@nanobpm/nano-workforce 0.205.0 → 0.205.2

package/resources/processes/merge-loop.bpmn

@@ -53,11 +53,15 @@
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
           <nano:extend name="failingChecksList" type="string" optional="true" />
+          <nano:extend name="reviewThreads" type="integer" optional="true" />
+          <nano:extend name="pendingChecks" type="integer" optional="true" />
         </nano:shape>
         <nano:shape id="MergeReady" name="merge-ready message payload">
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
           <nano:extend name="failingChecksList" type="string" optional="true" />
+          <nano:extend name="reviewThreads" type="integer" optional="true" />
+          <nano:extend name="pendingChecks" type="integer" optional="true" />
         </nano:shape>
         <nano:shape id="FixCiIn" name="CI fix — input">
           <nano:extend name="prKey" type="string" />
@@ -179,6 +183,7 @@
       <bpmn:outgoing>f_m_mRebase</bpmn:outgoing>
       <bpmn:outgoing>f_m_mWaiting</bpmn:outgoing>
       <bpmn:outgoing>f_m_mDraft</bpmn:outgoing>
+      <bpmn:outgoing>f_m_mThreads</bpmn:outgoing>
       <bpmn:outgoing>f_m_mBlocked</bpmn:outgoing>
     </bpmn:exclusiveGateway>
     <bpmn:serviceTask id="attempt-merge" name="Merge PR">
@@ -258,7 +263,7 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=&#34;blocked&#34;" target="status" />
-          <zeebe:input source="=if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
+          <zeebe:input source="=if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads = 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with all checks green (none failing, none pending) and every review thread resolved. GitHub still reports BLOCKED, which means a required review approval (or code-owner review) is outstanding — nothing the automated loop can produce. Approve the PR (or adjust the branch-protection review requirement), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing or checks still pending after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_mDraft</bpmn:incoming>
@@ -277,7 +282,7 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=status" target="agentVerdict" />
-          <zeebe:input source="=&#34;This PR cannot be merged and needs a human decision. &#34; + (if mergeState = &#34;conflict&#34; then &#34;The automated rebase agent could not resolve the merge conflicts on this branch. Resolve them manually (or reply with guidance), then reply to retry.&#34; else if mergeStatus = &#34;retry&#34; then &#34;The merge kept losing a race with concurrent updates to the base branch and exhausted its automatic retry budget (&#34; + string(mergeRetryMax) + &#34; retries). This is a repeated transient race, not a conflict, failing check, or permissions block. Reply to retry, or investigate why the base branch keeps moving.&#34; else if mergeState = &#34;ready&#34; then &#34;The merge attempt did not land (merge result: &#34; + mergeStatus + &#34;). Investigate why GitHub refused the merge, then reply to retry.&#34; else if status = &#34;blocked&#34; then &#34;The automated CI-fix agent could not make the required checks green. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else &#34;The automated CI-fix agent exceeded its time budget (SLA) before the required checks went green. Check its progress or intervene, then reply to retry.&#34;)" target="question" />
+          <zeebe:input source="=&#34;This PR cannot be merged and needs a human decision. &#34; + (if mergeState = &#34;conflict&#34; then &#34;The automated rebase agent could not resolve the merge conflicts on this branch. Resolve them manually (or reply with guidance), then reply to retry.&#34; else if mergeStatus = &#34;retry&#34; then &#34;The merge kept losing a race with concurrent updates to the base branch and exhausted its automatic retry budget (&#34; + string(mergeRetryMax) + &#34; retries). This is a repeated transient race, not a conflict, failing check, or permissions block. Reply to retry, or investigate why the base branch keeps moving.&#34; else if mergeState = &#34;ready&#34; and mergeStatus = &#34;blocked&#34; and question != null then question else if mergeState = &#34;ready&#34; then &#34;The merge attempt did not land (merge result: &#34; + mergeStatus + &#34;). Investigate why GitHub refused the merge, then reply to retry.&#34; else if status = &#34;blocked&#34; then &#34;The automated CI-fix agent could not make the required checks green. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else &#34;The automated CI-fix agent exceeded its time budget (SLA) before the required checks went green. Check its progress or intervene, then reply to retry.&#34;)" target="question" />
