@nanobpm/nano-workforce 0.189.0 → 0.189.2

package/app/service.test.ts

@@ -11,9 +11,10 @@ import { memDataFor } from "../test/worldDb.ts";
 import { withTrackingViews } from "../test/trackingViews.ts";
 import { DurableResumeRegistry } from "./durableResume.ts";
 import { WorldStore } from "./world/index.ts";
-import { abandonClosedPr, isPrSettled, MAX_ACK_RETRIES, parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
+import { abandonClosedPr, isPrSettled, MAX_ACK_RETRIES, parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollReviews, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
 import { trackingTargetFor } from "./instanceTracking.ts";
 import type { DataLayer } from "@nanobpm/urban";
+import { READINESS_READY_MESSAGE } from "./readiness.ts";
 
 function memTable(rows: any[], key: string) {
   return {
@@ -39,6 +40,33 @@ function memTable(rows: any[], key: string) {
   };
 }
 
+// Emulates the `data.open().exec` raw-SQL path submitPr uses to atomically reset a PR's adjudication
+// memory (`resetAdjudications` → `DELETE FROM "pr_adjudications" WHERE "pr_key" = ?`, Copilot review of
+// #806). The bulk-DELETE SQL itself is validated against real SQLite in app/adjudications.test.ts; here
+// it need only mutate the in-memory `pr_adjudications` store so submitPr's reset is observable. Pushes
+// an optional ordering token so the fence-ordering test can assert the reset runs AFTER `process_key`.
+function memOpen(stores: Record<string, { rows: any[]; key: string }>, ops?: string[]) {
+  return {
+    exec: async (sql: string, params: any[] = []) => {
+      if (/DELETE FROM "pr_adjudications" WHERE "pr_key" = \?/.test(sql)) {
+        ops?.push("adjudication-delete");
+        const store = stores.pr_adjudications;
+        let changed = 0;
+        if (store) {
+          for (let i = store.rows.length - 1; i >= 0; i--) {
+            if (store.rows[i].pr_key === params[0]) {
+              store.rows.splice(i, 1);
+              changed++;
+            }
+          }
+        }
+        return { changed };
+      }
+      throw new Error(`unexpected exec sql: ${sql}`);
+    },
+  };
+}
+
 function withGithubOff(run: () => Promise<void>): Promise<void> {
   const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
   const prevTok = process.env["GITHUB_TOKEN"];
@@ -51,6 +79,90 @@ function withGithubOff(run: () => Promise<void>): Promise<void> {
   });
 }
 
