@nanobpm/nano-workforce 0.187.6 → 0.188.0

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.188.0](https://github.com/nanobpm/nano-workforce/compare/v0.187.6...v0.188.0) (2026-09-17)
+
+### Features
+
+* **convergence:** bounded agent auto-ack before human escalation on ack-only converge blocks ([#800](https://github.com/nanobpm/nano-workforce/issues/800)) ([be0f7a2](https://github.com/nanobpm/nano-workforce/commit/be0f7a2f04ef768a2acdfdf229131e7158834026)), closes [#789](https://github.com/nanobpm/nano-workforce/issues/789) [Magikcraft/nano-bpm#1199](https://github.com/Magikcraft/nano-bpm/issues/1199) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#787](https://github.com/nanobpm/nano-workforce/issues/787) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [787/#796](https://github.com/787/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [787/#796](https://github.com/787/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796) [#796](https://github.com/nanobpm/nano-workforce/issues/796)
+
 ## [0.187.6](https://github.com/nanobpm/nano-workforce/compare/v0.187.5...v0.187.6) (2026-09-16)
 
 ### Bug Fixes

package/README.md

@@ -360,6 +360,7 @@ agent at that URL to author, compile, and submit a graph unaided. See
 | `NANO_PR_MERGE_METHOD` | `squash` | merge method: `squash`, `merge`, or `rebase` |
 | `NANO_PR_MERGE_ADMIN` | `0` | pass `--admin` to override failing non-required checks (use with care) |
 | `NANO_PR_MAX_CI_FIX_ROUNDS` | `3` | max `senior:fix-ci` attempts to green a `blocked` PR before escalating; `0` disables (escalate immediately), clamped 0–20 |
+| `NANO_PR_MAX_ACK_RETRIES` | `2` | max bounded review-round re-dispatches to recover an ack-only converge block — unacknowledged suppressed advisories and/or unresolved canonical `nano-ack:` threads (`app/convergeGate.ts` `ackOnly`) — before escalating to a human (#796); `0` escalates on the first ack-only block, clamped 0–20 |
 | `NANO_PR_REVIEW_WAIT_TIMEOUT` | `PT30M` | ISO-8601 duration the loop waits for a fresh review before escalating a stalled review (timer arm of the `wait-review` gateway) |
 | `NANO_PR_REVIEW_NUDGE_MINUTES` | `5` | cooldown between the poller's automatic reviewer re-request nudges for one waiting PR (clamped 1–1440) |
 | `NANO_WORKFORCE_BASE_URL` | `http://localhost:3000` | externally-reachable base URL for the capability hooks (`/app/api/hooks/*`). Must resolve from **wherever the agent runs** — set it to the app's LAN address (or console-proxy URL) for a remote fleet. See [Fleet networking](#fleet-networking-remote-workers) |