           <zeebe:input source="=&#34;blocked&#34;" target="status" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
@@ -287,9 +292,26 @@
       <bpmn:incoming>f_mr_giveup</bpmn:incoming>
       <bpmn:outgoing>f_m_escA</bpmn:outgoing>
     </bpmn:serviceTask>
+    <bpmn:serviceTask id="merge-esc-threads" name="Escalate: unresolved review threads">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.persist-escalation" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="EscalationIn" />
+          <zeebe:property name="io.nanobpm.dataEnvelope.out" value="EscalationOut" />
+        </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:input source="=&#34;blocked&#34;" target="status" />
+          <zeebe:input source="=&#34;This PR is merge-blocked by &#34; + string(reviewThreads) + &#34; unresolved review thread(s) (branch protection requires every conversation resolved; all checks are green and there is no conflict). These are review findings the loop already converged, so a fresh review round cannot clear them without a reply. Resolve the threads on the PR (or reply with guidance — e.g. which threads to push back on), then reply to retry.&#34;" target="question" />
+          <zeebe:input source="=null" target="agentSlaJobType" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_m_mThreads</bpmn:incoming>
+      <bpmn:outgoing>f_m_escT</bpmn:outgoing>
+    </bpmn:serviceTask>
     <bpmn:exclusiveGateway id="gw-merge-escalated" name="escalation opened?" default="f_m_escReenter">
       <bpmn:incoming>f_m_escA</bpmn:incoming>
       <bpmn:incoming>f_m_escLanded</bpmn:incoming>
+      <bpmn:incoming>f_m_escT</bpmn:incoming>
       <bpmn:outgoing>f_m_escWait</bpmn:outgoing>
       <bpmn:outgoing>f_m_escReenter</bpmn:outgoing>
     </bpmn:exclusiveGateway>
@@ -732,6 +754,9 @@
     <bpmn:sequenceFlow id="f_m_mDraft" name="draft — mark ready (human)" sourceRef="gw-mergeable" targetRef="merge-esc-conflict">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=mergeState = "draft"</bpmn:conditionExpression>
     </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_m_mThreads" name="blocked (unresolved review threads)" sourceRef="gw-mergeable" targetRef="merge-esc-threads">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=mergeState = "review-threads"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
     <bpmn:sequenceFlow id="f_mrp_probe" sourceRef="wait-mergeable-repoll" targetRef="merge-stall-probe" />
     <bpmn:sequenceFlow id="f_m_mBlocked" name="unclassified — auto-rebase" sourceRef="gw-mergeable" targetRef="gw-rebase" />
     <bpmn:sequenceFlow id="f_ci_go" name="within budget" sourceRef="gw-ci-fix" targetRef="SP_cifix">
@@ -773,6 +798,7 @@
     <bpmn:sequenceFlow id="f_m_done" sourceRef="mark-merged" targetRef="MergeEnd" />
     <bpmn:sequenceFlow id="f_m_escC" sourceRef="merge-esc-conflict" targetRef="wait-merge-answer" />
     <bpmn:sequenceFlow id="f_m_escA" sourceRef="merge-esc-attempt" targetRef="gw-merge-escalated" />
+    <bpmn:sequenceFlow id="f_m_escT" sourceRef="merge-esc-threads" targetRef="gw-merge-escalated" />
     <bpmn:sequenceFlow id="f_m_escWait" sourceRef="gw-merge-escalated" targetRef="wait-merge-answer">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=escalated = true</bpmn:conditionExpression>
     </bpmn:sequenceFlow>
@@ -833,7 +859,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-stall" bpmnElement="gw-merge-stall" isMarkerVisible="true">
         <dc:Bounds x="1538" y="1535" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1521" y="1650" width="85" height="42" />
