@nanobpm/nano-workforce 0.206.0 → 0.206.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.206.1](https://github.com/nanobpm/nano-workforce/compare/v0.206.0...v0.206.1) (2026-11-08)
+
+### Bug Fixes
+
+* **merge:** fail the review backstop closed and retire review waits on merged PRs ([#928](https://github.com/nanobpm/nano-workforce/issues/928)) ([973c161](https://github.com/nanobpm/nano-workforce/commit/973c161d8b279db21915601647c5e8c43f3cac2f)), closes [nano-bpm#1467](https://github.com/nanobpm/nano-bpm/issues/1467) [#927](https://github.com/nanobpm/nano-workforce/issues/927)
+
 ## [0.206.0](https://github.com/nanobpm/nano-workforce/compare/v0.205.2...v0.206.0) (2026-11-08)
 
 ### Features

package/app/pollReviewsTerminal.test.ts

@@ -0,0 +1,175 @@
+// Regression for issue #927 §3 (nano-bpm#1467): after the PR merged, the convergence loop kept
+// re-requesting Copilot reviews on the MERGED PR for six rounds and finally escalated a review
+// timeout. `pollReviews` must check the PR's live state before re-soliciting: a merged/closed PR
+// retires the parked convergence instance and closes the row out — no reviewer-request POST.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
+import { pollReviews } from "./service.ts";
+
+const REPO = "owner/repo";
+const NUMBER = 9;
+
+function memTable(rows: any[], key: string, lookups: unknown[] = []) {
+  return {
+    get: (k: any) => Promise.resolve(rows.find((r) => r[key] === k) ?? null),
+    all: () => Promise.resolve([...rows]),
+    find: (q: any) => Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v))),
+    findOne: (q: any) => {
+      lookups.push(q);
+      return Promise.resolve(rows.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null);
+    },
+    insert: (r: any) => {
+      rows.push(r);
+      return Promise.resolve(r);
+    },
+    update: (k: any, patch: any) => {
+      const r = rows.find((x) => x[key] === k);
+      if (r) Object.assign(r, patch);
+      return Promise.resolve(r);
+    },
+    delete: () => Promise.resolve(),
+  };
+}
+
+type Opts = { reviewsFail?: boolean; reviews?: unknown[]; cancelFails?: boolean; searchState?: string | null };
+
+async function run(prState: { merged: boolean; state: string }, opts: Opts = {}) {
+  const row: any = {
+    pr_key: `${REPO}#${NUMBER}`,
+    repo: REPO,
+    number: NUMBER,
+    status: "waiting_review",
+    last_review_id: 0,
+    waiting_since: "2026-11-08T15:08:58Z",
+    last_nudge_at: "2000-01-01T00:00:00Z",
+    process_key: "589000",
+    updated_at: "t0",
+  };
+  const planLookups: unknown[] = [];
+  const stores: Record<string, { rows: unknown[]; key: string }> = {
+    pull_requests: { rows: [row], key: "pr_key" },
+    merges: { rows: [], key: "id" },
+    plan_tasks: { rows: [], key: "id" },
+  };
+  const data = {
+    table: withTrackingViews((name: string, key: string) => {
+      stores[name] ??= { rows: [], key };
+      return memTable(stores[name].rows, stores[name].key, name === "plan_tasks" ? planLookups : []);
+    }),
+  } as any;
+  const cancelled: string[] = [];
+  const published: string[] = [];
+  const engine = {
+    publishMessage: (m: { name: string }) => {
+      published.push(m.name);
+      return Promise.resolve();
+    },
+    cancelInstance: (a: { processInstanceKey: string }) => {
+      if (opts.cancelFails) return Promise.reject(new Error("transient engine error"));
+      cancelled.push(a.processInstanceKey);
+      return Promise.resolve();
+    },
+    searchProcessInstances: () =>
+      Promise.resolve(
+        opts.searchState === null ? [] : [{ processInstanceKey: "589000", state: opts.searchState ?? "ACTIVE" }],
+      ),
+  } as any;
+  const posts: string[] = [];
+  const prevFetch = globalThis.fetch;
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevTok = process.env["GITHUB_TOKEN"];
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  process.env["GITHUB_TOKEN"] = "test-token";
+  globalThis.fetch = ((url: string | URL | Request, init?: RequestInit) => {
+    const u = String(url);
+    const method = (init?.method ?? "GET").toUpperCase();
+    const json = (b: unknown, status = 200) => Promise.resolve(new Response(JSON.stringify(b), { status }));
+    if (method !== "GET") posts.push(`${method} ${u}`);
+    if (u.includes(`/pulls/${NUMBER}/requested_reviewers`)) return method === "GET" ? json({ users: [] }) : json({}, 201);
+    if (u.includes(`/pulls/${NUMBER}/reviews`) && opts.reviewsFail) return json({ message: "bad gateway" }, 502);