+function reviewPagesFetch(pages: Record<string, unknown>[][], requests: string[]) {
+  return (url: string | URL | Request): Promise<Response> => {
+    const u = new URL(String(url));
+    if (!u.pathname.endsWith("/reviews")) {
+      return Promise.resolve(
+        new Response(
+          JSON.stringify({ head: { ref: null, sha: "SHA_CURRENT" } }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        ),
+      );
+    }
+    requests.push(u.toString());
+    const page = Number(u.searchParams.get("page") ?? "1");
+    const headers = new Headers();
+    if (page < pages.length) {
+      headers.set(
+        "link",
+        `<https://api.github.com/repos/owner/repo/pulls/42/reviews?per_page=100&page=${page + 1}>; rel="next", ` +
+          `<https://api.github.com/repos/owner/repo/pulls/42/reviews?per_page=100&page=${pages.length}>; rel="last"`,
+      );
+    }
+    return Promise.resolve(new Response(JSON.stringify(pages[page - 1] ?? []), { status: 200, headers }));
+  };
+}
+
+test("pollReviews publishes readiness-ready for a fresh review on the final page (#793)", async () => {
+  const oldReviews = Array.from({ length: 100 }, (_, i) => ({
+    id: i + 1,
+    state: "COMMENTED",
+    submitted_at: "2026-09-01T00:00:00Z",
+    commit_id: "SHA_CURRENT",
+  }));
+  const pages = [
+    oldReviews,
+    [{ id: 101, state: "APPROVED", submitted_at: "2026-09-15T12:00:00Z", commit_id: "SHA_CURRENT" }],
+  ];
+  const requests: string[] = [];
+  const pr = {
+    pr_key: "owner/repo#42",
+    repo: "owner/repo",
+    number: 42,
+    status: "waiting_review",
+    waiting_since: "2026-09-10T00:00:00Z",
+    last_review_id: 100,
+  };
+  const stores: Record<string, { rows: any[]; key: string }> = {
+    pull_requests: { rows: [pr], key: "pr_key" },
+  };
+  const data = {
+    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], key),
+  } as any as DataLayer;
+  const messages: { name: string; correlationKey?: string; variables?: Record<string, unknown> }[] = [];
+  const engine = {
+    publishMessage: async (message: { name: string; correlationKey?: string; variables?: Record<string, unknown> }) => {
+      messages.push(message);
+    },
+  } as any;
+
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevFetch = globalThis.fetch;
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  globalThis.fetch = reviewPagesFetch(pages, requests) as typeof fetch;
+  try {
+    await pollReviews(data, engine, "tok");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode === undefined) delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    else process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+  }
+
+  assertEquals(requests.length, 2, "the poller must read the final reviews page");
+  assertEquals(
+    messages,
+    [{
+      name: READINESS_READY_MESSAGE,
+      correlationKey: "owner/repo#42",
+      variables: { ready: true, detail: "review 101 (APPROVED)" },
+    }],
+    "fresh review must release the review wait",
+  );
+  assertEquals(pr.last_review_id, 101);
+  assertEquals(pr.status, "converging");
+});
+
 test("isPrSettled reads the derived tracking view — an out-of-band-abandoned PR (base row still converging) is settled", async () => {
   // The base `pull_requests` row still reads `converging`, but the ADR-0065 derived tracking VIEW
   // folds the reconciler's out-of-band terminal edge into `derived_status: "abandoned"`. Terminal-edge
@@ -104,6 +216,7 @@ test("re-submit of a cancelled PR marks stale open escalations", async () => {
     };
     const data = {
       table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
     } as any;
     const engine = {
       createInstance: () => Promise.resolve({ processInstanceKey: "PI-9" }),
@@ -140,7 +253,142 @@ test("re-submit of a cancelled PR marks stale open escalations", async () => {
   });
 });
 
