@nanobpm/nano-workforce 0.205.1 → 0.205.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.205.2](https://github.com/nanobpm/nano-workforce/compare/v0.205.1...v0.205.2) (2026-11-08)
+
+### Bug Fixes
+
+* **convergence:** fail closed when no head-current Copilot review exists ([#924](https://github.com/nanobpm/nano-workforce/issues/924)) ([e0ded57](https://github.com/nanobpm/nano-workforce/commit/e0ded57e0888755fa6fd77495f3361e8dafc0980)), closes [#923](https://github.com/nanobpm/nano-workforce/issues/923) [nano-bpm#1443](https://github.com/nanobpm/nano-bpm/issues/1443) [#923](https://github.com/nanobpm/nano-workforce/issues/923) [#923](https://github.com/nanobpm/nano-workforce/issues/923) [#923](https://github.com/nanobpm/nano-workforce/issues/923) [#923](https://github.com/nanobpm/nano-workforce/issues/923)
+
 ## [0.205.1](https://github.com/nanobpm/nano-workforce/compare/v0.205.0...v0.205.1) (2026-11-06)
 
 ### Bug Fixes

package/app/convergeAdversarial.test.ts

@@ -292,3 +292,57 @@ test("the pass budget resets when the next review lands (new round)", async () =
   // Round 2 gets its own full budget of 1 pass.
   assert(completions(engine, "adversarial-review") === 2, `round 2 must get a fresh pass: ${runs(engine)}`);
 });
+
+// Issue #923 §4 (behavioural, not substring): a `converged` agent verdict with NO head-current review
+// makes the converge-gate report `reviewStale`; the loop must record the round as `review-stale`
+// (not the agent's self-reported `converged`) and park for a fresh review — never reaching
+// `persist-converged`.
+test("#923: a stale converge-gate verdict persists the round as review-stale and parks without converging", async () => {
+  const { engine, seen } = await boot({
+    responses: {
+      "senior:pr-review": [{ status: "converged", summary: "done" }, { status: "waiting", summary: "awaiting" }],
+      "pr.converge-gate": {
+        convergeBlocked: false,
+        convergeBlockReason: "",
+        convergeAckOnly: false,
+        reviewStale: true,
+      },
+    },
+    vars: { advMax: 0 },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  assert(completions(engine, "persist-converged") === 0, `must not converge on a stale review: ${runs(engine)}`);
+  const recorded = seen["pr.persist-round"][0];
+  assert(recorded?.status === "review-stale", `persist-round status: ${JSON.stringify(recorded?.status)}`);
+  assert(completions(engine, "wait-review") === 0, "must be parked waiting for a fresh review");
+});
+
+// Issue #923 review ("previously missed", behavioural): the arrival-window cutoff the converge-gate
+// emits on a stale verdict must PROPAGATE through the process to the check-progress park — the
+// variable crosses persist-round untouched, so check-progress can stamp `waiting_since` at the
+// gate's read time (not the later park time) and a head-current review landing in the read→park
+// window still satisfies the wait. This is the process-level wiring the worker unit tests cannot
+// see (each worker is tested in isolation with an injected variable).
+test("#923 review: the converge-gate's reviewWaitCutoff reaches check-progress on a stale verdict", async () => {
+  const CUTOFF = "2026-11-08T01:00:00.000Z";
+  const { engine, seen } = await boot({
+    responses: {
+      "senior:pr-review": [{ status: "converged", summary: "done" }, { status: "waiting", summary: "awaiting" }],
+      "pr.converge-gate": {
+        convergeBlocked: false,
+        convergeBlockReason: "",
+        convergeAckOnly: false,
+        reviewStale: true,
+        reviewWaitCutoff: CUTOFF,
+      },
+    },
+    vars: { advMax: 0 },
+  });
+  assertThatInstance(engine, byProcessId("convergence-loop")).isActive().hasNoIncident();
+  const progressJobs = seen["pr.progress-check"];
+  assert(progressJobs.length >= 1, "check-progress ran");
+  assert(
+    progressJobs[0]?.reviewWaitCutoff === CUTOFF,
+    `check-progress must receive the gate's reviewWaitCutoff, got ${JSON.stringify(progressJobs[0]?.reviewWaitCutoff)}`,
+  );
+});

package/app/convergeGate.test.ts

@@ -17,6 +17,7 @@ import {
   advisoryStableKey,
   isAckThread,
   parseAckedAdvisories,
+  parseReviewOpenFindings,
   parseReviewThreadsPage,
   parseSuppressedAdvisories,
   pickLatestCopilotReview,
@@ -820,7 +821,11 @@ test("converge-gate #799: a STALE review (commit_id predates HEAD) does not bloc
     headSha: "newsha2222222222222222222222222222222222",
   });
   const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
-  assertEquals(out, { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false, reviewStale: true });
+  assertEquals(out.convergeBlocked, false);
+  assertEquals(out.reviewStale, true);
+  // The gate stamps the review-wait cutoff (the time of ITS review read) so a head-current review
+  // landing in the read→park window still satisfies the wait (issue #923 review).
+  assertEquals(typeof out.reviewWaitCutoff, "string");
 });
 
 test("converge-gate #799: a HEAD-CURRENT review still blocks on an unacked advisory (control)", async () => {
@@ -838,9 +843,14 @@ test("converge-gate #799: a HEAD-CURRENT review still blocks on an unacked advis
   assertStringIncludes(out.convergeBlockReason ?? "", "spec-app/nano-app.schema.json:613");
 });
 
-test("converge-gate #799: an unknown review commit_id or unreadable HEAD is NOT stale (evaluates normally)", async () => {
-  // Fail-safe: without both SHAs we cannot prove staleness, so the gate must fall through to the
-  // ordinary evaluation (here: block on the unacked advisory), never fabricate a re-solicit loop.
+test("converge-gate #799/#923: a review commit_id GitHub did not carry is treated as MISSING — re-solicits (no fail-open)", async () => {
+  // #799's fail-safe ("a null review commit_id is not stale") was written for a gate that only
+  // handled a review that EXISTS. #923 closes the class: a null commit_id is ambiguous between "no
+  // review at all" and "a review GitHub carried no commit_id for", and the gate cannot distinguish
+  // them — converging on either is converging without a verifiable head-current verdict (the
+  // #1443 fail-open). With a readable head the gate now signals reviewStale for BOTH, so the
+  // poller re-solicits a review whose commit_id IS carried, un-wedging the loop. The head-side
+  // fail-safe is unchanged: an unreadable head still evaluates normally (see the #923 test below).
   const handler = await makeUnderTest({
     readThreads: async () => [],
     readReviewBody: async () => SAMPLE_REVIEW_BODY,
@@ -848,8 +858,66 @@ test("converge-gate #799: an unknown review commit_id or unreadable HEAD is NOT
     headSha: "newsha2222222222222222222222222222222222",
   });
   const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
-  assertEquals(out.convergeBlocked, true);
-  assertEquals(out.reviewStale, false);
+  assertEquals(out.convergeBlocked, false);
+  assertEquals(out.reviewStale, true);
+  // The gate stamps the review-wait cutoff (the time of ITS review read) so a head-current review
+  // landing in the read→park window still satisfies the wait (issue #923 review).
+  assertEquals(typeof out.reviewWaitCutoff, "string");
+});
+
+// ── Fail closed on "no review exists" (issue #923 §1) ────────────────────────
+// The gate used to treat `{ body: "", commitId: null }` — a VERIFIED "no Copilot review on this
+// PR" — as "a verified clean review": zero threads + zero advisories → not blocked → merged with
+// ZERO reviews (nano-bpm#1443). Convergence requires a HEAD-CURRENT reviewer verdict, so a missing
+// review must signal `reviewStale` and route to the review wait (the poller solicits a review of
+// the head), exactly like a stale one.
+
+test("converge-gate #923: NO Copilot review at all signals reviewStale (never converges unreviewed)", async () => {
+  // `readReview` returns `{ body: "", commitId: null }` (verified: no Copilot review) and the head
+  // read succeeds. The old gate fell through as the most permissive case and converged.
+  const handler = await makeUnderTest({
+    readThreads: async () => [],
+    readReviewBody: async () => "",
+    reviewCommitId: null,
+    headSha: "headsha4444444444444444444444444444444444",
+  });
+  const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
+  assertEquals(out.convergeBlocked, false);
+  assertEquals(out.reviewStale, true);
+  // The gate stamps the review-wait cutoff (the time of ITS review read) so a head-current review
+  // landing in the read→park window still satisfies the wait (issue #923 review).
+  assertEquals(typeof out.reviewWaitCutoff, "string");
+});
+
+test("converge-gate #923: a review GitHub carried no commit_id for is ALSO treated as missing (fail closed)", async () => {
+  // A null commit_id is ambiguous — "no review" vs "a review with no commit_id" — and the gate
+  // cannot distinguish them, so BOTH must take the re-solicit path. Converging on an unverifiable
+  // verdict is the fail-open this issue closes; the re-solicit produces a review whose commit_id
+  // IS carried, un-wedging the loop.
+  const handler = await makeUnderTest({
+    readThreads: async () => [],
+    readReviewBody: async () => "## Overview\nNo suppressed block.",
+    reviewCommitId: null,
+    headSha: "headsha4444444444444444444444444444444444",
+  });
+  const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
+  assertEquals(out.reviewStale, true);
+  assertEquals(out.convergeBlocked, false);
+});
+
+test("converge-gate #923: a missing review with an UNREADABLE head still fails safe (no fabricated re-solicit)", async () => {
+  // Without the head we cannot prove anything — the gate keeps `isReviewStale`'s fail-safe and
+  // falls through to the ordinary evaluation (here: a clean empty review converges). A transport
+  // hiccup must never strand the loop re-soliciting forever; the review-wait timeout is the
+  // backstop.
+  const handler = await makeUnderTest({
+    readThreads: async () => [],
+    readReviewBody: async () => "",
+    reviewCommitId: null,
+    headSha: null,
+  });
+  const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
+  assertEquals(out, { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false, reviewStale: false });
 });
 