+    if (u.includes(`/pulls/${NUMBER}/reviews`)) return json(opts.reviews ?? []); // default: review requested, none arrived
+    if (u.includes("/git/ref")) return json({ object: { sha: "e597b399" } });
+    if (u.endsWith(`/pulls/${NUMBER}`)) return json({ ...prState, mergeable_state: "clean", head: { sha: "e597b399" } });
+    return json({}, 404);
+  }) as typeof fetch;
+  try {
+    await pollReviews(data, engine, "test-token");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode !== undefined) process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+    else delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    if (prevTok !== undefined) process.env["GITHUB_TOKEN"] = prevTok;
+    else delete process.env["GITHUB_TOKEN"];
+  }
+  return { row, posts, cancelled, published, stores, planLookups };
+}
+
+test("pollReviews #927: a PR MERGED while awaiting review retires the loop — no review re-request", async () => {
+  const { row, posts, cancelled, published } = await run({ merged: true, state: "closed" });
+  assertEquals(posts.length, 0, "no reviewer-request POST on a merged PR");
+  assertEquals(cancelled, ["589000"], "the parked convergence instance is retired");
+  assertEquals(published.length, 0);
+  assertEquals(row.status, "merged");
+  assertEquals(typeof row.merged_at, "string");
+});
+
+test("pollReviews #927: a PR CLOSED unmerged while awaiting review is abandoned — no review re-request", async () => {
+  const { row, posts, cancelled, stores } = await run({ merged: false, state: "closed" });
+  assertEquals(posts.length, 0);
+  assertEquals(cancelled, ["589000"]);
+  assertEquals((stores.merges.rows as any[]).some((m) => m.method === "pr-closed"), true);
+  assertEquals(row.status === "waiting_review", false);
+});
+
+test("pollReviews #927: an OPEN PR awaiting review is still re-solicited (control)", async () => {
+  const { row, posts, cancelled } = await run({ merged: false, state: "open" });
+  assertEquals(cancelled.length, 0);
+  assertEquals(row.status, "waiting_review");
+  assertEquals(posts.length, 1, "the review nudge still fires for a live PR");
+});
+
+const HEAD_CURRENT_REVIEW = [
+  { id: 77, state: "COMMENTED", submitted_at: "2026-11-08T16:00:00Z", commit_id: "e597b399", user: { login: "copilot-pull-request-reviewer[bot]" } },
+];
+
+for (const [label, prState] of [
+  ["MERGED", { merged: true, state: "closed" }],
+  ["CLOSED", { merged: false, state: "closed" }],
+] as const) {
+  test(`pollReviews #927: a HEAD-CURRENT review on a ${label} PR retires the loop — never resumes a round`, async () => {
+    const { row, posts, cancelled, published } = await run(prState, { reviews: HEAD_CURRENT_REVIEW });
+    assertEquals(published.length, 0, "no readiness-ready published for a terminal PR");
+    assertEquals(posts.length, 0);
+    assertEquals(cancelled, ["589000"]);
+    assertEquals(row.status === "waiting_review" || row.status === "converging", false);
+  });
+}
+
+test("pollReviews #927: a failed cancel of a still-LIVE instance leaves the row pollable", async () => {
+  const { row, posts, published } = await run({ merged: true, state: "closed" }, { cancelFails: true, searchState: "ACTIVE" });
+  assertEquals(row.status, "waiting_review", "not finalized while the instance (and its timer) lives");
+  assertEquals(posts.length, 0, "no re-solicit this pass");
+  assertEquals(published.length, 0);
+});
+
+for (const searchState of ["COMPLETED", null] as const) {
+  test(`pollReviews #927: a failed cancel of an already-${searchState ?? "gone"} instance still finalizes`, async () => {
+    const { row } = await run({ merged: true, state: "closed" }, { cancelFails: true, searchState });
+    assertEquals(row.status, "merged");
+  });
+}
+
+test("pollReviews #927: a PR merged externally while awaiting review runs the retro hook", async () => {
+  // maybeStartRetro resolves the PR's plan via `plan_tasks`; the lookup proves the hook ran.
+  const { planLookups } = await run({ merged: true, state: "closed" });
+  assertEquals(planLookups, [{ pr_key: `${REPO}#${NUMBER}` }]);
+});
+
+test("pollReviews #927: a MERGED PR whose review fetch FAILS is still retired (terminal check precedes fetch)", async () => {
+  const { row, posts, cancelled, published } = await run({ merged: true, state: "closed" }, { reviewsFail: true });
+  assertEquals(cancelled, ["589000"]);
+  assertEquals(published.length, 0);
+  assertEquals(posts.length, 0);
+  assertEquals(row.status, "merged");
+});