+          <dc:Bounds x="1521" y="1630" width="85" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-mergeable" bpmnElement="gw-mergeable" isMarkerVisible="true">
@@ -902,6 +928,9 @@
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-attempt" bpmnElement="merge-esc-attempt">
         <dc:Bounds x="1688" y="720" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_merge-esc-threads" bpmnElement="merge-esc-threads">
+        <dc:Bounds x="1138" y="1680" width="100" height="80" />
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-escalated" bpmnElement="gw-merge-escalated" isMarkerVisible="true">
         <dc:Bounds x="2088" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
@@ -1002,7 +1031,7 @@
         <di:waypoint x="402" y="1300" />
         <di:waypoint x="402" y="320" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="446" y="1239" width="88" height="56" />
+          <dc:Bounds x="919" y="1239" width="88" height="56" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_reb_rearm" bpmnElement="f_reb_rearm">
@@ -1179,6 +1208,14 @@
           <dc:Bounds x="1057" y="483" width="85" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_mThreads" bpmnElement="f_m_mThreads">
+        <di:waypoint x="1013" y="305" />
+        <di:waypoint x="1013" y="1720" />
+        <di:waypoint x="1138" y="1720" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1018" y="1642" width="81" height="56" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_mBlocked" bpmnElement="f_m_mBlocked">
         <di:waypoint x="1013" y="305" />
         <di:waypoint x="1013" y="440" />
@@ -1255,7 +1292,7 @@
         <di:waypoint x="1668" y="740" />
         <di:waypoint x="1688" y="740" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1952" y="616" width="53" height="14" />
+          <dc:Bounds x="1932" y="616" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gAbandoned" bpmnElement="f_m_gAbandoned">
@@ -1281,8 +1318,9 @@
         <di:waypoint x="870" y="618" />
         <di:waypoint x="870" y="638" />
         <di:waypoint x="888" y="638" />
-        <di:waypoint x="888" y="1598" />
-        <di:waypoint x="1338" y="1598" />
+        <di:waypoint x="888" y="1780" />
+        <di:waypoint x="1388" y="1780" />
+        <di:waypoint x="1388" y="1600" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_msp_gate" bpmnElement="f_msp_gate">
         <di:waypoint x="1438" y="1560" />
@@ -1308,6 +1346,14 @@
         <di:waypoint x="1988" y="120" />
         <di:waypoint x="2088" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escT" bpmnElement="f_m_escT">
+        <di:waypoint x="1238" y="1720" />
+        <di:waypoint x="2008" y="1720" />
+        <di:waypoint x="2008" y="145" />
+        <di:waypoint x="2068" y="145" />
+        <di:waypoint x="2068" y="120" />
+        <di:waypoint x="2088" y="120" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escWait" bpmnElement="f_m_escWait">
         <di:waypoint x="2138" y="120" />
         <di:waypoint x="2238" y="120" />
@@ -1327,13 +1373,13 @@
         <di:waypoint x="1013" y="1620" />
         <di:waypoint x="1013" y="305" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1446" y="1587" width="85" height="28" />
+          <dc:Bounds x="1246" y="1587" width="85" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_dep_rewait" bpmnElement="f_dep_rewait">
         <di:waypoint x="1738" y="1280" />
-        <di:waypoint x="1738" y="1640" />
-        <di:waypoint x="234" y="1640" />
+        <di:waypoint x="1738" y="1300" />
+        <di:waypoint x="234" y="1300" />
         <di:waypoint x="234" y="298" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_go" bpmnElement="f_mr_go">

package/workers/converge-gate/worker.ts

@@ -29,6 +29,15 @@
 // re-enters the review wait for a fresh review of the current HEAD. The head read fails OPEN, so a
 // transport hiccup can never fabricate a stale verdict.
 //
+// MISSING-REVIEW GUARD (issue #923): the same `reviewStale` signal fires when NO Copilot review
+// exists at all — the gate's single most important precondition. The old code treated
+// `{ body: "", commitId: null }` as "a verified clean review" and converged, merging
+// nano-bpm#1443 with ZERO reviews. A missing review now fails CLOSED into the re-solicit path.