package/SPEC.md

@@ -99,27 +99,36 @@ known at submit time, carried as a process variable and stored on the DB row.
 │         │
 │         ▼
 │    <gateway: status>
-│      ├── converged  → [Mark converged] → (end: converged)
-│      │
-│      ├── addressed  → [Record round] → [Check progress] (did the PR head advance?)
+│      ├── converged  → [Check review comments] (pr.converge-gate; ++ackRetryRound on ack-only block)
+│      │                   → <gateway: comments addressed?>
+│      │                       ├── addressed → [Scope classifier] → … → [Mark converged] → (end)
+│      │                       ├── review stale (#799) → [Record round] (re-solicit fresh review) ┐
+│      │                       └── unaddressed → <gateway: auto-ack within budget?>               │
+│      │                            ├── convergeAckOnly and ackRetryRound ≤ ackRetryMax           │
+│      │                            │      → re-dispatch review-round (round unchanged) ───────────┤
+│      │                            └── unresolved thread / budget exhausted                      │
+│      │                                 → [Escalate: unaddressed comments] (blocked)             │
+│      │                                 → [Wait: wait-answer userTask] ────────────────────────────┤
+│      │                                                                                          │
+│      ├── addressed  → [Record round] → [Check progress] (did the PR head advance?)              │
 │      │                   ├── progressed → <guard: round ≥ maxRounds → escalate "not converged"> │
 │      │                   │                   → <event-based gateway: review ready or timeout?>   │
-│      │                   │      ├── readiness-ready (msg catch, key = prKey) → round++ ─┐
-│      │                   │      └── =reviewWaitTimeout (timer catch)                    │
-│      │                   │           → [Escalate: review stalled] (blocked)             │
-│      │                   │           → [Wait: wait-answer userTask] ────────────────────┤
-│      │                   └── no progress → <husk? no commit AND no terminal instance>   │
+│      │                   │      ├── readiness-ready (msg catch, key = prKey) → round++ ─┐        │
+│      │                   │      └── =reviewWaitTimeout (timer catch)                     │        │
+│      │                   │           → [Escalate: review stalled] (blocked)             │        │
+│      │                   │           → [Wait: wait-answer userTask] ────────────────────┤        │
+│      │                   └── no progress → <husk? no commit AND no terminal instance>   │        │
 │      │                          ├── husk & retries < MAX → re-enter [Review round] (bypasses the round-cap guard) │
-│      │                          └── no-advance / husk cap → [Escalate: no progress]      │
-│      │                                     → [Wait: wait-answer userTask] ───────────────────┤
-│      │                                                                             │
-│      └── needs_input     [Record escalation]                       │               │
-│          or blocked  →   (kind = question | blocker)               │               │
-│                          → [Wait: wait-answer userTask]            │               │
-│                          → [record-answer: pr.answer-escalation]   │               │
-│                          → set answer ──────────────────────────────┤               │
-│                                                                    │               │
-└────────────────────────────────────────────────────────────────────┴───────────────┘
+│      │                          └── no-advance / husk cap → [Escalate: no progress]      │       │
+│      │                                     → [Wait: wait-answer userTask] ───────────────────┤   │
+│      │                                                                             │            │
+│      └── needs_input     [Record escalation]                       │               │            │
+│          or blocked  →   (kind = question | blocker)               │               │            │
+│                          → [Wait: wait-answer userTask]            │               │            │
+│                          → [record-answer: pr.answer-escalation]   │               │            │
+│                          → set answer ──────────────────────────────┤               │            │
+│                                                                    │               │            │
+└────────────────────────────────────────────────────────────────────┴───────────────┴────────────┘
 
