@nanobpm/nano-workforce 0.206.0 → 0.206.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.206.2](https://github.com/nanobpm/nano-workforce/compare/v0.206.1...v0.206.2) (2026-11-09)
+
+### Bug Fixes
+
+* **merge:** let a DIRTY state outrank absent required checks so a conflicting PR reaches the rebase arm ([#930](https://github.com/nanobpm/nano-workforce/issues/930)) ([71984d5](https://github.com/nanobpm/nano-workforce/commit/71984d5d607151b2c3690a12d6b05537b24c3ece)), closes [#392](https://github.com/nanobpm/nano-workforce/issues/392) [nanobpm/nano-bpm#1444](https://github.com/nanobpm/nano-bpm/issues/1444) [#929](https://github.com/nanobpm/nano-workforce/issues/929)
+
+## [0.206.1](https://github.com/nanobpm/nano-workforce/compare/v0.206.0...v0.206.1) (2026-11-08)
+
+### Bug Fixes
+
+* **merge:** fail the review backstop closed and retire review waits on merged PRs ([#928](https://github.com/nanobpm/nano-workforce/issues/928)) ([973c161](https://github.com/nanobpm/nano-workforce/commit/973c161d8b279db21915601647c5e8c43f3cac2f)), closes [nano-bpm#1467](https://github.com/nanobpm/nano-bpm/issues/1467) [#927](https://github.com/nanobpm/nano-workforce/issues/927)
+
 ## [0.206.0](https://github.com/nanobpm/nano-workforce/compare/v0.205.2...v0.206.0) (2026-11-08)
 
 ### Features

package/app/github.test.ts

@@ -719,6 +719,49 @@ const MERGE_CASES: MergeCase[] = [
     protocol: protocolWith({ requiredChecks: reqChecks("build"), waitForChecks: true }),
     want: "waiting",
   },
+  // ── DIRTY outranks an ABSENT/PENDING required check (issue #929) ─────────────────────────────
+  // GitHub does not run `pull_request` workflows on a PR with merge conflicts, so a DIRTY head
+  // reports its declared-required checks as ABSENT (or skipped). Mapping that absence to `waiting`
+  // deadlocks the merge loop: the checks can never arrive until the conflict is resolved, and the
+  // conflict is never routed to the rebase arm because the checks read as "not yet run". The
+  // conflict is ground truth whose remedy (a rebase) is also exactly what re-triggers CI, so DIRTY
+  // outranks absence — but NOT a red declared-required check, which still routes to fix-ci.
+  {
+    name: "DIRTY + declared-required check ABSENT -> conflict, not waiting (the #929 deadlock)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "summary", conclusion: "SKIPPED" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("typecheck + test (Node)", "whole-repo invariants") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + no check runs at all -> conflict (absence is a consequence of the conflict)",
+    state: { mergeStateStatus: "DIRTY" },
+    protocol: protocolWith({ requiredChecks: reqChecks("build"), waitForChecks: true }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + declared-required check PENDING -> conflict (rebase, then CI re-runs on the new head)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "QUEUED" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + declared-required check present-but-unconcluded -> conflict",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "IN_PROGRESS" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + RED declared-required check -> blocked (a red check still outranks the conflict)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "FAILURE" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "blocked",
+  },
+  {
+    name: "DIRTY + green declared-required checks -> conflict (unchanged pre-#929 behaviour)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "SUCCESS" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
 ];
 
 for (const c of MERGE_CASES) {

package/app/github.ts

@@ -1621,7 +1621,6 @@ export function classifyMergeability(s: PrState, protocol?: MergeProtocol): Merg
   // settled-thread routing below.
   const gate = requiredChecksVerdict(s, protocol);
   if (gate === "blocked") return "blocked";
-  if (gate === "waiting") return "waiting";
   // A GitHub-identified merge conflict (`mergeStateStatus: "DIRTY"`) is ground truth whose remedy is
   // a rebase, dispatched off the `conflict` verdict. It outranks the thread gate below (PR #922
   // review, thread 1): a FAILED thread probe (`THREAD_PROBE_FAILED`) returning `waiting` here would
@@ -1630,7 +1629,18 @@ export function classifyMergeability(s: PrState, protocol?: MergeProtocol): Merg
   // round that cannot clear it. Surface the conflict first; the threads are re-triaged once the
   // rebased head is re-read. (A red declared-required check still outranks even this — see the
   // backstop above — so a conflicting PR with failing CI routes to fix-ci, not a doomed rebase.)
+  //
+  // DIRTY also outranks a `waiting` required-checks verdict (issue #929): GitHub does NOT run
+  // `pull_request` workflows on a PR with merge conflicts, so a conflicting head reports its
+  // declared-required checks as ABSENT (or skipped) — and `requiredChecksVerdict` maps absence to
+  // `waiting`. Evaluated in the old order that deadlocked the merge loop: the checks can never
+  // arrive until the conflict is resolved, and the conflict was never routed to the rebase arm
+  // because the absent checks read as "not yet run". The absence is a CONSEQUENCE of the conflict,
+  // and the conflict's remedy (a rebase) is exactly what re-triggers CI on the new head — so the
+  // conflict owns the verdict. Only a RED declared-required check (`blocked`, handled above) may
+  // still outrank DIRTY.
   if (s.mergeStateStatus === "DIRTY") return "conflict";
+  if (gate === "waiting") return "waiting";
   // The merge-stage thread gate (issue #921, PR #922 review): a read that opted into the
   // review-threads probe and found ≥1 open thread (`unresolvedThreads > 0`) is NEVER merge-ready,
   // whatever `mergeStateStatus` says. A repo without branch-protection