 // ── Structural guard over the committed BPMN (no engine) ─────────────────────
@@ -971,6 +1039,20 @@ test("the round cap does NOT escalate a stale-retry round — f_guardMax is gate
   assertStringIncludes(f, "maxRounds and reviewStale != true");
 });
 
+test("persist-round records a stale re-entry as 'review-stale', not the agent's self-report (#923 §4)", () => {
+  // Round accounting must reflect whether a reviewer verdict was obtained: a round that re-enters
+  // persist-round via f_convergeStale (no head-current review existed, or it predated the head)
+  // never received a verdict, so recording the agent's self-reported status ("converged") would
+  // tell the operator a review round happened that never did (/status showed nano-bpm#1443 as
+  // "round 2" with zero reviews). The stale re-entry maps `status` from `reviewStale` so the
+  // durable round history reads `review-stale`.
+  const task = flat.match(/<bpmn:serviceTask\b[^>]*\bid="persist-round"[^>]*>.*?<\/bpmn:serviceTask>/);
+  assert(task, "persist-round task missing");
+  assertStringIncludes(task[0], 'target="status"');
+  assertStringIncludes(task[0], "reviewStale");
+  assertStringIncludes(task[0], "review-stale");
+});
+
 test("wait-review clears reviewStale when a fresh review lands, so the marker can't leak into a later round (#799)", () => {
   // reviewStale is written ONLY by the converge-gate; once a fresh review arrives it is no longer
   // known-stale, so wait-review resets it to false alongside the round increment. Without this reset
@@ -1196,3 +1278,101 @@ test("parseSuppressedAdvisories: v2 table rows without findings yield nothing; n
   );
   assertEquals(parseSuppressedAdvisories("| `a.ts` | Broken thing (moderate, 1 vote). |"), []);
 });
+
+// ── The reviewer-verdict gate (issue #923 §2) ────────────────────────────────
+// Convergence requires a head-current reviewer VERDICT, not just zero unresolved threads: a
+// head-current review whose own summary reports open findings must block the same way an
+// unresolved thread does. `parseReviewOpenFindings` reads that verdict out of the review body
+// (Copilot's "Changes recommended" / "N open issue(s)" / ccr-overview-v2 "Open (N)" section).
+
+test("parseReviewOpenFindings: a 'Changes recommended' review reports open findings", () => {
+  const body = "## Pull Request Overview\n🟡 Changes recommended — 7 findings (6 high).";
+  assertEquals(parseReviewOpenFindings(body), ["changes recommended"]);
+});
+
+test("parseReviewOpenFindings: an 'N open issue(s)' summary reports N", () => {
+  assertEquals(
+    parseReviewOpenFindings("<details open>\n<summary><strong>3 open issues</strong></summary>\n</details>"),
+    ["3 open issues"],
+  );
+  assertEquals(parseReviewOpenFindings("<summary>1 open issue</summary>"), ["1 open issue"]);
+});
+
+test("parseReviewOpenFindings: '0 open issues' is a clean verdict, not a finding", () => {
+  assertEquals(parseReviewOpenFindings("Review complete. 0 open issues."), []);
+  assertEquals(parseReviewOpenFindings("<details><summary><strong>0 open issues</strong></summary></details>"), []);
+});
+
+test("parseReviewOpenFindings: a ccr-overview-v2 'Open (N)' section reports N", () => {
+  assertEquals(parseReviewOpenFindings(V2_REVIEW_BODY), ["1 open finding"]);
+});
+
+test("parseReviewOpenFindings: a clean review (no open-issues signal) reports none", () => {
+  assertEquals(parseReviewOpenFindings("## Pull Request Overview\n✅ Looks good — no issues found."), []);
+  assertEquals(parseReviewOpenFindings(""), []);
+  assertEquals(parseReviewOpenFindings(null), []);
+  assertEquals(parseReviewOpenFindings(undefined), []);
+});
+
+test("parseReviewOpenFindings: verdict phrases in descriptive prose / table rows are NOT findings", () => {
+  const clean = [
+    "<!-- ccr-overview-v2 -->",
+    "",
+    "### ✅ Looks good",
+    "",
+    "<details>",
+    "<summary><strong>What changed in this PR</strong></summary>",
+    "",
+    "| File | Summary and final review notes |",
+    "|---|---|",
+    '| `a.ts` | Recognizes "Changes recommended" and counts 3 open issues; parses Open (2) sections. |',
+    "</details>",
+    "<summary>Notes</summary> then later Open (4) outside any summary",
+  ].join("\n");
+  assertEquals(parseReviewOpenFindings(clean), []);
+});
+
+test("parseReviewOpenFindings: a v2 overview with NO Open section reports none", () => {
+  const clean = [
+    "<!-- ccr-overview-v2 -->",
+    "",
+    "## Copilot review overview",
+    "",
+    "<details>",
+    "<summary><strong>What changed in this PR</strong></summary>",
+    "",
+    "| File | Summary and final review notes |",
+    "|---|---|",
+    "| `a.ts` | Adds a thing. |",
+    "</details>",
+  ].join("\n");
+  assertEquals(parseReviewOpenFindings(clean), []);
+});
+
+test("converge-gate #923: a head-current review whose body reports OPEN ISSUES blocks (verdict gate, no threads)", async () => {
+  // The verdict gate: zero unresolved threads and no suppressed advisories, but the head-current
+  // review's own summary says findings are open. This must block EXACTLY like an unresolved
+  // thread — NOT ack-only (the round agent's code/reply work is needed, not a nano-ack repost).
+  const handler = await makeUnderTest({
+    readThreads: async () => [],
+    readReviewBody: async () => "## Pull Request Overview\n🟡 Changes recommended — 7 findings (6 high).",
+    reviewCommitId: "headsha4444444444444444444444444444444444",
+    headSha: "headsha4444444444444444444444444444444444",
+  });
+  const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
+  assertEquals(out.convergeBlocked, true);
+  assertEquals(out.reviewStale, false);
+  assertEquals(out.convergeAckOnly, false);
+  assertStringIncludes(out.convergeBlockReason ?? "", "changes recommended");
+});
+
+test("converge-gate #923: a head-current CLEAN review with no findings still converges (verdict-gate control)", async () => {
+  const handler = await makeUnderTest({
+    readThreads: async () => [],
+    readReviewBody: async () => "## Pull Request Overview\n✅ Looks good — no issues found.",
+    reviewCommitId: "headsha4444444444444444444444444444444444",
+    headSha: "headsha4444444444444444444444444444444444",
+  });
+  const out = await handler({ variables: { prKey: "o/r#1", repo: "o/r", prNumber: 1 } } as any, {} as any);
+  assertEquals(out, { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false, reviewStale: false });
+});

package/app/github.ts

@@ -290,6 +290,37 @@ export function parseSuppressedAdvisories(reviewBody: string | null | undefined)
   return out;
 }
 