package/app/service.ts

@@ -100,6 +100,7 @@ import { ENGINE_TERMINAL_STATES } from "./reconcile.ts";
 // (submitPr/startMerge) and re-exported below so the long-standing `import { repoEnvelopeVars } from
 // "./service.ts"` call sites (and its tests) keep resolving.
 import { repoEnvelopeVars } from "./repoEnvelope.ts";
+import { maybeStartRetro } from "./retro.ts";
 import { clampNudgeMinutes, isoDurationToMs, isReviewStale, reviewWaitTimeout } from "./reviewWait.ts";
 import { trialMergeAudits } from "./trialMerge.ts";
 import {
@@ -1283,6 +1284,13 @@ export async function pollReviews(data: DataLayer, engine: EngineClient, token:
     const { repo, number, pr_key: prKey } = pr;
     const lastId = pr.last_review_id ?? 0;
     try {
+      // #927: a PR that already landed/closed must never resume or re-solicit a review — whatever
+      // the review freshness (no review, stale review, OR a head-current one landing after the
+      // merge). Check terminal state FIRST — before even fetching reviews, so a failing
+      // reviews endpoint (e.g. 502) can't strand a merged PR in `waiting_review` with a live timer — so no branch below can route a merged PR back into a
+      // review round. `null` → handled-but-not-finalized (cancel failed): skip this pass, stay pollable.
+      const retired = await retireTerminalReviewWait(data, engine, pr, token);
+      if (retired !== false) continue;
       const reviews = await fetchPrReviews(repo, number, token);
       if (reviews === null) return; // no usable transport (no gh, no token) → idle
       const fresh = reviews
@@ -1342,6 +1350,60 @@ export async function pollReviews(data: DataLayer, engine: EngineClient, token:
   }
 }
 