 Both `needs_input` (the agent has a question) and `blocked` (the agent is stuck
 on something external — auth, a failing push, a missing secret) route to the
@@ -145,9 +154,14 @@ Notes:
 - **Convergence comment-gate + stale-review re-solicitation (issue #799).** The
   agent's self-reported `converged` does not finalize directly: it first runs the
   deterministic `pr.converge-gate` (`check-converge` → `gw-converge-gate`). That
-  gate **blocks** convergence (`convergeBlocked = true` → escalate "unaddressed
-  comments") while any review thread is unresolved or any suppressed advisory
-  lacks a resolved `nano-ack:` thread; otherwise it proceeds to the scope
+  gate **blocks** convergence (`convergeBlocked = true`) while any review thread
+  is unresolved or any suppressed advisory lacks a resolved `nano-ack:` thread.
+  A block whose *sole* outstanding items are unresolved `nano-ack:` threads is
+  classified **ack-only** and does **not** immediately escalate to a human:
+  within the `ackRetryMax` budget the bounded auto-ack retry re-dispatches
+  `review-round` (round unchanged) to finish the acknowledgements; only a
+  substantive unresolved thread — or an exhausted ack-retry budget — escalates
+  ("unaddressed comments"). Otherwise the gate proceeds to the scope
   classifier and finalizes. A third arm handles a **stale review** — one whose
   `commit_id` predates the PR's current HEAD (its advisories describe code the
   head has moved past, e.g. an advisory already fixed in a later commit). Rather
@@ -182,6 +196,40 @@ Notes:
   backstop when even repeated nudges fail.
 - On `needs_input`, the same `round` is retried after the answer (the answer is
   added to the agent's context; the round number does not advance).
+- On `converged`, the run does **not** finalize blindly: it first runs the
+  deterministic **converge gate** (`pr.converge-gate`, `Check review comments`),
+  which re-reads GitHub and re-blocks (`convergeBlocked=true`) while **any
+  substantive** review thread is unresolved or **any** suppressed advisory lacks a
+  resolved `nano-ack:` thread. An unresolved `nano-ack:` **ack thread** is **never
+  dropped** from the gate — it is a genuinely-open GitHub thread, so it still
+  **blocks** convergence — but a block whose only open threads are unresolved acks
+  is classified **ack-only**: a partially-completed acknowledgement the bounded
+  auto-ack retry can finish (post-and-resolve), not a code-review finding, so it
+  stays on the recoverable path instead of escalating. (An ack thread is one whose
+  *root* comment carries a canonical `nano-ack: <path> :: <text>` marker; a
+  substantive reviewer finding never does, so it escalates. Because an unresolved
+  ack still blocks either way, this classification is **fail-closed**: even a
+  mislabelled root cannot finalize the gate with an open thread — worst case it
+  routes to the bounded ack-retry, which cannot ack a non-advisory and so escalates
+  to a human on exhaustion.)
+  A block whose SOLE cause is unacknowledged suppressed
+  advisories or unresolved ack threads (no unresolved *substantive* thread) is
+  flagged **ack-only**
+  (`convergeAckOnly=true`) and is routine + recoverable: rather than pulling a
+  human in first, the loop makes a **bounded auto-ack re-dispatch** of
+  `review-round` — up to `ackRetryMax` times, advancing `ackRetryRound` on each
+  ack-only block (seeded from `NANO_PR_MAX_ACK_RETRIES`). It escalates to the human
+  `wait-answer` only when the block is **not** ack-only (an unresolved inline
+  thread), or the budget is exhausted. Both counters are process variables.
+- **Contested advisory → human is via the agent's `needs_input`, not a decline
+  (#787 / #796).** A resolved `Declined, false positive. nano-ack: …` thread is a
+  *considered agent adjudication* and, by design (#787), keeps the advisory
+  acknowledged so the gate **converges** — a stateless gate cannot re-block a
+  decline without re-introducing the #787 per-round-escalation livelock. The
+  "genuinely contested advisory surfaces to a human" path of #796 is reached when
+  the (re-dispatched) agent cannot decide and returns **`needs_input`** — that
+  routes through the normal status-escalation arm to `wait-answer`. Decline =
+  agent-adjudicated → converge; `needs_input` = agent defers → human.
 - **No-progress guard + husk classification (issue #786).** Before the review
   wait, an `addressed` round passes through `pr.progress-check`
   (`workers/progress-check/worker.ts`, mirrored by `app/roundProgress.ts`): it

package/app/contracts.ts

@@ -132,6 +132,14 @@ export const ENV_CONTRACTS = {
     semantics: "Maximum transient base/head-moved merge-race retries per PR before escalating.",
     default: "5",
   },
+  NANO_PR_MAX_ACK_RETRIES: {
+    category: "env",
+    name: "NANO_PR_MAX_ACK_RETRIES",
+    owner: "app/service.ts",
+    semantics:
+      "Maximum bounded review-round re-dispatches the convergence loop makes to auto-ack unacked suppressed advisories before escalating to a human (#796); 0 escalates on the first ack-only block.",
+    default: "2",
+  },
   NANO_PR_MAX_MERGE_STALL_ROUNDS: {
     category: "env",
     name: "NANO_PR_MAX_MERGE_STALL_ROUNDS",