+/** Read the reviewer VERDICT out of a Copilot review body (issue #923 §2): does the review's own
+ * summary report OPEN, actionable findings? Convergence requires a head-current verdict that is
+ * CLEAN — a review whose body says findings are still open must block the same way an unresolved
+ * thread does, even when every inline thread happens to be resolved (a review can carry findings
+ * with no unresolved threads at all: the nano-bpm#1443 review raised 7 findings as a summary-only
+ * "Changes recommended").
+ *
+ * Recognised open-finding signals (each returns a short human label for the block reason):
+ *   • "Changes recommended" — Copilot's 🟡 verdict line (vs. the ✅ clean verdict);
+ *   • "N open issue(s)"    — the summary count Copilot emits when findings remain;
+ *   • a ccr-overview-v2 `<summary>…Open (N)…</summary>` section (issue #835's format) with N ≥ 1.
+ * A body carrying NONE of these reports no open findings (empty array) — including the empty body
+ * of a comment-only review. Pure; unit-tested. */
+export function parseReviewOpenFindings(reviewBody: string | null | undefined): string[] {
+  const body = reviewBody ?? "";
+  if (body.trim() === "") return [];
+  const out: string[] = [];
+  // Only VERDICT lines and dedicated finding-count <summary> sections count — never descriptive
+  // prose (a clean review's file table may legitimately say `Recognizes "Changes recommended"`).
+  // A verdict line STARTS with the verdict (`### 🟡 Changes recommended`, `🟡 Changes recommended`).
+  if (/^[ \t]*(?:#{1,6}[ \t]*)?(?:🟡[ \t]*)?changes recommended\b/imu.test(body)) out.push("changes recommended");
+  // Each <summary> match is bounded by its own closing tag ([^<]* cannot cross `</summary>`).
+  for (const m of body.matchAll(/<summary>(?:<strong>)?\s*(\d+)\s+open\s+issues?\s*(?:<\/strong>)?\s*<\/summary>/gi)) {
+    if (Number(m[1]) > 0) out.push(`${m[1]} open issue${m[1] === "1" ? "" : "s"}`);
+  }
+  for (const m of body.matchAll(/<summary>(?:<strong>)?\s*Open\s*\((\d+)\)\s*(?:<\/strong>)?\s*<\/summary>/gi)) {
+    if (Number(m[1]) > 0) out.push(`${m[1]} open finding${m[1] === "1" ? "" : "s"}`);
+  }
+  return out;
+}
+
 /** A finding clause's trailing `(<severity>, N vote[s])` tag in the ccr-overview-v2 file table. */
 const V2_FINDING_TAG = /\s*\(\s*[a-z]+\s*,\s*\d+\s+votes?\s*\)/gi;
 
@@ -1665,6 +1696,10 @@ export type MergeMethod = "squash" | "merge" | "rebase";
 export interface MergeOptions {
   method: MergeMethod;
   admin: boolean;
+  /** The head SHA the caller verified (issue #923 backstop). When set, GitHub refuses the merge if
+   * the PR head moved since — gh `--match-head-commit`, REST `sha` — so a later, unreviewed head
+   * can never be landed by a check-then-merge race. The refusal surfaces as a transient `retry`. */
+  expectedHeadSha?: string;
 }
 export interface MergeResult {
   outcome: "merged" | "queued" | "blocked" | "retry";
@@ -1677,9 +1712,21 @@ export interface MergeResult {
  * must re-attempt on the settled base, NOT page a human. Matches GitHub's stable message across
  * both the GraphQL `mergePullRequest` error and its HTTP 405 REST variant. Kept narrow — the exact
  * "<Base|Head> branch was modified" phrase — so a genuine block (conflict, failing required check,
- * 403 perms, 422 not-mergeable) is never swallowed as transient. */
+ * 403 perms, 422 not-mergeable) is never swallowed as transient.
+ *
+ * The same class covers the `--match-head-commit` / REST `sha` pin refusal (issue #923 review): the
+ * PR head advanced past the verified head between the review backstop and the merge mutation, so
+ * GitHub refused the pinned merge. That is a check-then-act race the loop is designed to absorb —
+ * the bounded merge retry re-runs the review backstop on the new head — not a human-actionable
+ * block. gh words it "Head commit of pull request #… does not match '--match-head-commit'"; the
+ * REST `sha` mismatch surfaces as a 409 whose body carries the same "Head branch was modified"
+ * phrase (matched by the first alternative) or a "SHA does not match" wording. */
 export function isTransientMergeRace(detail: string): boolean {
-  return /\b(?:base|head) branch was modified\b/i.test(detail);
+  return (
+    /\b(?:base|head) branch was modified\b/i.test(detail) ||
+    /does not match ['"]--match-head-commit['"]/i.test(detail) ||
+    /\bsha does not match\b/i.test(detail)
+  );
 }
 
 /** Attempt to land the PR. Returns `merged` (landed now), `queued` (added to the repo's merge
@@ -1697,6 +1744,7 @@ export async function mergePr(
   if (await useGh()) {
     const args = ["pr", "merge", String(number), "--repo", repo, methodFlag];
     if (opts.admin) args.push("--admin");
+    if (opts.expectedHeadSha) args.push("--match-head-commit", opts.expectedHeadSha);
     try {
       const out = await runGh(args);
       // gh prints "… will be added to the merge queue" when the branch requires one.
@@ -1721,7 +1769,9 @@ export async function mergePr(
       accept: "application/vnd.github+json",
       "content-type": "application/json",
     },
-    body: JSON.stringify({ merge_method: opts.method }),
+    body: JSON.stringify(
+      opts.expectedHeadSha ? { merge_method: opts.method, sha: opts.expectedHeadSha } : { merge_method: opts.method },
+    ),
   });
   if (r.ok) {
     // A 2xx from the REST merge endpoint does not guarantee the PR has *landed*: the body's

package/app/mergeLoopBehaviour.test.ts

@@ -688,6 +688,18 @@ test("a retry that exhausts the budget escalates as a repeated race, not a gener
   assertStringIncludes(String(escalation(engine).question ?? ""), "retry budget", "the retry escalation must read as a repeated race");
 });
 
+test("a worker-supplied block question (review backstop #923) reaches the human escalation verbatim", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "blocked", status: "blocked", question: "Merge refused: no head-current Copilot review exists." } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "no head-current Copilot review", "the backstop's recovery instructions must reach the human");
+  assert(!q.includes("Investigate why GitHub refused"), "must not be overwritten by the generic refusal text");
+});
+
 // ---------------------------------------------------------------------------
 // CI-fix sub-process (SP_cifix) — mergeCiReattempt (#134), #329
 // ---------------------------------------------------------------------------

package/app/mergeRetry.test.ts

@@ -43,6 +43,33 @@ test("isTransientMergeRace: genuine blocks are NOT transient (never swallowed)",
   assertEquals(isTransientMergeRace("Merge conflict; base branch has conflicts"), false); // a base conflict is a real block
 });
 
+// #923 review (Copilot "previously missed"): the `--match-head-commit` / REST `sha` pin refuses the
+// merge when the PR head advanced past the verified head between the review backstop and the merge
+// mutation. That refusal is the SAME class as the base/head-moved race — a transient check-then-act
+// race GitHub resolves by re-attempting — so it must classify as `retry` (the merge loop's bounded
+// retry re-runs the review backstop on the new head), never `blocked` (which pages a human for a
+// race the loop is designed to absorb).
+test("isTransientMergeRace: the pinned-head mismatch refusal is transient", () => {
+  // gh CLI `--match-head-commit` refusal (gh's own wording).
+  assertEquals(
+    isTransientMergeRace(
+      "Head commit of pull request #924 does not match '--match-head-commit' expected f5a6f20",
+    ),
+    true,
+  );
+  // gh wording variant (no "expected" tail).
+  assertEquals(
+    isTransientMergeRace("Head commit of pull request #924 does not match '--match-head-commit'"),
+    true,
+  );
+  // REST PUT /pulls/{n}/merge `sha` mismatch — GitHub returns 409 Conflict.
+  assertEquals(
+    isTransientMergeRace("github 409 Conflict: Head branch was modified. Review and try the merge again."),
+    true,
+  );
+  assertEquals(isTransientMergeRace("github 409 Conflict: SHA does not match expected head"), true);
+});
+
 // Drive `mergePr`'s REST (token) transport: the 405 base-moved race must surface as `retry`, while
 // a genuine 405 refusal stays `blocked`.
 async function withMergePut(
@@ -88,3 +115,25 @@ test("mergePr: a genuine 405 refusal → outcome 'blocked' (not swallowed as tra
     assertEquals(res?.outcome, "blocked");
   });
 });
+
+test("mergePr: a REST 409 sha-mismatch refusal → outcome 'retry' (not blocked)", async () => {
+  await withMergePut(409, "Conflict", "Head branch was modified. Review and try the merge again.", async () => {
+    const res = await mergePr("acme/widgets", 42, "test-token", {
+      method: "squash",
+      admin: false,
+      expectedHeadSha: "f5a6f20",
+    });
+    assertEquals(res?.outcome, "retry");
+  });
+});
+
+test("mergePr: a genuine 409 refusal → outcome 'blocked' (not swallowed as transient)", async () => {
+  await withMergePut(409, "Conflict", "Pull Request is not mergeable", async () => {
+    const res = await mergePr("acme/widgets", 42, "test-token", {
+      method: "squash",
+      admin: false,
+      expectedHeadSha: "f5a6f20",
+    });
+    assertEquals(res?.outcome, "blocked");
+  });
+});

