the *existing* `gw-mergeable` routes the token to the correct arm:
+//   • ready    → attempt-merge
+//   • conflict → rebase arm
+//   • blocked  → CI-fix arm
+//   • draft / waiting (still computing) → not-landable escalation (gw-mergeable default)
+// The timer only guarantees the remediation machinery is ENTERED when the poller is dead; every
+// downstream arm is the same one the live poller feeds. A bounded `mergeStallRounds` counter
+// (incremented by this task's output mapping, capped by `mergeStallMax`) stops the probe from
+// re-arming forever: once exhausted, `gw-merge-stall` routes to human escalation instead.
+import type { AppJobHandler } from "@nanobpm/urban";
+import { classifyMergeability, fetchPrState } from "../../app/github.ts";
+import { loadMergeProtocol } from "../../app/mergeProtocol.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+// Input typed off the model data envelope (`MergeStallProbeIn` in merge-loop.bpmn) — ADR 0040.
+type In = WorkerInputs["pr.merge-stall-probe"];
+
+interface Out extends Record<string, unknown> {
+  // Mirrors the poller's `merge-ready {mergeState}` payload so the existing `gw-mergeable` FEEL
+  // routes it. `waiting` (GitHub still computing / no verdict) is surfaced verbatim; gw-mergeable
+  // has no `waiting` arm, so it falls to the not-landable default and escalates — the correct
+  // backstop when the poller is dead and 30 minutes on GitHub still cannot settle the PR.
+  mergeState: string;
+  failingChecks: number;
+  failingChecksList: string;
+}
+
+const handler: AppJobHandler<In, Out> = async (job, app) => {
+  const { repo, prNumber } = job.variables;
+  const token = process.env.GITHUB_TOKEN ?? "";
+
+  // Re-derive ground truth exactly as the poller does (service.ts block 2). Load the repo's merge
+  // protocol so the protocol-aware backstop (#392) gates a red DECLARED-required check even when
+  // GitHub reports UNSTABLE. Any transport hiccup is treated as "still waiting" — never a spurious
+  // ready/conflict verdict — so a bad read is surfaced as `waiting`, which `gw-mergeable` routes to
+  // its not-landable default (human escalation), erring toward a human rather than misrouting the
+  // token to a wrong remediation arm.
+  const st = await fetchPrState(repo, prNumber, token).catch(() => null);
+  if (st === null) {
+    return { mergeState: "waiting", failingChecks: 0, failingChecksList: "" };
+  }
+  const protocol = await loadMergeProtocol(repo, token).catch(() => null);
+  const mergeState = classifyMergeability(st, protocol ?? undefined);
+
+  app.log.info("merge-stall-probe: poller stalled — re-derived mergeability", {
+    prKey: job.variables.prKey,
+    mergeState,
+    mergeStateStatus: st.mergeStateStatus,
+  });
+
+  return {
+    mergeState,
+    // Carried for the CI-fix arm (mergeState "blocked" = a failed required check), mirroring the
+    // poller's `merge-ready` payload so fix-ci knows which gates to green.
+    failingChecks: st.failingChecks,
+    failingChecksList: st.failingCheckNames.join("\n"),
+  };
+};
+
+export default handler;