package/app/convergeAutoAck.test.ts

@@ -0,0 +1,252 @@
+// Behavioural coverage for the bounded agent auto-ack step on the converge-gate-blocked path
+// (issue #796).
+//
+// The converge-gate fails CLOSED and used to route EVERY block straight to the human `wait-answer`.
+// But a block whose SOLE cause is unacknowledged Copilot *suppressed advisories* (no unresolved
+// inline threads) is routine and recoverable: simply re-dispatching the review-round agent posts the
+// missing `nano-ack:` threads and converges. Pulling a human in as the FIRST recovery — before any
+// bounded agent retry — is the defect (#789/#1199 on merlin parked a human for exactly this).
+//
+// The fix models a bounded auto-ack retry (mirroring the merge loop's `gw-merge-retry`): an ack-only
+// block re-enters `review-round` up to `ackRetryMax` times, advancing `ackRetryRound` on each
+// ack-only block, and only escalates to the human when the block is NOT ack-only (an unresolved
+// inline thread), the re-dispatched agent needs input, or the budget is exhausted.
+//
+// These deploy the committed convergence-loop into the real WASM engine (`@nanobpm/urban-testkit`)
+// and drive tokens through it, asserting the observable invariant (completed elements, budget
+// counter, terminal state, escalation user task) — protecting what the loop DOES, not how it is drawn.
+import { after, test } from "node:test";
+import { assert } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { assertThatInstance, byProcessId, createWasmEngineClient, type WasmEngineClient } from "@nanobpm/urban-testkit";
+
+const MODEL = readFileSync("resources/processes/convergence-loop.bpmn", "utf8");
+
+type Output = Record<string, unknown>;
+type Responder = Output | Output[] | ((job: { variables: Record<string, unknown> }) => Output);
+
+const ALL_JOB_TYPES = [
+  "senior:pr-review",
+  "pr.capture-head",
+  "pr.persist-round",
+  "pr.progress-check",
+  "pr.converge-gate",
+  "senior:scope-classify",
+  "pr.finalize",
+  "pr.persist-escalation",
+  "pr.answer-escalation",
+] as const;
+
+const DEFAULT_RESPONSES: Record<string, Responder> = {
+  "senior:pr-review": { status: "converged", summary: "done" },
+  "pr.capture-head": { roundEntryHead: "sha-entry" },
+  "pr.persist-round": {},
+  "pr.progress-check": { progressed: true },
+  "senior:scope-classify": { scopeBlocked: false, scopeBlockReason: "" },
+  "pr.finalize": {},
+  "pr.persist-escalation": { escalated: true },
+  "pr.answer-escalation": {},
+};
+
+// Every FEEL expression the model touches, seeded so a missing-variable access can never raise a
+// spurious incident. `ackRetryMax` is the budget under test; overridden per scenario.
+const DEFAULT_VARS: Record<string, unknown> = {
+  prKey: "o/r#1",
+  repo: "o/r",
+  prNumber: 1,
+  prUrl: "https://example.test/pr/1",
+  round: 1,
+  maxRounds: 20,
+  reviewWaitTimeout: "PT30M",
+  ackRetryRound: 0,
+  ackRetryMax: 2,
+  abandonBrief: null,
+  status: null,
+  question: null,
+  summary: null,
+  answer: null,
+  scopePending: false,
+  scopeAnswer: null,
+  convergeBlocked: null,
+  convergeBlockReason: null,
+  convergeAckOnly: null,
+  reviewStale: null,
+  roundEntryHead: null,
+  huskRetries: 0,
+  progressed: true,
+  escalated: null,
+};
+
+async function startLoop(opts: {
+  responses?: Record<string, Responder | null>;
+  vars?: Record<string, unknown>;
+} = {}): Promise<WasmEngineClient> {
+  const engine = await createWasmEngineClient();
+  await engine.deployResources([{ name: "convergence-loop.bpmn", content: MODEL, contentType: "text/xml" }]);
+  const responses: Record<string, Responder | null> = { ...DEFAULT_RESPONSES, ...(opts.responses ?? {}) };
+  for (const jobType of ALL_JOB_TYPES) {
+    const responder = jobType in responses ? responses[jobType] : undefined;
+    if (responder === null) continue; // park the token
+    const queue = Array.isArray(responder) ? [...responder] : null;
+    await engine.registerWorker(jobType, (job) => {
+      if (queue) return queue.length > 1 ? queue.shift()! : (queue[0] ?? {});
+      if (typeof responder === "function") return responder(job as { variables: Record<string, unknown> });
+      return (responder as Output | undefined) ?? {};