package/app/reviewWait.test.ts

@@ -9,6 +9,7 @@ import {
   DEFAULT_REVIEW_NUDGE_MINUTES,
   DEFAULT_REVIEW_WAIT_TIMEOUT,
   isoDurationToMs,
+  isReviewMissingOrStale,
   isReviewStale,
   MAX_REVIEW_NUDGE_MINUTES,
   reviewWaitTimeout,
@@ -128,3 +129,39 @@ test("isReviewStale: a missing HEAD sha fails safe to NOT stale", () => {
 test("isReviewStale: both missing is NOT stale", () => {
   assertEquals(isReviewStale(null, null), false);
 });
+
+// ── isReviewMissingOrStale (issue #923) ──────────────────────────────────────
+// The CONVERGENCE-GATE variant of the staleness predicate. `isReviewStale` intentionally fails
+// safe to "not stale" on a missing review commit_id (a review GitHub carried no `commit_id` for
+// must not fabricate a re-solicit loop) — but that same fail-safe is a fail-OPEN when the null
+// means "no Copilot review exists AT ALL" (nano-bpm#1443 merged with ZERO reviews). The gate's
+// precondition is a HEAD-CURRENT reviewer verdict, so a missing review must route to the review
+// wait exactly like a stale one.
+
+test("isReviewMissingOrStale: NO review (null commit_id) with a readable HEAD is stale/missing — fail CLOSED", () => {
+  // The #923 case: `readReview` verified "no Copilot review" (`commitId: null`) and the head read
+  // succeeded — the gate must NOT treat "no review" as "a verified clean review".
+  assertEquals(isReviewMissingOrStale(null, "bbb2222"), true);
+  assertEquals(isReviewMissingOrStale(undefined, "bbb2222"), true);
+  assertEquals(isReviewMissingOrStale("", "bbb2222"), true);
+  assertEquals(isReviewMissingOrStale("   ", "bbb2222"), true);
+});
+
+test("isReviewMissingOrStale: a differing review commit_id and HEAD sha is stale (same as isReviewStale)", () => {
+  assertEquals(isReviewMissingOrStale("aaa1111", "bbb2222"), true);
+});
+
+test("isReviewMissingOrStale: a head-current review is NOT stale/missing", () => {
+  assertEquals(isReviewMissingOrStale("aaa1111", "aaa1111"), false);
+  assertEquals(isReviewMissingOrStale("  aaa1111 ", "aaa1111"), false);
+});
+
+test("isReviewMissingOrStale: an UNREADABLE head fails safe to NOT stale (never fabricates a re-solicit loop)", () => {
+  // Without the head we cannot prove the review predates it NOR that a missing review should
+  // re-solicit — a transport hiccup must not strand the loop re-requesting forever (the same
+  // fail-safe `isReviewStale` keeps; the review-wait timeout remains the backstop).
+  assertEquals(isReviewMissingOrStale(null, null), false);
+  assertEquals(isReviewMissingOrStale("aaa1111", null), false);
+  assertEquals(isReviewMissingOrStale("aaa1111", ""), false);
+  assertEquals(isReviewMissingOrStale(null, ""), false);
+});

package/app/reviewWait.ts

@@ -114,3 +114,29 @@ export function isReviewStale(
   if (rev === "" || head === "") return false;
   return rev !== head;
 }
+
+/** Is there NO head-current Copilot review to gate on? (issue #923) — the CONVERGENCE-GATE /
+ * merge-backstop variant of {@link isReviewStale}.
+ *
+ * `isReviewStale` intentionally fails safe to "not stale" on a missing review `commit_id` — for
+ * the POLLER, a review GitHub carried no `commit_id` for must not fabricate a re-solicit loop. But
+ * the gate's consumer is different: `fetchLatestCopilotReview` returns `commitId: null` both when
+ * no Copilot review exists AT ALL and when the newest one lacks a `commit_id`, and the gate's
+ * precondition is a HEAD-CURRENT reviewer verdict. Treating "no review" as "a verified clean
+ * review" is the fail-open that merged nano-bpm#1443 with ZERO reviews — so for the GATE, a
+ * missing review commit is stale/missing, not current.
+ *
+ * The head-side fail-safe is kept: with an UNREADABLE head we can prove nothing, so we must not
+ * fabricate a re-solicit loop on a transport hiccup (the review-wait timeout remains the
+ * backstop). Only a READABLE head + a missing/mismatched review commit routes to the review wait. */
+export function isReviewMissingOrStale(
+  reviewCommitId: string | null | undefined,
+  headSha: string | null | undefined,
+): boolean {
+  const head = (headSha ?? "").trim();
+  if (head === "") return false; // unverifiable head → fail safe, exactly as isReviewStale
+  const rev = (reviewCommitId ?? "").trim();
+  // A missing review commit with a readable head = NO head-current verdict → stale/missing.
+  if (rev === "") return true;
+  return rev !== head;
+}

package/app/roundProgress.test.ts

@@ -24,8 +24,11 @@ test("routeProgress: an addressed round whose head advanced continues", () => {
 
 test("routeProgress: an explicit non-addressed round always continues (no push is expected)", () => {
   // These are the statuses gw-status routes AWAY from the addressed/default arm — a legit no-push
-  // round. They always continue regardless of the head.
-  for (const status of ["waiting", "converged", "needs_input", "blocked"]) {
+  // round. They always continue regardless of the head. `review-stale` (#923 §4) joins them: the
+  // round re-entered via the converge gate's stale/missing-review path, so no reviewer verdict was
+  // obtained and no push was claimed — it must continue to the review wait, never escalate as
+  // no-progress.
+  for (const status of ["waiting", "converged", "needs_input", "blocked", "review-stale"]) {
     assertEquals(
       routeProgress(status, "sha-1", "sha-1"),
       "continue",
@@ -280,6 +283,64 @@ test("progress-check: a non-addressed round records the baseline and consumes th
   );
 });
 