+//
+// VERDICT GATE (issue #923 §2): even a head-current review BLOCKS when its own summary reports
+// open, actionable findings ("Changes recommended" / "N open issue(s)" / a v2 "Open (N)" section)
+// — zero unresolved threads is not a clean verdict.
+//
 // Scope integrity is NO LONGER judged here. A deterministic regex over the PR description could not
 // read the closed issue's acceptance criteria, so it false-positived on any body that merely
 // *mentioned* deferral (an ADR non-goal, a PR whose subject is scope tooling) and forced needless
@@ -49,10 +58,11 @@ import {
   fetchReviewThreads,
   isAckThread,
   parseAckedAdvisories,
+  parseReviewOpenFindings,
   parseSuppressedAdvisories,
   type ReviewThread,
 } from "../../app/github.ts";
-import { isReviewStale } from "../../app/reviewWait.ts";
+import { isReviewMissingOrStale } from "../../app/reviewWait.ts";
 import { parsePr } from "../../app/service.ts";
 import type { WorkerInputs, WorkerOutputs } from "../../nano-generated/worker-io.d.ts";
 import { type HeadReader, makeDefaultReadHead } from "../progress-check/worker.ts";
@@ -118,17 +128,57 @@ export function makeHandler(deps: {
       if (review === null) {
         return { convergeBlocked: true, convergeBlockReason: BLOCK_UNVERIFIABLE, convergeAckOnly: false, reviewStale: false };
       }
-      // STALE-REVIEW GUARD (issue #799). When the PR HEAD has advanced PAST the commit the latest
-      // Copilot review was submitted against, that review's suppressed advisories describe code the
-      // head has moved past — e.g. an advisory the agent already FIXED IN CODE (but did not ack) is
-      // still re-listed in the obsolete body. Blocking/escalating on it re-escalates a human
-      // indefinitely (PR #789). Instead of gating on the stale body, signal `reviewStale` so the
-      // process re-enters the review wait and the poller re-solicits a fresh review of the current
-      // HEAD to gate on. The head read fails OPEN (null → not stale), so a transport hiccup can never
-      // fabricate a stale verdict; the ordinary gate below still runs on a HEAD-current review.
+      // STALE-OR-MISSING-REVIEW GUARD (issues #799 / #923). Convergence requires a HEAD-CURRENT
+      // reviewer verdict. Two states fail that precondition and must route to the review wait (the
+      // poller (re-)solicits a review of the current HEAD) rather than be gated on:
+      //   • STALE (#799): the PR HEAD has advanced PAST the commit the latest Copilot review was
+      //     submitted against — its suppressed advisories describe code the head has moved past
+      //     (e.g. an advisory the agent already FIXED IN CODE but did not ack), so blocking on the
+      //     obsolete body re-escalates a human indefinitely (PR #789).
+      //   • MISSING (#923): NO Copilot review exists at all (`commitId: null` with a readable
+      //     head). The old gate treated that as "a verified clean review" — zero threads, zero
+      //     advisories → not blocked — and merged nano-bpm#1443 with ZERO reviews. A missing
+      //     review is the gate's single most important precondition, so it fails CLOSED into the
+      //     same re-solicit path (`isReviewMissingOrStale`), never through to finalize.
+      // The head read still fails OPEN (null → not stale): without the head we can prove nothing,
+      // so a transport hiccup can never fabricate a stale/missing verdict that would loop the loop
+      // re-soliciting forever — the review-wait timeout remains the backstop.
+      //
+      // ARRIVAL-WINDOW CUTOFF (issue #923 review, "previously missed"): the stale/missing verdict
+      // is decided from the review read ABOVE — but the loop only PARKS for the next review several
+      // tasks later (persist-round → check-progress), and check-progress stamps `waiting_since` at
+      // THAT (later) park time. A head-current review that lands in the window BETWEEN this read
+      // and the park would then be REJECTED by `pollReviews` (it filters
+      // `submitted_at >= waiting_since`), so the loop re-solicits and can time out despite a valid
+      // verdict already sitting unconsumed on the PR. Emit the time of THIS read as
+      // `reviewWaitCutoff` so check-progress can park with `waiting_since` at the cutoff — any
+      // review that arrived in the window then satisfies the wait instead of being discarded.