-// Red/green regression for technical-incident surfacing (issue #94). A convergence/merge instance
+// Red/green regression for issue #806 (Copilot review): re-submitting a PR must ALSO invalidate its
+// durable adjudication memory. The auto-resume replays a prior `(PR, question)` answer forever, so a
+// re-opened PR whose question recurs would silently auto-apply the stale decision and an operator
+// could never force a fresh one. `submitPr`'s reopen path clears `pr_adjudications` for the PR.
+test("re-submit of a PR invalidates its durable adjudications (#806 review)", async () => {
+  await withGithubOff(async () => {
+    const PR_KEY = "owner/repo#42";
+    const stores: Record<string, { rows: unknown[]; key: string }> = {
+      pull_requests: {
+        rows: [{ pr_key: PR_KEY, repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", title: "t", status: "converged" }],
+        key: "pr_key",
+      },
+      escalations: { rows: [], key: "id" },
+      pr_adjudications: {
+        rows: [
+          { id: 1, pr_key: PR_KEY, question_fingerprint: "fp-a", answer: "prior A", adjudicated_by: "alice", adjudicated_kind: "human", adjudicated_at: "t" },
+          { id: 2, pr_key: "owner/repo#99", question_fingerprint: "fp-b", answer: "other PR", adjudicated_by: "bob", adjudicated_kind: "human", adjudicated_at: "t" },
+        ],
+        key: "id",
+      },
+      pr_dependencies: { rows: [], key: "pr_key" },
+    };
+    const data = {
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
+    } as any;
+    const engine = { createInstance: () => Promise.resolve({ processInstanceKey: "PI-9" }) } as any;
+
+    await submitPr(data, engine, { repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", prKey: PR_KEY });
+
+    const remaining = stores.pr_adjudications.rows as Record<string, unknown>[];
+    assertEquals(remaining.length, 1, "this PR's adjudication is invalidated; another PR's is untouched");
+    assertEquals(remaining[0].pr_key, "owner/repo#99", "only the re-submitted PR's adjudications are cleared");
+  });
+});
+
+// Red/green regression for issue #806 (Copilot review): the durable adjudication RESET must happen
+// AFTER `process_key` is advanced to the new instance — not before createInstance. Clearing the memory
+// while `process_key` still names the OLD instance leaves a window where a delayed old-instance answer
+// job passes the worker's staleness gate and reinserts its adjudication into the fresh run. Advancing
+// the run identity FIRST fences that job, so the ordering is the fix. This asserts the observable
+// invariant: the `pull_requests.process_key` write is issued BEFORE any `pr_adjudications.delete`.
+test("re-submit advances process_key BEFORE resetting adjudications (fence ordering, #806 review)", async () => {
+  await withGithubOff(async () => {
+    const PR_KEY = "owner/repo#42";
+    const ops: string[] = [];
+    const stores: Record<string, { rows: any[]; key: string }> = {
+      pull_requests: {
+        rows: [{ pr_key: PR_KEY, repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", title: "t", status: "converged", process_key: "PI-OLD" }],
+        key: "pr_key",
+      },
+      escalations: { rows: [], key: "id" },
+      pr_adjudications: {
+        rows: [{ id: 1, pr_key: PR_KEY, question_fingerprint: "fp-a", answer: "prior A", adjudicated_by: "alice", adjudicated_kind: "human", adjudicated_at: "t" }],
+        key: "id",
+      },
+      pr_dependencies: { rows: [], key: "pr_key" },
+    };
+    const wrap = (name: string, key: string) => {
+      const t = memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key);
+      return {
+        ...t,
+        update: (k: any, patch: any) => {
+          if (name === "pull_requests" && Object.prototype.hasOwnProperty.call(patch, "process_key")) ops.push("process_key");
+          return t.update(k, patch);
+        },
+      };
+    };
+    // The adjudication reset is now the atomic bulk `DELETE` via `data.open().exec` (Copilot review of
+    // #806), so `memOpen(stores, ops)` records the `adjudication-delete` ordering token — the table
+    // `delete` gateway is no longer on the reset path.
+    const data = { table: withTrackingViews(wrap), open: () => memOpen(stores, ops) } as any;
+    const engine = { createInstance: () => Promise.resolve({ processInstanceKey: "PI-NEW" }) } as any;
+
+    await submitPr(data, engine, { repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", prKey: PR_KEY });
+
+    assertEquals(stores.pr_adjudications.rows.length, 0, "the re-submitted PR's adjudication is invalidated");
+    const pkIdx = ops.indexOf("process_key");
+    const delIdx = ops.indexOf("adjudication-delete");
+    assertEquals(pkIdx >= 0, true, "process_key is advanced on reopen");
+    assertEquals(delIdx >= 0, true, "adjudications are reset on reopen");
+    assertEquals(pkIdx < delIdx, true, "process_key is advanced BEFORE the adjudication memory is reset (the fence ordering)");
+  });
+});
+