+test("progress-check: a review-stale re-entry parks with waiting_since at the gate's reviewWaitCutoff, not the park time", async () => {
+  // Issue #923 review ("previously missed"): the converge-gate decides stale/missing from ITS review
+  // read, but the loop parks several tasks later — and the old park stamped `waiting_since` at the
+  // (later) park time. A head-current review landing in that read→park window was then REJECTED by
+  // `pollReviews` (`submitted_at >= waiting_since`), so the loop re-solicited and could time out
+  // despite a valid verdict already sitting unconsumed on the PR. The gate emits `reviewWaitCutoff`
+  // (its read time); the park must stamp `waiting_since` at THAT cutoff so the in-window review
+  // satisfies the wait.
+  const CUTOFF = "2026-11-08T01:00:00.000Z"; // the gate's review-read time (earlier than "now")
+  const handler = await makeUnderTest(
+    async () => "sha-2",
+    async () => ({ work: true, consumedKey: "9" }),
+  );
+  const { app, updates } = fakeApp({ last_round_head: "sha-1" });
+  const out = await handler(
+    {
+      processInstanceKey: "pik",
+      variables: {
+        prKey: "o/r#1",
+        status: "waiting",
+        repo: "o/r",
+        prNumber: 1,
+        reviewWaitCutoff: CUTOFF,
+      },
+    } as any,
+    app as any,
+  );
+  assertEquals(out, { progressed: true, huskRetries: 0 });
+  assertEquals(updates.length, 1, "one atomic park write");
+  assertEquals(updates[0]!.patch.status, "waiting_review", "the round parks for review");
+  assertEquals(
+    updates[0]!.patch.waiting_since,
+    CUTOFF,
+    "waiting_since is stamped at the gate's review-read cutoff, so a review landing in the read→park window satisfies the wait",
+  );
+});
+
+test("progress-check: a normal round (no reviewWaitCutoff) still stamps waiting_since at the park time", async () => {
+  // The cutoff is only emitted on a review-stale re-entry. A normal round carries no
+  // `reviewWaitCutoff`, so the park falls back to "now" — the pre-fix behaviour every existing test
+  // relies on.
+  const handler = await makeUnderTest(
+    async () => "sha-2",
+    async () => ({ work: true, consumedKey: "9" }),
+  );
+  const { app, updates } = fakeApp({ last_round_head: "sha-1" });
+  await handler(
+    { processInstanceKey: "pik", variables: { prKey: "o/r#1", status: "waiting", repo: "o/r", prNumber: 1 } } as any,
+    app as any,
+  );
+  assertEquals(updates[0]!.patch.status, "waiting_review");
+  const stamped = updates[0]!.patch.waiting_since;
+  assertEquals(typeof stamped, "string", "a park time is stamped");
+  // Not the (absent) cutoff — a fresh "now" timestamp, i.e. close to the wall clock.
+  const driftMs = Math.abs(Date.now() - Date.parse(stamped as string));
+  assertEquals(driftMs < 60_000, true, "waiting_since falls back to the park time when no cutoff is carried");
+});
+
 test("progress-check: a blank/unknown status is treated as addressed — reads the head and can report no progress", async () => {
   let called = false;
   const handler = await makeUnderTest(async () => {

package/app/roundProgress.ts

@@ -39,6 +39,12 @@ const NON_ADDRESSED_STATUSES: ReadonlySet<string> = new Set([
   "converged",
   "needs_input",
   "blocked",
+  // `review-stale` (issue #923 §4): the round re-entered persist-round via the converge gate's
+  // stale/missing-review path (f_convergeStale) — no head-current reviewer verdict was ever
+  // obtained, so the round claims no push and must always continue to the review wait (the poller
+  // re-solicits a fresh review of the current head). Treating it as `addressed` would fabricate a
+  // no-progress escalation on a round that never claimed progress.
+  "review-stale",
 ]);
 
 /** True when a round's status is `addressed` for no-progress purposes — i.e. NOT one of the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.205.1",
+  "version": "0.205.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/convergence-loop.bpmn

@@ -42,6 +42,7 @@
           <nano:extend name="round" type="integer" optional="true" />
           <nano:extend name="huskRetries" type="integer" optional="true" />
           <nano:extend name="roundEntryHead" type="string" optional="true" />
+          <nano:extend name="reviewWaitCutoff" type="string" optional="true" />
         </nano:shape>
         <nano:shape id="PrCaptureHeadIn" name="Capture round-entry head — input">
           <nano:extend name="prKey" type="string" />
@@ -68,6 +69,7 @@
           <nano:extend name="convergeBlockReason" type="string" optional="true" />
           <nano:extend name="convergeAckOnly" type="boolean" optional="true" />
           <nano:extend name="reviewStale" type="boolean" optional="true" />
+          <nano:extend name="reviewWaitCutoff" type="string" optional="true" />
         </nano:shape>
         <nano:shape id="EscalationIn" name="Record escalation — input">
           <nano:extend name="prKey" type="string" />
@@ -307,6 +309,9 @@
         <zeebe:properties>
           <zeebe:property name="io.nanobpm.dataEnvelope.in" value="PrPersistRoundIn" />
         </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:input source="=if reviewStale = true then &#34;review-stale&#34; else status" target="status" />
+        </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_advSkip</bpmn:incoming>
       <bpmn:incoming>f_advClean</bpmn:incoming>

package/resources/processes/merge-loop.bpmn

@@ -282,7 +282,7 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=status" target="agentVerdict" />
-          <zeebe:input source="=&#34;This PR cannot be merged and needs a human decision. &#34; + (if mergeState = &#34;conflict&#34; then &#34;The automated rebase agent could not resolve the merge conflicts on this branch. Resolve them manually (or reply with guidance), then reply to retry.&#34; else if mergeStatus = &#34;retry&#34; then &#34;The merge kept losing a race with concurrent updates to the base branch and exhausted its automatic retry budget (&#34; + string(mergeRetryMax) + &#34; retries). This is a repeated transient race, not a conflict, failing check, or permissions block. Reply to retry, or investigate why the base branch keeps moving.&#34; else if mergeState = &#34;ready&#34; then &#34;The merge attempt did not land (merge result: &#34; + mergeStatus + &#34;). Investigate why GitHub refused the merge, then reply to retry.&#34; else if status = &#34;blocked&#34; then &#34;The automated CI-fix agent could not make the required checks green. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else &#34;The automated CI-fix agent exceeded its time budget (SLA) before the required checks went green. Check its progress or intervene, then reply to retry.&#34;)" target="question" />
+          <zeebe:input source="=&#34;This PR cannot be merged and needs a human decision. &#34; + (if mergeState = &#34;conflict&#34; then &#34;The automated rebase agent could not resolve the merge conflicts on this branch. Resolve them manually (or reply with guidance), then reply to retry.&#34; else if mergeStatus = &#34;retry&#34; then &#34;The merge kept losing a race with concurrent updates to the base branch and exhausted its automatic retry budget (&#34; + string(mergeRetryMax) + &#34; retries). This is a repeated transient race, not a conflict, failing check, or permissions block. Reply to retry, or investigate why the base branch keeps moving.&#34; else if mergeState = &#34;ready&#34; and mergeStatus = &#34;blocked&#34; and question != null then question else if mergeState = &#34;ready&#34; then &#34;The merge attempt did not land (merge result: &#34; + mergeStatus + &#34;). Investigate why GitHub refused the merge, then reply to retry.&#34; else if status = &#34;blocked&#34; then &#34;The automated CI-fix agent could not make the required checks green. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else &#34;The automated CI-fix agent exceeded its time budget (SLA) before the required checks went green. Check its progress or intervene, then reply to retry.&#34;)" target="question" />
           <zeebe:input source="=&#34;blocked&#34;" target="status" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>