+    });
+  }
+  await engine.createInstance({
+    processDefinitionId: "convergence-loop",
+    awaitCompletion: false,
+    variables: { ...DEFAULT_VARS, ...(opts.vars ?? {}) },
+  });
+  return engine;
+}
+
+/** Element ids completed by the single instance. */
+function completedElementIds(engine: WasmEngineClient): Set<string> {
+  const snap = engine.snapshot() as { elementStats?: { elementId: string; completed: number }[] };
+  return new Set((snap.elementStats ?? []).filter((s) => s.completed > 0).map((s) => s.elementId));
+}
+/** The number of times an element completed (review-round runs multiple times across retries). */
+function completions(engine: WasmEngineClient, elementId: string): number {
+  const snap = engine.snapshot() as { elementStats?: { elementId: string; completed: number }[] };
+  return (snap.elementStats ?? []).find((s) => s.elementId === elementId)?.completed ?? 0;
+}
+function instanceVars(engine: WasmEngineClient): Record<string, unknown> {
+  const snap = engine.snapshot() as { instances?: { variables?: Record<string, unknown> }[] };
+  return snap.instances?.[0]?.variables ?? {};
+}
+
+function asReadModelApp(engine: WasmEngineClient): WasmEngineClient {
+  (engine as unknown as { engine: WasmEngineClient }).engine = engine;
+  return engine;
+}
+
+const engines: WasmEngineClient[] = [];
+async function boot(opts?: Parameters<typeof startLoop>[0]): Promise<WasmEngineClient> {
+  const engine = asReadModelApp(await startLoop(opts));
+  engines.push(engine);
+  return engine;
+}
+after(async () => {
+  await Promise.all(engines.map((e) => e.close()));
+});
+
+async function openWaitAnswer(engine: WasmEngineClient): Promise<boolean> {
+  const tasks = await engine.searchUserTasks({});
+  return tasks.some((t) => t.elementId === "wait-answer");
+}
+
+// ── Acceptance: an ack-only block auto-acks and converges WITHOUT a human ─────
+
+test("an ack-only converge block re-dispatches the review-round agent and converges — no human", async () => {
+  // First gate call: blocked SOLELY on unacked advisories (ack-only). After the review-round agent
+  // is re-dispatched (auto-ack), the second gate call clears.
+  const engine = await boot({
+    responses: {
+      "pr.converge-gate": [
+        { convergeBlocked: true, convergeBlockReason: "1 unacknowledged suppressed advisory", convergeAckOnly: true },
+        { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false },
+      ],
+    },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).hasCompleted().hasNoIncident();
+  // The instance finalized without parking a human escalation.
+  assert(!(await openWaitAnswer(engine)), "no wait-answer user task must be opened on the auto-ack path");
+  // The review-round agent ran twice: the initial round + the one bounded auto-ack re-dispatch.
+  assert(completions(engine, "review-round") === 2, `review-round should run twice; ran ${completions(engine, "review-round")}`);
+  // (A COMPLETED instance's variables are folded away — assert the retry via the element run count
+  // above and the terminal converged element below, not a post-completion ackRetryRound read.)
+  assert(completedElementIds(engine).has("persist-converged"), "the PR must finalize as converged");
+});
+
+// ── Acceptance: a NON-ack-only block (unresolved thread) still escalates ──────
+
+test("a block with an unresolved inline thread is NOT ack-only and escalates to a human as before", async () => {
+  const engine = await boot({
+    responses: {
+      "pr.converge-gate": { convergeBlocked: true, convergeBlockReason: "1 unresolved review thread", convergeAckOnly: false },
+    },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  assert(await openWaitAnswer(engine), "a non-ack-only block must park the human wait-answer");
+  // It never re-dispatched the agent for an auto-ack — the review-round ran only its initial round.
+  assert(completions(engine, "review-round") === 1, "a non-ack-only block must not auto-ack-retry");
+  assert(instanceVars(engine).ackRetryRound === 0, "a non-ack-only block must not consume the ack-retry budget");
+});
+
+// ── Acceptance: the auto-ack pass is BOUNDED — exhausting the budget escalates ─
+