+// Red/green regression (Copilot review): the durable adjudication RESET runs AFTER the new instance is
+// created and `process_key` is advanced. If the reset DELETE fails, the new convergence instance is
+// already live while the OLD adjudications remain — and because the new instance is ACTIVE the
+// `alreadyRunning` idempotency gate short-circuits every retry, so the reset is never re-run and the
+// fresh run replays STALE decisions forever. `submitPr` must instead ROLL THE NEW RUN BACK on a reset
+// failure: terminate the just-created instance (so nothing auto-applies stale memory) and rethrow, so
+// the submission is not treated as started and a retry re-creates a clean run.
+test("re-submit rolls back (cancels) the new instance when the adjudication reset fails (#806 review)", async () => {
+  await withGithubOff(async () => {
+    const PR_KEY = "owner/repo#42";
+    const stores: Record<string, { rows: any[]; key: string }> = {
+      pull_requests: {
+        rows: [{ pr_key: PR_KEY, repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", title: "t", status: "converged", process_key: "PI-OLD" }],
+        key: "pr_key",
+      },
+      escalations: { rows: [], key: "id" },
+      pr_adjudications: {
+        rows: [{ id: 1, pr_key: PR_KEY, question_fingerprint: "fp-a", answer: "prior A", adjudicated_by: "alice", adjudicated_kind: "human", adjudicated_at: "t" }],
+        key: "id",
+      },
+      pr_dependencies: { rows: [], key: "pr_key" },
+    };
+    // The reset DELETE throws (a transient DB failure), leaving the new instance live but the memory
+    // uncleared — the exact half-committed state the rollback guards against.
+    const failingOpen = () => ({
+      exec: async (sql: string) => {
+        if (/DELETE FROM "pr_adjudications" WHERE "pr_key" = \?/.test(sql)) throw new Error("boom: reset DELETE failed");
+        throw new Error(`unexpected exec sql: ${sql}`);
+      },
+    });
+    const data = { table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)), open: failingOpen } as any;
+    const cancelled: string[] = [];
+    const engine = {
+      createInstance: () => Promise.resolve({ processInstanceKey: "PI-NEW" }),
+      cancelInstance: (input: { processInstanceKey: string }) => {
+        cancelled.push(input.processInstanceKey);
+        return Promise.resolve();
+      },
+    } as any;
+
+    let threw = false;
+    try {
+      await submitPr(data, engine, { repo: "owner/repo", number: 42, url: "https://github.com/owner/repo/pull/42", prKey: PR_KEY });
+    } catch {
+      threw = true;
+    }
+    assertEquals(threw, true, "a failed reset propagates so the caller can retry");
+    assertEquals(cancelled, ["PI-NEW"], "the just-created instance is terminated (rolled back), never left live with stale memory");
+  });
+});
+
 // can hit an engine incident that parks the token; until `pollIncidents` nothing on the PR row
 // reflected it, so the grid kept showing "converging" while the run was dead in the water. This
 // drives the pass's reconciliation core against a stubbed `/v2/incidents/search`:
@@ -180,6 +428,7 @@ test("pollIncidents mirrors an ACTIVE incident onto the PR row, then clears it,
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -233,6 +482,7 @@ test("pollIncidents never queries a PR with no live instance and clears any stal
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -266,6 +516,7 @@ test("pollIncidents picks the oldest incident by creationTime, sorting a missing
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -305,6 +556,7 @@ test("submitPr stringifies a numeric processInstanceKey (contract: string | null
     };
     const data = {
       table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
     } as any;
     const engine = {
       // A large key delivered as a JS number — the exact case that breaks dev response validation
@@ -339,6 +591,7 @@ function captureConvergeOnly() {
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   let captured: unknown;
   const engine = {
@@ -391,6 +644,7 @@ function captureVars() {
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   let captured: Record<string, unknown> | undefined;
   const engine = {
@@ -429,6 +683,7 @@ function captureRoot() {
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
   let captured: unknown;
   const engine = {
@@ -795,6 +1050,7 @@ test("pollWaveGatesImpl is level-triggered: PRs merged before the token arrives
     };
     const data = {
       table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -884,6 +1140,7 @@ test("pollWaveGatesImpl never releases the barrier on an unverifiable subscripti
     };
     const data = {
       table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -988,6 +1245,7 @@ test("pollWaveGatesImpl releases the wave when a member PR is closed-unmerged an
     };
     const data = {
       table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -1044,6 +1302,7 @@ test("abandonClosedPr is idempotent — the terminal merges audit row is written
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
 