package/app/mergeLoopBehaviour.test.ts

@@ -498,7 +498,9 @@ test("the 'waiting' re-poll is bounded — exhausting mergeStallMax escalates to
   const engine = await boot({
     vars: { mergeStallMax: 0 },
     responses: {
-      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "" },
+      // The probe always emits the full tri-state (a failed read reports reviewThreads: -1) — the
+      // escalation wording reads it, so the test payload must carry it.
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
     },
   });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
@@ -509,6 +511,186 @@ test("the 'waiting' re-poll is bounded — exhausting mergeStallMax escalates to
   assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("wait-mergeable-repoll", "merge-stall-probe", "merge-esc-conflict");
 });
 
+// ---------------------------------------------------------------------------
+// #929 — a DIRTY PR whose required checks are ABSENT (GitHub skips pull_request
+// workflows on a conflicting head) must route to the rebase arm, never to the
+// misleading "all checks green … needs approval" escalation.
+// ---------------------------------------------------------------------------
+
+test("a DIRTY PR with absent required checks reaches SP_rebase via the stall probe (#929)", async () => {
+  // The incident (nanobpm/nano-bpm#1444): REST reported mergeable=false/dirty and every
+  // declared-required check was ABSENT (GitHub skips CI on a conflicting head), yet the loop
+  // escalated "needs approval" twice and never dispatched the rebase. With the classifier fix,
+  // the stall probe re-derives `conflict` and the token reaches the rebase agent.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  // The poller's pre-fix verdict was `waiting` (absent required checks outranked DIRTY), so the
+  // instance is parked on the mergeable wait when the stall timer fires.
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("merge-stall-probe", "rebase") // the rebase agent ran — SP_rebase was reached
+    .hasVariable("rebaseRound", 1);
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "a DIRTY PR must rebase, not escalate 'needs approval'");
+  const openTasks = await engine.searchUserTasks({});
+  assert(!openTasks.some((t) => t.elementId === "wait-merge-answer"), "no human escalation on the rebase path");
+});
+
+test("a stall escalation on a DIRTY PR never claims 'all checks green' — it names the conflict (#929)", async () => {
+  // The pre-fix escalation built "all checks green (none failing, none pending)" from
+  // `failingChecks = 0 and pendingChecks = 0` — but on a DIRTY head those zeros mean GitHub
+  // SKIPPED the required checks, not that they passed. The approval wording must stay gated on a
+  // PROBED-and-clear thread count; a DIRTY PR (whose `conflict` verdict is only reachable via the
+  // rebase arm) that still lands here keeps the conservative wording instead of the false claim.
+  const engine = await boot({
+    vars: { mergeStallMax: 0, rebaseMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-stall-probe", "merge-esc-conflict");
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("all checks green"), "absent/unprobed checks must never read as 'all checks green'");
+  assert(!q.includes("required review approval"), "a conflict must never read as a review-approval wait");
+  assertStringIncludes(q, "merge conflict", "the conflict escalation must name the conflict");
+  // PR #930 review: the verdict alone does not establish that the required checks are ABSENT —
+  // a conflicting head can carry successful required checks, and a failed read reports the same
+  // zeros — so the escalation may only note that GitHub MAY not have run them, never assert it.
+  assert(!q.includes("absent, NOT green"), "the verdict alone never establishes that the required checks are absent");
+  assertStringIncludes(q, "may not have run", "the escalation notes the check-skip caveat without asserting it");
+});
+
+test("a conflict-verdict escalation with GREEN required checks still names only the conflict (#930 review)", async () => {
+  // The mirror case the review called out: `conflict` with every required check successful. The
+  // escalation must not claim the checks are absent or not-green — only the conflict is known.
+  const engine = await boot({
+    vars: { mergeStallMax: 0, rebaseMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "merge conflict", "the conflict escalation must name the conflict");
+  assert(!q.includes("NOT green"), "green required checks must never be described as not-green");
+  assert(!q.includes("all checks green"), "the escalation asserts the conflict, not the check state either way");
+});
+
+test("a stalled 'waiting' with clear threads and zero checks never asserts the required checks ran (#930 review)", async () => {
+  // `waiting` + reviewThreads>0 + failing=0/pending=0 is ambiguous: the required checks may be
+  // absent (never ran on a conflicting head) rather than green. The escalation must float both
+  // candidates — a conflict whose checks never ran, or a review-approval requirement — and send
+  // the human to the PR, never assert "no failing or pending checks" as if the rollup were green.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-stall-probe", "merge-esc-conflict");
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("all checks green"), "zero counts with clear threads must never claim green checks");