+/** Review-wait out-of-band terminal check (issue #927). nano-bpm#1467 landed while its convergence
+ * loop was parked at `wait-review`; the poller then kept re-requesting Copilot reviews on the MERGED
+ * PR for six rounds and finally escalated a review timeout no human could act on. Before any
+ * re-solicitation, read the PR's live state: if it is terminal (merged or closed) the review wait is
+ * moot, so RETIRE the parked convergence instance (`process_key`) and close the row out — `merged`
+ * (with `merged_at`) for a landed PR, the canonical `abandonClosedPr` for a closed-unmerged one.
+ * Conservative: an unreadable/open state returns `false` and the caller re-solicits as before.
+ * Exported for tests. */
+export async function retireTerminalReviewWait(
+  data: DataLayer,
+  engine: EngineClient,
+  pr: PullRequest,
+  token: string,
+): Promise<boolean | null> {
+  const st = await fetchPrState(pr.repo, pr.number, token).catch(() => null);
+  const liveness = classifyPrLiveness(st);
+  if (liveness !== "merged" && liveness !== "closed") return false;
+  if (pr.process_key != null) {
+    const key = String(pr.process_key);
+    try {
+      await engine.cancelInstance({ processInstanceKey: key });
+    } catch (err) {
+      // Only finalize the row once the instance is confirmed gone/terminal: a transiently-failed
+      // cancel would otherwise drop the row from `waiting_review` scans while the live instance's
+      // review-timeout timer still escalates a human. Unconfirmed → stay pollable, retry next pass.
+      let confirmedTerminal = false;
+      try {
+        const match = (await engine.searchProcessInstances({ processInstanceKeys: [key] })).find(
+          (s) => String(s.processInstanceKey) === key,
+        );
+        confirmedTerminal = !match || ENGINE_TERMINAL_STATES.has(String(match.state ?? "").trim().toUpperCase());
+      } catch {
+        confirmedTerminal = false;
+      }
+      if (!confirmedTerminal) {
+        console.error(`[poller] ${pr.pr_key}: retire review-wait instance ${key} failed, retrying next pass: ${err}`);
+        return null;
+      }
+    }
+  }
+  if (liveness === "merged") {
+    const ts = now();
+    await prs(data).update(pr.pr_key, { status: "merged", merged_at: ts, updated_at: ts });
+    // Reuse the merged-completion side effect `pr.mark-merged`/`pr.finalize` run: an externally
+    // merged PR may be its plan's last to settle, so its automatic retrospective must still start.
+    // `maybeStartRetro` is best-effort and never throws.
+    await maybeStartRetro(data, engine, pr.pr_key);
+  } else {
+    await abandonClosedPr(data, pr.pr_key, "PR was closed on GitHub while awaiting review — retiring the convergence loop");
+  }
+  console.log(`[poller] ${liveness} while waiting for review -> retired loop ${pr.pr_key}`);
+  return true;
+}
+
 /** Ensure a Copilot review is in flight for a PR still waiting, throttled to one attempt per
  * REVIEW_NUDGE_MS window. Skips when Copilot is already a pending reviewer (a review is coming);
  * otherwise re-requests one and records the nudge. This is the primary liveness mechanism — the

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.206.0",
-  "gitSha": "e5eedca0ee28db1f54167b4bb962ce4c06776e9f",
-  "gitTag": "v0.206.0",
-  "builtAt": "2026-11-08T12:12:11.017Z"
+  "version": "0.206.1",
+  "gitSha": "973c161d8b279db21915601647c5e8c43f3cac2f",
+  "gitTag": "v0.206.1",
+  "builtAt": "2026-11-08T20:26:54.809Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.206.0",
+  "version": "0.206.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/workers/merge/worker.test.ts

@@ -112,6 +112,13 @@ test("pr.merge short-circuits an already-merged PR without re-running the land p
 // would stay green if the verb regressed.
 type GithubCall = { url: string; method: string };
 