package/workers/converge-gate/worker.ts

@@ -29,6 +29,15 @@
 // re-enters the review wait for a fresh review of the current HEAD. The head read fails OPEN, so a
 // transport hiccup can never fabricate a stale verdict.
 //
+// MISSING-REVIEW GUARD (issue #923): the same `reviewStale` signal fires when NO Copilot review
+// exists at all — the gate's single most important precondition. The old code treated
+// `{ body: "", commitId: null }` as "a verified clean review" and converged, merging
+// nano-bpm#1443 with ZERO reviews. A missing review now fails CLOSED into the re-solicit path.
+//
+// VERDICT GATE (issue #923 §2): even a head-current review BLOCKS when its own summary reports
+// open, actionable findings ("Changes recommended" / "N open issue(s)" / a v2 "Open (N)" section)
+// — zero unresolved threads is not a clean verdict.
+//
 // Scope integrity is NO LONGER judged here. A deterministic regex over the PR description could not
 // read the closed issue's acceptance criteria, so it false-positived on any body that merely
 // *mentioned* deferral (an ADR non-goal, a PR whose subject is scope tooling) and forced needless
@@ -49,10 +58,11 @@ import {
   fetchReviewThreads,
   isAckThread,
   parseAckedAdvisories,
+  parseReviewOpenFindings,
   parseSuppressedAdvisories,
   type ReviewThread,
 } from "../../app/github.ts";
-import { isReviewStale } from "../../app/reviewWait.ts";
+import { isReviewMissingOrStale } from "../../app/reviewWait.ts";
 import { parsePr } from "../../app/service.ts";
 import type { WorkerInputs, WorkerOutputs } from "../../nano-generated/worker-io.d.ts";
 import { type HeadReader, makeDefaultReadHead } from "../progress-check/worker.ts";
@@ -118,17 +128,57 @@ export function makeHandler(deps: {
       if (review === null) {
         return { convergeBlocked: true, convergeBlockReason: BLOCK_UNVERIFIABLE, convergeAckOnly: false, reviewStale: false };
       }
-      // STALE-REVIEW GUARD (issue #799). When the PR HEAD has advanced PAST the commit the latest
-      // Copilot review was submitted against, that review's suppressed advisories describe code the
-      // head has moved past — e.g. an advisory the agent already FIXED IN CODE (but did not ack) is
-      // still re-listed in the obsolete body. Blocking/escalating on it re-escalates a human
-      // indefinitely (PR #789). Instead of gating on the stale body, signal `reviewStale` so the
-      // process re-enters the review wait and the poller re-solicits a fresh review of the current
-      // HEAD to gate on. The head read fails OPEN (null → not stale), so a transport hiccup can never
-      // fabricate a stale verdict; the ordinary gate below still runs on a HEAD-current review.
+      // STALE-OR-MISSING-REVIEW GUARD (issues #799 / #923). Convergence requires a HEAD-CURRENT
+      // reviewer verdict. Two states fail that precondition and must route to the review wait (the
+      // poller (re-)solicits a review of the current HEAD) rather than be gated on:
+      //   • STALE (#799): the PR HEAD has advanced PAST the commit the latest Copilot review was
+      //     submitted against — its suppressed advisories describe code the head has moved past
+      //     (e.g. an advisory the agent already FIXED IN CODE but did not ack), so blocking on the
+      //     obsolete body re-escalates a human indefinitely (PR #789).
+      //   • MISSING (#923): NO Copilot review exists at all (`commitId: null` with a readable
+      //     head). The old gate treated that as "a verified clean review" — zero threads, zero
+      //     advisories → not blocked — and merged nano-bpm#1443 with ZERO reviews. A missing
+      //     review is the gate's single most important precondition, so it fails CLOSED into the
+      //     same re-solicit path (`isReviewMissingOrStale`), never through to finalize.
+      // The head read still fails OPEN (null → not stale): without the head we can prove nothing,
+      // so a transport hiccup can never fabricate a stale/missing verdict that would loop the loop
+      // re-soliciting forever — the review-wait timeout remains the backstop.
+      //
+      // ARRIVAL-WINDOW CUTOFF (issue #923 review, "previously missed"): the stale/missing verdict
+      // is decided from the review read ABOVE — but the loop only PARKS for the next review several
+      // tasks later (persist-round → check-progress), and check-progress stamps `waiting_since` at
+      // THAT (later) park time. A head-current review that lands in the window BETWEEN this read
+      // and the park would then be REJECTED by `pollReviews` (it filters
+      // `submitted_at >= waiting_since`), so the loop re-solicits and can time out despite a valid
+      // verdict already sitting unconsumed on the PR. Emit the time of THIS read as
+      // `reviewWaitCutoff` so check-progress can park with `waiting_since` at the cutoff — any
+      // review that arrived in the window then satisfies the wait instead of being discarded.
       const headSha = await readHeadSha(ghRepo, ghNumber).catch(() => null);
-      if (isReviewStale(review.commitId, headSha)) {
-        return { convergeBlocked: false, convergeBlockReason: "", convergeAckOnly: false, reviewStale: true };
+      if (isReviewMissingOrStale(review.commitId, headSha)) {
+        return {
+          convergeBlocked: false,
+          convergeBlockReason: "",
+          convergeAckOnly: false,
+          reviewStale: true,
+          reviewWaitCutoff: new Date().toISOString(),
+        };
+      }
+      // VERDICT GATE (issue #923 §2): a head-current review whose OWN summary reports open,
+      // actionable findings (Copilot's "Changes recommended" / "N open issue(s)" / a v2 "Open (N)"
+      // section) blocks the same way an unresolved thread does — even with zero unresolved threads
+      // (a review can carry findings as summary-only, as #1443's 7-finding review did). This block
+      // is NOT ack-only: the findings need the round agent's code/reply work, so it escalates to a
+      // human rather than entering the bounded auto-ack path.
+      const openFindings = parseReviewOpenFindings(review.body);
+      if (openFindings.length > 0) {
+        return {
+          convergeBlocked: true,
+          convergeBlockReason:
+            `Convergence blocked: the latest head-current Copilot review reports ${openFindings.join("; ")}. ` +
+            `Address every finding the review raised (or reply-and-resolve why each is a false positive) before converging.`,
+          convergeAckOnly: false,
+          reviewStale: false,
+        };
       }
       // Split the unresolved threads into SUBSTANTIVE reviewer findings vs partially-completed
       // `nano-ack:` ACK threads (root carries a canonical `nano-ack: <path> :: <text>` marker — see

package/workers/merge/worker.test.ts

@@ -8,7 +8,7 @@ import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import { _clearMergeProtocolCache } from "../../app/mergeProtocol.ts";
 import { noopLog } from "../../test/log.ts";
-import handler from "./worker.ts";
+import handler, { makeHandler } from "./worker.ts";
 
 function fakeApp() {
   const stores: Record<string, Record<string, unknown>[]> = {
@@ -294,3 +294,194 @@ test("pr.merge abandons a closed-not-merged PR without escalating (terminal aban
     },
   );
 });
+
+// ── Merge-loop backstop (issue #923 §3) ──────────────────────────────────────
+// Just before landing, the worker re-checks that a HEAD-CURRENT Copilot review exists. A head that
+// moved between convergence and landing — or a review that never existed (the nano-bpm#1443
+// fail-open: merged with ZERO reviews) — must block the landing, not slip through. These tests
+// drive the backstop through `makeHandler`'s injected readers; the fetch stub only needs the
+// single-PR GET (liveness) since the injected readers replace the review/head fetches.
+
+function backstopRoutes(url: string): Response | null {
+  if (/\/pulls\/\d+$/.test(url)) {
+    return new Response(JSON.stringify({ merged: false, mergeable_state: "clean" }));
+  }
+  return null; // no AGENTS.md / merge-protocol.json → DEFAULT gh-merge protocol
+}
+
+test("pr.merge #923: refuses to land when NO Copilot review exists (the #1443 fail-open)", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      // Verified "no Copilot review on this PR" + a readable head → missing → BLOCK.
+      readReview: async () => ({ body: "", commitId: null }),
+      readHeadSha: async () => "headsha4444444444444444444444444444444444",
+    });
+    const out = (await backstop(
+      { variables: { prKey: "acme/widgets#21", repo: "acme/widgets", prNumber: 21 } } as any,
+      app,
+    )) as Record<string, unknown>;
+
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals(out.status, "blocked");
+    assertEquals(typeof out.question, "string");
+    assertEquals((out.question as string).includes("no head-current Copilot review"), true);
+
+    // The refusal is audited, and NO land was attempted (no merge PUT, no enqueue comment).
+    assertEquals(stores.merges.length, 1);
+    assertEquals(stores.merges[0].outcome, "blocked");
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+    assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+  });
+});
+
+test("pr.merge #923: refuses to land when the head MOVED past the latest review (stale at land time)", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      // The review was submitted against the OLD head; the branch has since advanced.
+      readReview: async () => ({ body: "lgtm", commitId: "oldsha1111111111111111111111111111111111" }),
+      readHeadSha: async () => "newsha2222222222222222222222222222222222",
+    });
+    const out = (await backstop(
+      { variables: { prKey: "acme/widgets#23", repo: "acme/widgets", prNumber: 23 } } as any,
+      app,
+    )) as Record<string, unknown>;
+
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+  });
+});
+
+test("pr.merge #923: a HEAD-CURRENT review lands normally (backstop control)", async () => {
+  await withGithub(
+    (url) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "lgtm", commitId: "samesha33333333333333333333333333333333" }),
+        readHeadSha: async () => "samesha33333333333333333333333333333333",
+      });
+      const out = (await backstop(
+        { variables: { prKey: "acme/widgets#25", repo: "acme/widgets", prNumber: 25 } } as any,
+        app,
+      )) as Record<string, unknown>;
+
+      // The backstop passes and the ordinary land protocol runs (direct merge).
+      assertEquals(out, { mergeStatus: "merged" });
+      assertEquals(
+        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
+        true,
+      );
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    },
+  );
+});
+
+test("pr.merge #923: an UNREADABLE review/head fails OPEN (a transport hiccup never wedges a merge)", async () => {
+  await withGithub(
+    (url) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => null, // no usable transport → unverifiable, NOT "no review"
+        readHeadSha: async () => {
+          throw new Error("boom");
+        },
+      });
+      const out = (await backstop(
+        { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
+        app,
+      )) as Record<string, unknown>;
+
+      assertEquals(out, { mergeStatus: "merged" });
+      assertEquals(
+        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
+        true,
+      );
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    },
+  );
+});
+
+test("pr.merge #923: a head-current review whose summary reports OPEN findings blocks landing", async () => {
+  await withGithub(backstopRoutes, async (calls) => {
+    const { app, stores } = fakeApp();
+    const backstop = makeHandler({
+      readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "h1" }),
+      readHeadSha: async () => "h1",
+    });
+    const out = (await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app)) as Record<string, unknown>;
+    assertEquals(out.mergeStatus, "blocked");
+    assertEquals((out.question as string).includes("open findings"), true);
+    assertEquals(stores.merges[0].method, "review-backstop");
+    assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+  });
+});
+
+for (const [label, readHeadSha] of [
+  ["returns null", async () => null],
+  ["throws", async () => { throw new Error("transient"); }],
+] as const) {
+  test(`pr.merge #923: an unverifiable head (read ${label}) never blocks on a possibly-stale review's open findings`, async () => {
+    await withGithub(backstopRoutes, async () => {
+      const { app, stores } = fakeApp();
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "old" }),
+        readHeadSha,
+      });
+      await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app);
+      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
+    });
+  });
+}
+
+test("pr.merge #923: the direct merge pins the verified head SHA (no check-then-merge race)", async () => {
+  let putBody = "";
+  await withGithub(
+    (url, init) => {
+      if (/\/pulls\/\d+\/merge$/.test(url)) {
+        putBody = String(init?.body ?? "");
+        return new Response(JSON.stringify({ merged: true }), { status: 200 });
+      }
+      return backstopRoutes(url);
+    },
+    async () => {
+      const { app } = fakeApp();
+      const backstop = makeHandler({ readReview: async () => ({ body: "lgtm", commitId: "h2" }), readHeadSha: async () => "h2" });
+      await backstop({ variables: { prKey: "acme/widgets#31", repo: "acme/widgets", prNumber: 31 } } as any, app);
+      assertEquals(JSON.parse(putBody).sha, "h2");
+    },
+  );
+});
+
+test("pr.merge #923: a queue-comment repo whose head moved after the backstop retries instead of enqueueing", async () => {
+  const protocol =
+    "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+  await withGithub(
+    (url) => {
+      if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+      if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+      return backstopRoutes(url);
+    },
+    async (calls) => {
+      const { app } = fakeApp();
+      const heads = ["h3", "h4"];
+      const backstop = makeHandler({
+        readReview: async () => ({ body: "lgtm", commitId: "h3" }),
+        readHeadSha: async () => heads.shift() ?? "h4",
+      });
+      const out = (await backstop({ variables: { prKey: "acme/widgets#33", repo: "acme/widgets", prNumber: 33 } } as any, app)) as Record<string, unknown>;
+      assertEquals(out.mergeStatus, "retry");
+      assertEquals(calls.some((c) => /\/issues\/\d+\/comments$/.test(c.url) && c.method === "POST"), false);
+    },
+  );
+});