   await abandonClosedPr(data, "owner/repo#70", "closed without merging");
@@ -1072,6 +1331,7 @@ test("abandonClosedPr self-heals a missing pull_requests parent row before the F
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
 
   await abandonClosedPr(data, "owner/repo#71", "closed without merging");
@@ -1098,6 +1358,7 @@ test("abandonClosedPr rejects a malformed prKey with a clear error before any FK
   };
   const data = {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
 
   const err = await assertRejects(() => abandonClosedPr(data, "not-a-valid-pr-key", "closed without merging"));
@@ -1170,6 +1431,7 @@ function capsProbeExec(ready: boolean) {
 function capsDataLayer(stores: Record<string, { rows: any[]; key: string }>) {
   return {
     table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
   } as any;
 }
 

package/app/service.ts

@@ -9,7 +9,8 @@
 // `Table<T>` surface), not hand-written SQL. Row shapes are declared inline here.
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
-import { escalationFormId } from "./agentCompletion.ts";
+import { matchAdjudication, prAdjudications, resetAdjudications } from "./adjudications.ts";
+import { completeEscalationAutoApplied, escalationFormId } from "./agentCompletion.ts";
 import { agentSlaTimeout } from "./agentSla.ts";
 import {
   CAPS_RESOLVED_MESSAGE,
@@ -585,6 +586,14 @@ export async function submitPr(
     for (const e of await escs(data).find({ pr_key: parsed.prKey, status: "open" })) {
       await escs(data).update(e.id, { status: "stale" });
     }
+    // A fresh convergence run must ALSO start with a clean durable adjudication memory (issue #806,
+    // Copilot review): the auto-resume replays a prior `(PR, question)` answer forever, so a re-opened
+    // PR whose question recurs would silently auto-apply the stale decision and an operator could never
+    // force a fresh one. This PR's adjudications are invalidated on reopen — but the reset is deferred
+    // to AFTER `process_key` is advanced to the new instance (see below), NOT here: clearing the memory
+    // while `process_key` still names the OLD instance leaves a window where a delayed old-instance
+    // answer job still passes the worker's staleness gate and reinserts its adjudication into the fresh
+    // run (Copilot review of #806). Advancing the run identity FIRST, then clearing, fences that job.
     // Re-open a previously converged/abandoned/merged PR for a fresh convergence run.
     await table.update(parsed.prKey, {
       status: "converging",
@@ -682,8 +691,44 @@ export async function submitPr(
     },
   });
   const processKey = processInstanceKey == null ? null : String(processInstanceKey);
-  if (processKey != null) {
-    await table.update(parsed.prKey, { process_key: processKey });
+  // The `process_key` advance and the adjudication reset below are the two writes that MAKE the new
+  // run authoritative. If EITHER throws, the newly created instance is already live but the reopen is
+  // only half-committed — and a retry would short-circuit at the `alreadyRunning` idempotency gate
+  // (the new instance is ACTIVE, so `derived_status` is non-terminal), never re-running the reset. A
+  // failed reset would then leave the fresh run replaying STALE adjudication memory indefinitely
+  // (Copilot review). So roll the just-created run back on failure: terminate it and rethrow, so the
+  // submission is NOT treated as started. Terminating flips the PR's derived tracking status to a
+  // terminal edge (`abandoned`) via the `instanceTracking` reconciler, making the PR resubmittable so
+  // a retry re-creates a fresh instance and re-runs the reset cleanly — no orphaned run auto-applies
+  // stale decisions in the meantime.
+  try {
+    if (processKey != null) {
+      await table.update(parsed.prKey, { process_key: processKey });
+    }
+    // Invalidate this PR's durable adjudication memory for the fresh run (issue #806, Copilot review) —
+    // deferred to HERE, after `process_key` is advanced to the new instance above, so the reset happens
+    // UNDER the new run identity. On reopen (`existing`), any delayed old-instance answer job is now
+    // rejected by the worker's staleness gate (its `processInstanceKey` no longer matches the advanced
+    // `process_key`), so it cannot reinsert a stale adjudication after the reset; and the worker reads
+    // `process_key` as late as possible so it observes this advance. The insert-if-absent record then
+    // re-learns the operator's new answer for the new run. Runs unconditionally (even if `processKey` is
+    // null: the memory must still be clean for the fresh run). The wipe is a SINGLE atomic `DELETE`
+    // (`resetAdjudications`), never a row-by-row loop, so a crash mid-reset cannot leave a partially
+    // cleared memory (Copilot review of #806).
+    if (existing) {
+      await resetAdjudications(data, parsed.prKey);
+    }
+  } catch (err) {
+    if (processInstanceKey != null) {
+      try {
+        await engine.cancelInstance({ processInstanceKey: String(processInstanceKey) });
+      } catch (cancelErr) {
+        // Best-effort: a failed rollback-cancel leaves the instance for the abandon/reconcile poller