       const headSha = await readHeadSha(ghRepo, ghNumber).catch(() => null);
-      if (isReviewStale(review.commitId, headSha)) {
-        return { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false, reviewStale: true };
+      if (isReviewMissingOrStale(review.commitId, headSha)) {
+        return {
+          convergeBlocked: false,
+          convergeBlockReason: "",
+          convergeAckOnly: false,
+          reviewStale: true,
+          reviewWaitCutoff: new Date().toISOString(),
+        };
+      }
+      // VERDICT GATE (issue #923 §2): a head-current review whose OWN summary reports open,
+      // actionable findings (Copilot's "Changes recommended" / "N open issue(s)" / a v2 "Open (N)"
+      // section) blocks the same way an unresolved thread does — even with zero unresolved threads
+      // (a review can carry findings as summary-only, as #1443's 7-finding review did). This block
+      // is NOT ack-only: the findings need the round agent's code/reply work, so it escalates to a
+      // human rather than entering the bounded auto-ack path.
+      const openFindings = parseReviewOpenFindings(review.body);
+      if (openFindings.length > 0) {
+        return {
+          convergeBlocked: true,
+          convergeBlockReason:
+            `Convergence blocked: the latest head-current Copilot review reports ${openFindings.join("; ")}. ` +
+            `Address every finding the review raised (or reply-and-resolve why each is a false positive) before converging.`,
+          convergeAckOnly: false,
+          reviewStale: false,
+        };
       }
       // Split the unresolved threads into SUBSTANTIVE reviewer findings vs partially-completed
       // `nano-ack:` ACK threads (root carries a canonical `nano-ack: <path> :: <text>` marker — see

package/workers/merge/worker.test.ts

@@ -8,7 +8,7 @@ import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import { _clearMergeProtocolCache } from "../../app/mergeProtocol.ts";
 import { noopLog } from "../../test/log.ts";
-import handler from "./worker.ts";
+import handler, { makeHandler } from "./worker.ts";
 
 function fakeApp() {
   const stores: Record<string, Record<string, unknown>[]> = {
@@ -294,3 +294,194 @@ test("pr.merge abandons a closed-not-merged PR without escalating (terminal aban
     },
   );
 });
+
+// ── Merge-loop backstop (issue #923 §3) ──────────────────────────────────────
+// Just before landing, the worker re-checks that a HEAD-CURRENT Copilot review exists. A head that
+// moved between convergence and landing — or a review that never existed (the nano-bpm#1443
+// fail-open: merged with ZERO reviews) — must block the landing, not slip through. These tests
+// drive the backstop through `makeHandler`'s injected readers; the fetch stub only needs the
+// single-PR GET (liveness) since the injected readers replace the review/head fetches.
+
+function backstopRoutes(url: string): Response | null {
+  if (/\/pulls\/\d+$/.test(url)) {
+    return new Response(JSON.stringify({ merged: false, mergeable_state: "clean" }));
+  }
+  return null; // no AGENTS.md / merge-protocol.json → DEFAULT gh-merge protocol
+}
+
+test("pr.merge #923: refuses to land when NO Copilot review exists (the #1443 fail-open)", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      // Verified "no Copilot review on this PR" + a readable head → missing → BLOCK.
+      readReview: async () => ({ body: "", commitId: null }),
+      readHeadSha: async () => "headsha4444444444444444444444444444444444",
+    });
+    const out = (await backstop(
+      { variables: { prKey: "acme/widgets#21", repo: "acme/widgets", prNumber: 21 } } as any,
+      app,
+    )) as Record<string, unknown>;
+
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals(out.status, "blocked");
+    assertEquals(typeof out.question, "string");
+    assertEquals((out.question as string).includes("no head-current Copilot review"), true);
+
+    // The refusal is audited, and NO land was attempted (no merge PUT, no enqueue comment).
+    assertEquals(stores.merges.length, 1);
+    assertEquals(stores.merges[0].outcome, "blocked");
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+    assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+  });
+});
+
+test("pr.merge #923: refuses to land when the head MOVED past the latest review (stale at land time)", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      // The review was submitted against the OLD head; the branch has since advanced.