+// A handler whose review backstop sees a VERIFIED head-current review, so land-protocol tests
+// exercise the protocol dispatch (the backstop now fails CLOSED on an unreadable read, #927).
+const reviewedHandler = makeHandler({
+  readReview: async () => ({ body: "lgtm", commitId: "reviewedhead" }),
+  readHeadSha: async () => "reviewedhead",
+});
+
 function withGithub(
   routes: (url: string, init: RequestInit | undefined) => Response | null,
   run: (calls: GithubCall[]) => Promise<void>,
@@ -153,7 +160,7 @@ test("pr.merge routes a mergify-queue repo through the queued branch (enqueue co
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#7", repo: "acme/widgets", prNumber: 7 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -189,7 +196,7 @@ test("pr.merge routes a refused merge through the blocked branch (escalation pay
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#9", repo: "acme/widgets", prNumber: 9 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -229,7 +236,7 @@ test("pr.merge routes a transient base-moved race through the retry branch (no e
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#11", repo: "acme/widgets", prNumber: 11 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -383,33 +390,63 @@ test("pr.merge #923: a HEAD-CURRENT review lands normally (backstop control)", a
   );
 });
 
-test("pr.merge #923: an UNREADABLE review/head fails OPEN (a transport hiccup never wedges a merge)", async () => {
-  await withGithub(
-    (url) => {
-      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
-      return backstopRoutes(url);
-    },
-    async (calls) => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => null, // no usable transport → unverifiable, NOT "no review"
-        readHeadSha: async () => {
-          throw new Error("boom");
-        },
-      });
-      const out = (await backstop(
-        { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
-        app,
-      )) as Record<string, unknown>;
+for (const [label, readReview, readHeadSha] of [
+  ["review read null", async () => null, async () => "h9"],
+  ["review read throws", async () => { throw new Error("boom"); }, async () => "h9"],
+  ["head read null", async () => ({ body: "lgtm", commitId: "h9" }), async () => null],
+  ["head read throws", async () => ({ body: "lgtm", commitId: "h9" }), async () => { throw new Error("boom"); }],
+  ["head read empty", async () => ({ body: "lgtm", commitId: "h9" }), async () => "  "],
+] as const) {
+  test(`pr.merge #927: an UNVERIFIABLE backstop read (${label}) fails CLOSED — no land, audited refusal`, async () => {
+    await withGithub(
+      (url) => {
+        if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(out.status, "blocked");
+        assertEquals((out.question as string).includes("could not be read"), true);
+        assertEquals(stores.merges.length, 1);
+        assertEquals(stores.merges[0].outcome, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+      },
+    );
+  });
+}
 
-      assertEquals(out, { mergeStatus: "merged" });
-      assertEquals(
-        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
-        true,
-      );
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    },
-  );
+test("pr.merge #927: reproduces nano-bpm#1467 — review REQUESTED but not yet arrived on a mergify-queue repo → no `@mergifyio queue`", async () => {
+  const protocol =
+    "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+  for (const readReview of [async () => ({ body: "", commitId: null }), async () => null]) {
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha: async () => "e597b399" } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#1467", repo: "acme/widgets", prNumber: 1467 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+      },
+    );
+  }
 });
 
 test("pr.merge #923: a head-current review whose summary reports OPEN findings blocks landing", async () => {
@@ -427,23 +464,6 @@ test("pr.merge #923: a head-current review whose summary reports OPEN findings b
   });
 });
 