+        // to reap, but must not mask the original error that the caller needs to see and retry on.
+        console.warn(`[submit] ${parsed.prKey} rollback-cancel of ${processInstanceKey} failed: ${cancelErr}`);
+      }
+    }
+    throw err;
   }
   return { prKey: parsed.prKey, processKey };
 }
@@ -2839,12 +2884,67 @@ export async function pollUserTasks(
   // Desired set, deduped by completable key (a task is open at most once; guard a page overlap / a
   // subject seen under two statuses mid-pass).
   const desiredByKey = new Map<string, UserTaskRow>();
+  // Keys auto-resumed from a durable adjudication this pass (issue #806). The reduced-capability scan
+  // visits each instance twice (direct + callActivity hierarchy), and both queries snapshot the task
+  // BEFORE the resume removes it, so the second visit would otherwise re-attempt a now-gone completion
+  // and fall through to projecting the very row we just retired. Recording the key keeps the resume
+  // one-shot and out of the inbox.
+  const resumedByKey = new Set<string>();
   const project = async (elementId: string | undefined, userTaskKey: string, processInstanceKey: string, rootProcessInstanceKey: string, formKey: string) => {
     if (!elementId) return;
     const rowKey = userTaskKey.trim();
-    if (!rowKey || desiredByKey.has(rowKey)) return;
+    if (!rowKey || desiredByKey.has(rowKey) || resumedByKey.has(rowKey)) return;
     const ctx = await contextFor(elementId, userTaskKey, processInstanceKey, rootProcessInstanceKey, formKey);
     if (!ctx) return;
+    // Durable adjudication auto-resume (issue #806): before surfacing a NEW convergence `wait-answer`
+    // to a human, check whether THIS PR already has a settled adjudication for the SAME question
+    // (canonical `questionFingerprint`). If it does, resume the loop with the recorded answer through
+    // the canonical `completeUserTaskAttributed` door — attributed to the prior adjudicator and marked
+    // `auto_applied` (a machine replay, reversible so a human can still override) so it is never
+    // laundered into a first-hand irreversible human authority (Copilot review of #806) — instead of
+    // re-parking a human on an already-answered question (PR #800 / proc 46310: the same design
+    // question escalated at round 2 and again at round 13). Scoped to the review loop's `wait-answer`
+    // on a real PR key; on any resolution failure the task still projects, so an un-resumable question
+    // always reaches a human (fail-open to the human).
+    if (elementId === PR_WAIT_ANSWER_ELEMENT && ctx.subjectType === "pr" && ctx.question && parsePr(ctx.subjectKey)) {
+      try {
+        // The adjudication LOOKUP lives inside this fail-open `try` (not just the resume) so a transient
+        // `pr_adjudications.find` error never rejects `project` and aborts `pollUserTasks` mid-pass — the
+        // task still projects and the question always reaches a human (SPEC: adjudication-resolution
+        // failures fail open to the human).
+        const adjudication = matchAdjudication(await prAdjudications(data).find({ pr_key: ctx.subjectKey }), ctx.question);
+        // Only auto-resume when the prior adjudicator's provenance is KNOWN. A settled row with a blank
+        // `adjudicated_by` (completed out of band, so `latestAdjudicator` returned no actor) must NOT be
+        // manufactured into a synthetic `human` actor — that would audit an unknown-provenance replay as
+        // a first-hand human decision. Fail open to a fresh human task instead (Copilot review of #806).
+        const adjudicatedBy = adjudication?.adjudicated_by?.trim();
+        if (adjudication && adjudicatedBy) {
+          const resumed = await completeEscalationAutoApplied(data, engine, {
+            userTaskKey: rowKey,
+            // The sweep already discovered this task's owning instance — hand it to the resolve so the
+            // auto-apply scans that ONE instance, not every open user task engine-wide (issue #806
+            // Copilot review: an unfiltered per-task scan makes a single poll pass O(N²) across N
+            // already-adjudicated PRs). `contextFor`/the sweep report the task's direct instance, so the
+            // filtered scan finds exactly this task; a miss still fails open to the human.
+            processInstanceKey,
+            variables: { answer: adjudication.answer },
+            actor: {
+              kind: adjudication.adjudicated_kind === "agent" ? "agent" : "human",
+              id: adjudicatedBy,
+            },
+            // Link the auto-apply back to the replayed adjudication (issue #806) so a human revert of the
+            // resulting completion invalidates this exact decision instead of it being silently re-applied.
+            adjudicationId: adjudication.id,
+          });
+          if (resumed.ok) {
+            resumedByKey.add(rowKey);
+            return;
+          }
+        }
+      } catch (err) {
+        console.error(`[poller] adjudication auto-resume (${ctx.subjectKey}): ${err}`);
+      }
+    }
     const row = buildUserTaskRow(ctx, at);
     if (row) desiredByKey.set(rowKey, row);
   };