package/workers/merge/worker.ts

@@ -10,12 +10,32 @@
 // waiting for the queue, NOT a direct `gh pr merge` — which that repo refuses. The actual gh/API
 // calls live in app/github.ts; this worker records the attempt in the `merges` audit table and
 // shapes the escalation payload on a block.
+//
+// MERGE-LOOP BACKSTOP (issue #923 §3): the convergence gate's verdict is only as fresh as the head
+// it reviewed — a head that MOVED between convergence and landing, or a review that never existed
+// (the #1443 fail-open), must not slip through at land time. Before running ANY land protocol this
+// worker re-checks that a HEAD-CURRENT Copilot review exists; a missing/stale review blocks the
+// landing (escalating to a human) instead of enqueueing/merging unreviewed code. The check fails
+// OPEN only when the GitHub state is UNREADABLE (no transport / a hiccup) — the merge-stage
+// mergeability polling is the independent backstop there, and a hard block on a transient read
+// would wedge every merge on a network blip.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { checkBaseTarget, classifyBaseGuard } from "../../app/baseGuard.ts";
-import { classifyPrLiveness, enqueueViaComment, fetchPrState, mergePr } from "../../app/github.ts";
+import { type HeadReader, makeDefaultReadHead } from "../../app/currentHead.ts";
+import {
+  classifyPrLiveness,
+  enqueueViaComment,
+  fetchBranchHead,
+  fetchLatestCopilotReview,
+  fetchPrHead,
+  fetchPrState,
+  mergePr,
+  parseReviewOpenFindings,
+} from "../../app/github.ts";
 import { classifyMergeLanding, DEFAULT_MERGE_PROTOCOL, loadMergeProtocol } from "../../app/mergeProtocol.ts";
+import { isReviewMissingOrStale } from "../../app/reviewWait.ts";
 import { abandonClosedPr, ensurePr, MERGE_ADMIN, MERGE_METHOD } from "../../app/service.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
@@ -28,7 +48,25 @@ interface Out extends Record<string, unknown> {
   question?: string;
 }
 
-const handler: AppJobHandler<In, Out> = async (job, app) => {
+// The backstop's review reader — the SAME shape the converge-gate binds (`{ body, commitId }`,
+// `null` = unverifiable). Injectable so tests drive the missing/stale/head-current matrix without
+// a transport.
+export type MergeReviewReader = (repo: string, prNumber: number) => Promise<{ body: string; commitId: string | null } | null>;
+
+const defaultReadReview: MergeReviewReader = (repo, prNumber) =>
+  fetchLatestCopilotReview(repo, prNumber, process.env.GITHUB_TOKEN ?? "");
+// The SAME branch-ref-over-stale-`head.sha` reader the converge-gate / progress-check / poller
+// bind (#786/#799), so the backstop's staleness comparison sees the exact head the gate did.
+const defaultReadHead: HeadReader = makeDefaultReadHead({ fetchPrHead, fetchBranchHead });
+
+const BLOCK_NO_HEAD_CURRENT_REVIEW =
+  "no head-current Copilot review exists for the PR's current HEAD (the head moved after the last review, or no review was ever submitted). A head-current reviewer verdict is required before landing";
+
+/** Build the handler with injectable GitHub readers. The default export binds the real readers;
+ * tests inject stubs for the backstop matrix. */
+export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha: HeadReader }): AppJobHandler<In, Out> {
+  const { readReview, readHeadSha } = deps;
+  const handler: AppJobHandler<In, Out> = async (job, app) => {
   const { prKey, repo, prNumber, round, abandonUrl } = job.variables;
   const token = process.env.GITHUB_TOKEN ?? "";
   const now = new Date().toISOString();
@@ -88,6 +126,68 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     return { mergeStatus: "abandoned" };
   }
 