+      readReview: async () => ({ body: "lgtm", commitId: "oldsha1111111111111111111111111111111111" }),
+      readHeadSha: async () => "newsha2222222222222222222222222222222222",
+    });
+    const out = (await backstop(
+      { variables: { prKey: "acme/widgets#23", repo: "acme/widgets", prNumber: 23 } } as any,
+      app,
+    )) as Record<string, unknown>;
+
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+  });
+});
+
+test("pr.merge #923: a HEAD-CURRENT review lands normally (backstop control)", async () => {
+  await withGithub(
+    (url) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "lgtm", commitId: "samesha33333333333333333333333333333333" }),
+        readHeadSha: async () => "samesha33333333333333333333333333333333",
+      });
+      const out = (await backstop(
+        { variables: { prKey: "acme/widgets#25", repo: "acme/widgets", prNumber: 25 } } as any,
+        app,
+      )) as Record<string, unknown>;
+
+      // The backstop passes and the ordinary land protocol runs (direct merge).
+      assertEquals(out, { mergeStatus: "merged" });
+      assertEquals(
+        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
+        true,
+      );
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    },
+  );
+});
+
+test("pr.merge #923: an UNREADABLE review/head fails OPEN (a transport hiccup never wedges a merge)", async () => {
+  await withGithub(
+    (url) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => null, // no usable transport → unverifiable, NOT "no review"
+        readHeadSha: async () => {
+          throw new Error("boom");
+        },
+      });
+      const out = (await backstop(
+        { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
+        app,
+      )) as Record<string, unknown>;
+
+      assertEquals(out, { mergeStatus: "merged" });
+      assertEquals(
+        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
+        true,
+      );
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    },
+  );
+});
+
+test("pr.merge #923: a head-current review whose summary reports OPEN findings blocks landing", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "h1" }),
+      readHeadSha: async () => "h1",
+    });
+    const out = (await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app)) as Record<string, unknown>;
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals((out.question as string).includes("open findings"), true);
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+  });
+});
+
+for (const [label, readHeadSha] of [
+  ["returns null", async () => null],
+  ["throws", async () => { throw new Error("transient"); }],
+] as const) {
+  test(`pr.merge #923: an unverifiable head (read ${label}) never blocks on a possibly-stale review's open findings`, async () => {
+    await withGithub(backstopRoutes, async () => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "old" }),
+        readHeadSha,
+      });
+      await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app);
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    });
+  });
+}
+
+test("pr.merge #923: the direct merge pins the verified head SHA (no check-then-merge race)", async () => {
+  let putBody = "";
+  await withGithub(
+    (url, init) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) {
+        putBody = String(init?.body ?? "");
+        return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      }
+      return backstopRoutes(url);
+    },
+    async () => {
+      const { app } = fakeApp();
+      const backstop = makeHandler({ readReview: async () => ({ body: "lgtm", commitId: "h2" }), readHeadSha: async () => "h2" });
+      await backstop({ variables: { prKey: "acme/widgets#31", repo: "acme/widgets", prNumber: 31 } } as any, app);
+      assertEquals(JSON.parse(putBody).sha, "h2");
+    },
+  );
+});
+
+test("pr.merge #923: a queue-comment repo whose head moved after the backstop retries instead of enqueueing", async () => {
+  const protocol =
+    "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+  await withGithub(
+    (url) => {
+      if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+      if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app } = fakeApp();
+      const heads = ["h3", "h4"];
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "lgtm", commitId: "h3" }),
+        readHeadSha: async () => heads.shift() ?? "h4",
+      });
+      const out = (await backstop({ variables: { prKey: "acme/widgets#33", repo: "acme/widgets", prNumber: 33 } } as any, app)) as Record<string, unknown>;
+      assertEquals(out.mergeStatus, "retry");
+      assertEquals(calls.some((c) => /\/issues\/\d+\/comments$/.test(c.url) && c.method === "POST"), false);
+    },
+  );
+});