-for (const [label, readHeadSha] of [
-  ["returns null", async () => null],
-  ["throws", async () => { throw new Error("transient"); }],
-] as const) {
-  test(`pr.merge #923: an unverifiable head (read ${label}) never blocks on a possibly-stale review's open findings`, async () => {
-    await withGithub(backstopRoutes, async () => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "old" }),
-        readHeadSha,
-      });
-      await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app);
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    });
-  });
-}
-
 test("pr.merge #923: the direct merge pins the verified head SHA (no check-then-merge race)", async () => {
   let putBody = "";
   await withGithub(
@@ -485,3 +505,36 @@ test("pr.merge #923: a queue-comment repo whose head moved after the backstop re
     },
   );
 });
+
+for (const [label, finalRead] of [
+  ["null", async () => null],
+  ["throwing", async () => {
+    throw new Error("502");
+  }],
+  ["blank", async () => "  "],
+] as const) {
+  test(`pr.merge #927: a queue-comment repo whose FINAL head re-read is ${label} retries instead of enqueueing`, async () => {
+    const protocol =
+      "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        let n = 0;
+        const backstop = makeHandler({
+          readReview: async () => ({ body: "lgtm", commitId: "h3" }),
+          readHeadSha: async () => (n++ === 0 ? "h3" : finalRead()),
+        } as any);
+        const out = (await backstop({ variables: { prKey: "acme/widgets#34", repo: "acme/widgets", prNumber: 34 } } as any, app)) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "retry");
+        assertEquals(stores.merges.some((m) => m.outcome === "retry"), true, "retry audit row");
+        assertEquals(calls.some((c) => /\/issues\/\d+\/comments$/.test(c.url) && c.method === "POST"), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false, "no merge call");
+      },
+    );
+  });
+}

package/workers/merge/worker.ts

@@ -15,10 +15,9 @@
 // it reviewed — a head that MOVED between convergence and landing, or a review that never existed
 // (the #1443 fail-open), must not slip through at land time. Before running ANY land protocol this
 // worker re-checks that a HEAD-CURRENT Copilot review exists; a missing/stale review blocks the
-// landing (escalating to a human) instead of enqueueing/merging unreviewed code. The check fails
-// OPEN only when the GitHub state is UNREADABLE (no transport / a hiccup) — the merge-stage
-// mergeability polling is the independent backstop there, and a hard block on a transient read
-// would wedge every merge on a network blip.
+// landing (escalating to a human) instead of enqueueing/merging unreviewed code. An UNREADABLE
+// review/head ALSO blocks (fails CLOSED, issue #927) — the old fail-open let nano-bpm#1467 land
+// 49 s before its first review.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
@@ -59,6 +58,9 @@ const defaultReadReview: MergeReviewReader = (repo, prNumber) =>
 // bind (#786/#799), so the backstop's staleness comparison sees the exact head the gate did.
 const defaultReadHead: HeadReader = makeDefaultReadHead({ fetchPrHead, fetchBranchHead });
 
+const BLOCK_UNVERIFIABLE_REVIEW =
+  "the PR's Copilot review state or current HEAD could not be read, so a head-current reviewer verdict cannot be verified (the backstop fails CLOSED on an unverifiable read)";
+
 const BLOCK_NO_HEAD_CURRENT_REVIEW =
   "no head-current Copilot review exists for the PR's current HEAD (the head moved after the last review, or no review was ever submitted). A head-current reviewer verdict is required before landing";
 