package/app/terminalReaderBehaviour.test.ts

@@ -51,6 +51,27 @@ function memData(stores: Stores) {
   return {
     table: withTrackingViews((name: string, key: string) =>
       memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    // Emulates the atomic bulk `DELETE FROM "pr_adjudications" WHERE "pr_key" = ?` submitPr issues via
+    // `data.open().exec` to reset a reopened PR's adjudication memory (Copilot review of #806). The SQL
+    // is validated against real SQLite in app/adjudications.test.ts; here it need only mutate the store.
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        if (/DELETE FROM "pr_adjudications" WHERE "pr_key" = \?/.test(sql)) {
+          const store = stores.pr_adjudications;
+          let changed = 0;
+          if (store) {
+            for (let i = store.rows.length - 1; i >= 0; i--) {
+              if (store.rows[i].pr_key === params[0]) {
+                store.rows.splice(i, 1);
+                changed++;
+              }
+            }
+          }
+          return { changed };
+        }
+        throw new Error(`unexpected exec sql: ${sql}`);
+      },
+    }),
   } as any;
 }
 

package/db/migrations/109_pr_adjudications.sql

@@ -0,0 +1,61 @@
+-- 109_pr_adjudications.sql — issue #806: persist wait-answer human adjudications so an
+-- already-answered convergence question does not re-escalate.
+--
+-- The convergence loop's `wait-answer` escalation (`record-answer` → resume) applies a human's
+-- answer to the CURRENT round but keeps NO durable memory that "(this PR, this question) was already
+-- adjudicated to X". A stateless later round that re-derives the identical escalation condition
+-- re-parks a human from scratch (PR #800 / proc 46310: the same design question escalated at round 2
+-- and again at round 13, both answered identically). A human adjudication is NOT GitHub-derivable —
+-- it is a fact the app itself must remember — so it lives here, durably.
+--
+-- One row per (PR, question) a human has settled: `pr.answer-escalation` (record-answer) writes it on
+-- answering, and the poller (`pollUserTasks`) reads it before surfacing a NEW `wait-answer` — when the
+-- question's fingerprint matches an existing row it auto-resumes with the recorded answer (attributed
+-- to the prior adjudicator) instead of re-escalating a human.
+--
+--   • question_fingerprint — the canonical `normalizeAdvisoryText` + `fingerprint` digest of the
+--     escalation question (app/github.ts `questionFingerprint`), the SAME line-stable normalisation
+--     advisory acks use; so only a byte/semantic-identical, already-answered question is suppressed
+--     while a materially different question still escalates. No second fingerprint implementation.
+--   • answer / adjudicated_by / adjudicated_kind / adjudicated_at — the settled answer, who settled it,
+--     whether they were a `human` or an `agent` (ADR 0046), and when, so the auto-resume replays the
+--     exact decision AND preserves the original attribution kind — a human-settled decision replays as