+  // MERGE-LOOP BACKSTOP (issue #923 §3): refuse to land without a HEAD-CURRENT Copilot review. The
+  // convergence gate's verdict is only as fresh as the head it reviewed — a head that MOVED between
+  // convergence and landing (a fix-ci / rebase push, an out-of-band commit), or a review that never
+  // existed at all (the nano-bpm#1443 fail-open: merged with ZERO reviews), must not slip through
+  // at land time. Runs AFTER the merged/closed short-circuits (an already-terminal PR needs no
+  // verdict) and BEFORE any land protocol (the `@mergifyio queue` comment is itself the landing
+  // for a queue repo). Fails OPEN only when the GitHub state is UNREADABLE (no transport / a
+  // hiccup → `null` review or head): a transient read failure must not wedge every merge — the
+  // merge-stage mergeability polling is the independent backstop there.
+  const [backstopReview, backstopHead] = await Promise.all([
+    readReview(repo, prNumber).catch(() => null),
+    readHeadSha(repo, prNumber).catch(() => null),
+  ]);
+  if (backstopReview !== null && isReviewMissingOrStale(backstopReview.commitId, backstopHead)) {
+    await app.data.table("merges", "id").insert({
+      pr_key: prKey,
+      outcome: "blocked",
+      method: "review-backstop",
+      detail: BLOCK_NO_HEAD_CURRENT_REVIEW,
+      at: now,
+    });
+    return {
+      mergeStatus: "blocked",
+      status: "blocked",
+      question:
+        `Merge refused: ${BLOCK_NO_HEAD_CURRENT_REVIEW}. ` +
+        `Push no further commits, wait for the Copilot review of the current HEAD to land (or request one: ` +
+        `gh api repos/${repo}/pulls/${prNumber}/requested_reviewers -X POST -f "reviewers[]=copilot-pull-request-reviewer[bot]"), ` +
+        `let the convergence loop gate on it, then reply to retry.`,
+    };
+  }
+
+  // A head-current review whose OWN summary still reports open findings (the same canonical
+  // verdict parser the converge-gate uses) must block too: a summary-only "Changes recommended"
+  // review that landed after convergence has no unresolved thread for mergeability polling to see.
+  // Only evaluate the verdict once head-currentness is VERIFIED (review read AND head read succeeded
+  // and match) — an unreadable head fails open here like the stale check above, never blocking on a
+  // possibly-stale review's body.
+  const reviewIsHeadCurrent =
+    backstopReview !== null && backstopHead !== null && backstopHead !== "" && backstopReview.commitId === backstopHead;
+  const openFindings = reviewIsHeadCurrent ? parseReviewOpenFindings(backstopReview.body) : [];
+  if (openFindings.length > 0) {
+    const detail = `the head-current Copilot review reports open findings (${openFindings.join(", ")})`;
+    await app.data.table("merges", "id").insert({
+      pr_key: prKey,
+      outcome: "blocked",
+      method: "review-backstop",
+      detail,
+      at: now,
+    });
+    return {
+      mergeStatus: "blocked",
+      status: "blocked",
+      question:
+        `Merge refused: ${detail}. Address the review's findings on the branch (or reply with ` +
+        `guidance on which to push back on), let the convergence loop gate on a clean review, then reply to retry.`,
+    };
+  }
+  // The head the backstop verified — pinned through the land call so a push between this check
+  // and the merge can never land a later, unreviewed head.
+  const verifiedHead = backstopReview !== null && backstopHead ? backstopHead : undefined;
+
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
   // GitHub only auto-retargets a PR when its base is *deleted* on merge; a merged-but-undeleted
@@ -125,9 +225,17 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     // Land via the repo's on-demand queue: post the enqueue comment; the poller's queued→landed
     // watch (service.ts block 3) then advances the process when the queue merges it.
     const comment = protocol?.land.comment ?? "@mergifyio queue";
-    const ok = await enqueueViaComment(repo, prNumber, token, comment);
-    outcome = ok ? "queued" : "blocked";
-    detail = ok ? `enqueued via "${comment}"` : `failed to post enqueue comment "${comment}"`;
+    // A comment can't pin a SHA, so re-read the head right before enqueueing: if it moved past the
+    // verified head, re-enter via the bounded retry (which re-runs the backstop on the new head).
+    const headNow = verifiedHead ? await readHeadSha(repo, prNumber).catch(() => null) : null;
+    if (verifiedHead && headNow !== null && headNow !== verifiedHead) {
+      outcome = "retry";
+      detail = `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
+    } else {
+      const ok = await enqueueViaComment(repo, prNumber, token, comment);
+      outcome = ok ? "queued" : "blocked";
+      detail = ok ? `enqueued via "${comment}"` : `failed to post enqueue comment "${comment}"`;
+    }
     auditMethod = "queue-comment";
   } else if (classifyMergeLanding(protocol ?? DEFAULT_MERGE_PROTOCOL) === "decision-required") {
     // The repo requires a human to click Merge (`land.method=ui`); Merlin can't. This is the
@@ -137,7 +245,7 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     auditMethod = "ui";
   } else {
     const admin = method === "admin" || MERGE_ADMIN;
-    const res = await mergePr(repo, prNumber, token, { method: MERGE_METHOD, admin });
+    const res = await mergePr(repo, prNumber, token, { method: MERGE_METHOD, admin, expectedHeadSha: verifiedHead });
     // No usable transport → treat as a block so a human is asked to configure/merge, rather than
     // silently completing the process without landing the PR.
     outcome = res?.outcome ?? "blocked";
@@ -180,6 +288,9 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
         `Resolve it on GitHub (rebase / fix a required check / grant merge rights), then reply to retry.${docHint}`,
     }),
   });
-};
+  };
+  return handler;
+}
 
+const handler = makeHandler({ readReview: defaultReadReview, readHeadSha: defaultReadHead });
 export default handler;

package/workers/progress-check/worker.ts

@@ -296,7 +296,7 @@ export function makeHandler(deps: {
   readRounds?: RoundsReader;
 }): AppJobHandler<In, Out> {
   return async (job, app) => {
-    const { prKey, status, repo, prNumber, round, huskRetries, roundEntryHead } = job.variables;
+    const { prKey, status, repo, prNumber, round, huskRetries, roundEntryHead, reviewWaitCutoff } = job.variables;
     const jobKey = job.jobKey;
 
     const prs = app.data.table<{
@@ -356,6 +356,13 @@ export function makeHandler(deps: {
         status?: "waiting_review" | "converging";
         agentWatermark?: string | null;
         churnEscalatedRound?: number;
+        /** The review-wait start to stamp instead of "now" (issue #923 review): the converge-gate
+         * emits `reviewWaitCutoff` (the time of ITS review read) when it signals `reviewStale`, so
+         * a head-current review that lands in the window between that read and this park still
+         * satisfies `pollReviews`' `submitted_at >= waiting_since` filter instead of being
+         * discarded — closing the arrival-window race that otherwise re-solicits and times out
+         * despite a valid verdict already sitting unconsumed on the PR. */
+        waitingSince?: string;
       },
     ): Promise<Out> => {
       const ts = new Date().toISOString();
@@ -368,7 +375,9 @@ export function makeHandler(deps: {
         // Only overwrite the baseline when we actually read a head, so a null (unreadable) head
         // never clobbers a good `last_round_head`.
         ...(opts.head ? { last_round_head: opts.head } : {}),
-        ...(opts.status === "waiting_review" ? { status: "waiting_review", waiting_since: ts } : {}),
+        ...(opts.status === "waiting_review"
+          ? { status: "waiting_review", waiting_since: opts.waitingSince ?? ts }
+          : {}),
         ...(opts.status === "converging" ? { status: "converging" } : {}),
         // Advance the attempt watermark ONLY when an agent-work read consumed a `review-round`
         // instance (Copilot #789); `undefined` leaves the persisted watermark untouched (an
@@ -392,8 +401,18 @@ export function makeHandler(deps: {
     const parsed = parsePr(prKey);
     const ghRepo = repo ?? parsed?.repo;
     const ghNumber = typeof prNumber === "number" ? prNumber : parsed?.number;
+    // The review-wait start to stamp on a park. When the converge-gate signalled `reviewStale` it
+    // emitted `reviewWaitCutoff` (the time of ITS review read); parking with `waiting_since` at that
+    // cutoff — rather than "now" — lets a head-current review that landed in the read→park window
+    // satisfy the wait (issue #923 review). Only a non-empty string is honoured; anything else
+    // (absent on a normal round, or a malformed value) falls back to the park time.
+    const waitCutoff =
+      typeof reviewWaitCutoff === "string" && reviewWaitCutoff !== "" ? reviewWaitCutoff : undefined;
     if (!ghRepo || typeof ghNumber !== "number") {
-      return commit({ progressed: true, huskRetries: 0 }, { status: "waiting_review" });
+      return commit(
+        { progressed: true, huskRetries: 0 },
+        { status: "waiting_review", ...(waitCutoff ? { waitingSince: waitCutoff } : {}) },
+      );
     }
 
     // Read the head and record the baseline on EVERY round — including a non-addressed `waiting`
@@ -457,7 +476,12 @@ export function makeHandler(deps: {
     if (!isAddressedStatus(status)) {
       return commit(
         { progressed: true, huskRetries: 0 },
-        { head: currentHead, status: "waiting_review", agentWatermark },
+        {
+          head: currentHead,
+          status: "waiting_review",
+          agentWatermark,
+          ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+        },
       );
     }
 
@@ -528,7 +552,12 @@ export function makeHandler(deps: {
       }
       // Genuine progress → the loop parks at wait-review. THIS is the review-wait park, written only
       // once the husk retry has been ruled out, so a husk-retry round never transits `waiting_review`.
-      return commit(out, { head: currentHead, status: "waiting_review", agentWatermark });
+      return commit(out, {
+        head: currentHead,
+        status: "waiting_review",
+        agentWatermark,
+        ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+      });
     }
 
     // NO-ADVANCE SELF-HEAL (#818, Layer 2). Before escalating to a human, reconcile the round's work
@@ -576,7 +605,12 @@ export function makeHandler(deps: {
           // (husk counter reset), so the poller solicits the next Copilot review against the healed head.
           return commit(
             { progressed: true, huskRetries: 0 },
-            { head: heal.sha, status: "waiting_review", agentWatermark },
+            {
+              head: heal.sha,
+              status: "waiting_review",
+              agentWatermark,
+              ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+            },
           );
         }
       }