@@ -132,26 +134,31 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // existed at all (the nano-bpm#1443 fail-open: merged with ZERO reviews), must not slip through
   // at land time. Runs AFTER the merged/closed short-circuits (an already-terminal PR needs no
   // verdict) and BEFORE any land protocol (the `@mergifyio queue` comment is itself the landing
-  // for a queue repo). Fails OPEN only when the GitHub state is UNREADABLE (no transport / a
-  // hiccup → `null` review or head): a transient read failure must not wedge every merge — the
-  // merge-stage mergeability polling is the independent backstop there.
+  // for a queue repo). Fails CLOSED on an UNREADABLE review/head too (issue #927).
   const [backstopReview, backstopHead] = await Promise.all([
     readReview(repo, prNumber).catch(() => null),
     readHeadSha(repo, prNumber).catch(() => null),
   ]);
-  if (backstopReview !== null && isReviewMissingOrStale(backstopReview.commitId, backstopHead)) {
+  // FAIL CLOSED (issue #927): a gate whose job is "never land unreviewed" must not land on an
+  // UNVERIFIABLE read. nano-bpm#1467 merged 49 s before its first Copilot review because a `null`
+  // review/head read (or an empty head) skipped this check entirely. An unreadable review or head now
+  // blocks (escalating to a human, who replies to retry) exactly like a missing/stale review.
+  const headTrimmed = (backstopHead ?? "").trim();
+  const unverifiable = backstopReview === null || headTrimmed === "";
+  if (unverifiable || isReviewMissingOrStale(backstopReview.commitId, headTrimmed)) {
+    const detail = unverifiable ? BLOCK_UNVERIFIABLE_REVIEW : BLOCK_NO_HEAD_CURRENT_REVIEW;
     await app.data.table("merges", "id").insert({
       pr_key: prKey,
       outcome: "blocked",
       method: "review-backstop",
-      detail: BLOCK_NO_HEAD_CURRENT_REVIEW,
+      detail,
       at: now,
     });
     return {
       mergeStatus: "blocked",
       status: "blocked",
       question:
-        `Merge refused: ${BLOCK_NO_HEAD_CURRENT_REVIEW}. ` +
+        `Merge refused: ${detail}. ` +
         `Push no further commits, wait for the Copilot review of the current HEAD to land (or request one: ` +
         `gh api repos/${repo}/pulls/${prNumber}/requested_reviewers -X POST -f "reviewers[]=copilot-pull-request-reviewer[bot]"), ` +
         `let the convergence loop gate on it, then reply to retry.`,
@@ -161,12 +168,8 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // A head-current review whose OWN summary still reports open findings (the same canonical
   // verdict parser the converge-gate uses) must block too: a summary-only "Changes recommended"
   // review that landed after convergence has no unresolved thread for mergeability polling to see.
-  // Only evaluate the verdict once head-currentness is VERIFIED (review read AND head read succeeded
-  // and match) — an unreadable head fails open here like the stale check above, never blocking on a
-  // possibly-stale review's body.
-  const reviewIsHeadCurrent =
-    backstopReview !== null && backstopHead !== null && backstopHead !== "" && backstopReview.commitId === backstopHead;
-  const openFindings = reviewIsHeadCurrent ? parseReviewOpenFindings(backstopReview.body) : [];
+  // Head-currentness is VERIFIED at this point (the fail-closed check above returned otherwise).
+  const openFindings = parseReviewOpenFindings(backstopReview.body);
   if (openFindings.length > 0) {
     const detail = `the head-current Copilot review reports open findings (${openFindings.join(", ")})`;
     await app.data.table("merges", "id").insert({
@@ -186,7 +189,7 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   }
   // The head the backstop verified — pinned through the land call so a push between this check
   // and the merge can never land a later, unreviewed head.
-  const verifiedHead = backstopReview !== null && backstopHead ? backstopHead : undefined;
+  const verifiedHead: string | undefined = headTrimmed;
 
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
@@ -227,10 +230,14 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
     const comment = protocol?.land.comment ?? "@mergifyio queue";
     // A comment can't pin a SHA, so re-read the head right before enqueueing: if it moved past the
     // verified head, re-enter via the bounded retry (which re-runs the backstop on the new head).
-    const headNow = verifiedHead ? await readHeadSha(repo, prNumber).catch(() => null) : null;
-    if (verifiedHead && headNow !== null && headNow !== verifiedHead) {
+    // Fail CLOSED (#927): an unreadable re-read retries rather than enqueueing an unverified head.
+    const headNow = await readHeadSha(repo, prNumber).catch(() => null);
+    if (headNow === null || headNow.trim() !== verifiedHead) {
       outcome = "retry";
-      detail = `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
+      detail =
+        headNow === null
+          ? `head could not be re-read after the review backstop; re-verifying before enqueue`
+          : `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
     } else {
       const ok = await enqueueViaComment(repo, prNumber, token, comment);
       outcome = ok ? "queued" : "blocked";