+--     human, an agent-settled one as agent, so an auto-apply can never launder an agent decision into an
+--     irreversible human authority (Copilot review of #806).
+--   • invalidated_at — a TOMBSTONE set when a human REVERTS the auto-applied completion that replayed
+--     this decision (`revertAgentCompletion` → `invalidateAdjudication`, Copilot review of #806). A plain
+--     DELETE is NOT race-safe: the reverted completion's `record-answer` job can be redelivered
+--     (at-least-once) AFTER the delete and re-insert the SAME `(pr_key, question_fingerprint)`, so the
+--     next poller pass re-auto-applies and silently undoes the revert. Keeping the row as a tombstone lets
+--     the `UNIQUE (pr_key, question_fingerprint)` fence make that redelivered re-insert a no-op, and
+--     `matchAdjudication` skips a tombstoned row so it never auto-applies again. The tombstone is cleared
+--     only by `resetAdjudications` on a fresh-run re-submit. NULL for a live, replayable decision.
+--   • source_completion_id — the `task_completions.id` of the WINNING completion that produced this
+--     decision (issue #806 review). A FIRST-HAND agent answer to a `wait-answer` records its own durable
+--     adjudication (`adjudicated_kind="agent"`) but — unlike a machine auto-apply — its ledger row has
+--     `auto_applied=0` and NO `source_adjudication_id`, so a human revert of that reversible agent
+--     completion could not previously find and tombstone the decision it created, and the poller would
+--     re-auto-apply the reverted answer. Linking every convergence adjudication to its winning completion
+--     lets `revertAgentCompletion` invalidate the decision on ANY reversible agent revert, not only a
+--     machine replay (`invalidateAdjudicationByCompletion`). INSERT-if-absent, so only the ORIGINAL
+--     first-hand completion is recorded; a later auto-apply's re-record is a UNIQUE no-op that leaves the
+--     link pointing at the first-hand winner. NULL for a legacy/uncorrelated answer.
+--
+-- `UNIQUE (pr_key, question_fingerprint)` keeps one settled answer per (PR, question); the surrogate
+-- `id` PK gives the `Table<T>` gateway a single-column key. Forward-only, additive (expand). Numbered
+-- after the current highest committed prefix (104) in the pre-assigned 109–110 block (#806); the
+-- runner wraps each file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+CREATE TABLE IF NOT EXISTS pr_adjudications (
+  id                   INTEGER PRIMARY KEY AUTOINCREMENT,
+  pr_key               TEXT NOT NULL REFERENCES pull_requests(pr_key),
+  question_fingerprint TEXT NOT NULL,
+  answer               TEXT,
+  adjudicated_by       TEXT,
+  adjudicated_kind     TEXT,
+  adjudicated_at       TEXT NOT NULL,
+  invalidated_at       TEXT,
+  source_completion_id INTEGER,
+  UNIQUE (pr_key, question_fingerprint)
+);
+CREATE INDEX IF NOT EXISTS idx_pradj_pr ON pr_adjudications(pr_key);
+CREATE INDEX IF NOT EXISTS idx_pradj_srccompletion ON pr_adjudications(source_completion_id);