+test("an ack-only block with a zero budget escalates to a human on the first block (bounded)", async () => {
+  const engine = await boot({
+    vars: { ackRetryMax: 0 },
+    responses: {
+      "pr.converge-gate": { convergeBlocked: true, convergeBlockReason: "1 unacknowledged suppressed advisory", convergeAckOnly: true },
+    },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  assert(await openWaitAnswer(engine), "an exhausted ack-retry budget must escalate to the human");
+  assert(completedElementIds(engine).has("persist-escalation-blockedcomments"), "escalation must be the blocked-comments arm");
+});
+
+// ── Acceptance: a POSITIVE budget is exhausted — max-1 re-dispatches once, then escalates ─
+
+test("an ack-only block with a max-1 budget re-dispatches EXACTLY once, then escalates on the second block", async () => {
+  // Two CONSECUTIVE ack-only blocks with a budget of 1. This is the positive-budget exhaustion the
+  // max-2 (converges after one block) and max-0 (escalates on the first block) cases never exercise:
+  // it proves the `ackRetryRound <= ackRetryMax` gate performs exactly ONE re-dispatch and then, on
+  // the SECOND ack-only block, routes to the human — catching an off-by-one in the `<=` / counter.
+  const engine = await boot({
+    vars: { ackRetryMax: 1 },
+    responses: {
+      "pr.converge-gate": [
+        { convergeBlocked: true, convergeBlockReason: "1 unacknowledged suppressed advisory", convergeAckOnly: true },
+        { convergeBlocked: true, convergeBlockReason: "1 unacknowledged suppressed advisory", convergeAckOnly: true },
+      ],
+    },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  assert(await openWaitAnswer(engine), "a max-1 budget must escalate on the SECOND ack-only block");
+  assert(
+    completedElementIds(engine).has("persist-escalation-blockedcomments"),
+    "escalation must be the blocked-comments arm",
+  );
+  // Exactly one re-dispatch: the initial round + one auto-ack retry = two review-round runs (not three).
+  assert(
+    completions(engine, "review-round") === 2,
+    `review-round should run exactly twice; ran ${completions(engine, "review-round")}`,
+  );
+  // The budget counter advanced once per ack-only block (0→1→2), landing PAST the max (1) — the exact
+  // condition that flipped `ackRetryRound <= ackRetryMax` false on the second block. The instance is
+  // still ACTIVE (parked on the human), so its variables are readable (a COMPLETED instance folds them).
+  assert(
+    instanceVars(engine).ackRetryRound === 2,
+    `ackRetryRound should be 2 at the escalation; was ${instanceVars(engine).ackRetryRound}`,
+  );
+});
+
+// ── Acceptance: a re-dispatched agent that needs input surfaces to a human ────
+//
+// This is the ONLY path a genuinely-contested advisory reaches a human (#796 reconciled with #787):
+// the "contested → human" trigger is the agent returning `needs_input` (it cannot decide), NOT the
+// agent posting a reasoned `Declined, false positive. nano-ack: …`. A resolved decline is an agent
+// adjudication that converges by design (#787) — a stateless converge-gate cannot re-block a decline
+// without re-introducing the #787 per-round-escalation livelock. Decline = adjudicated → converge;
+// needs_input = deferred → human.
+
+test("a contested advisory — the re-dispatched agent returns needs_input — surfaces to a human", async () => {
+  const engine = await boot({
+    responses: {
+      "senior:pr-review": [
+        { status: "converged", summary: "round 1" },
+        { status: "needs_input", summary: "contested", question: "Is this advisory a real defect?" },
+      ],
+      "pr.converge-gate": { convergeBlocked: true, convergeBlockReason: "1 unacknowledged suppressed advisory", convergeAckOnly: true },
+    },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  assert(await openWaitAnswer(engine), "a re-dispatched agent that needs input must reach the human wait-answer");
+  // It DID try the bounded auto-ack once (the second review-round run), then the agent's needs_input
+  // verdict routed it to the human via the normal status escalation arm.
+  assert(completions(engine, "review-round") === 2, `review-round should run twice; ran ${completions(engine, "review-round")}`);
+});