+  assert(!q.includes("NO failing or pending checks"), "zero counts do not establish that the required checks ran");
+  assert(!q.includes("required review approval is outstanding"), "an ambiguous read must never assert a verified review-approval blocker");
+  assertStringIncludes(q, "not verified", "the approval blocker must be floated, not asserted");
+  assertStringIncludes(q, "may never have run", "the escalation must allow that the required checks never ran");
+});
+
+test("a stalled 'waiting' with unresolved threads reports their count and asks to resolve them (#930 review)", async () => {
+  // Absent required checks can yield `waiting` before the thread gate runs; the verified unresolved
+  // threads must be surfaced, since resolving a conflict or approving does not clear them.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: 2, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "2 unresolved review thread(s)", "the verified thread count must be reported");
+  assertStringIncludes(q, "Resolve those conversations", "the operator must be asked to resolve the threads");
+  assertStringIncludes(q, "may never have run", "the check state stays unverified");
+  assert(!q.includes("all checks green"), "never claim green checks");
+});
+
+test("a stall escalation after a FAILED GitHub read says the state could not be read — never a confirmed conflict (#930 review)", async () => {
+  // The stall probe's catch maps a failed read to `waiting`, reviewThreads -1, zero checks — the
+  // exact payload the pre-fix wording read as a confirmed conflict. The escalation must report an
+  // unreadable state and nothing more specific.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "could not be fully read", "a failed read must be named as such");
+  assert(!q.includes("CONFLICTING"), "a failed read must never assert a confirmed conflict");
+  assert(!q.includes("required review approval"), "a failed read must never assert a review-approval blocker");
+});
+
+test("a stall give-up with no remediation attempted never claims a remediation budget was exhausted (#930 review)", async () => {
+  for (const mergeState of ["conflict", "blocked"]) {
+    const engine = await boot({
+      vars: { mergeStallMax: 0 },
+      responses: {
+        "pr.merge-stall-probe": { mergeState, failingChecks: mergeState === "blocked" ? 1 : 0, failingChecksList: mergeState === "blocked" ? "ci" : "", reviewThreads: 0, pendingChecks: 0 },
+      },
+    });
+    await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+    await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+    const q = String(escalation(engine).question ?? "");
+    if (q === "") continue; // routed to a remediation agent rather than the direct give-up
+    assert(!/budget|exhausted/.test(q), `${mergeState}: the escalation must not claim an exhausted budget: ${q}`);
+  }
+});
+
+test("answering 'retry' on a DIRTY PR's escalation re-arms the poller, which re-derives conflict and rebases (#929)", async () => {
+  // The incident's second half: a human answered "retry" and the loop re-classified the same way
+  // and escalated again — the rebase was never reached. Post-fix the retry re-arms the poller; the
+  // next verdict for the still-DIRTY PR is `conflict`, which dispatches the rebase agent.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  // The human replies "retry" — the answer reconciles then re-arms the poller.
+  await engine.completeUserTask(await mergeAnswerTaskKey(engine), { answer: "retry" });
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  // The re-armed poller now classifies the DIRTY PR as `conflict` (absent required checks no
+  // longer outrank DIRTY) and the rebase agent is dispatched.
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "conflict" } });
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("record-merge-answer", "rebase")
+    .hasVariable("rebaseRound", 1);
+});
+
 test("an unclassified verdict routes to auto-rebase (DEFAULT), not to a human (#774)", async () => {
   // The DEFAULT arm is a last-resort self-heal, not a page: an unexpected/garbage `mergeState` routes
   // to the bounded rebase agent (which reconciles from ground truth), never straight to a human.
@@ -637,7 +819,7 @@ test("the 'never settled' question is reserved for a genuinely unreadable/unsett
   const engine = await boot({
     vars: { mergeStallMax: 0 },
     responses: {
-      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1 },
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
     },
   });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
@@ -645,8 +827,8 @@ test("the 'never settled' question is reserved for a genuinely unreadable/unsett
   await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
   assertStringIncludes(
     String(escalation(engine).question ?? ""),
-    "never settled",
-    "a genuinely unsettled/unreadable mergeability keeps the original message",
+    "could not be fully read",
+    "a genuinely unsettled/unreadable mergeability names the unreadable state",
   );
 });
 
@@ -871,6 +1053,31 @@ test("a conflict runs the bounded rebase agent and a rebased result re-arms the
     .hasVariable("rebaseRound", 1); // the rebase counter advanced across the sub-process boundary
 });
 
+test("a rebase agent cannot spoof the escalation verdict by returning mergeState (#930 self-review)", async () => {
+  // The agent's result keys are hoisted into process scope, and `mergeState` now selects the
+  // shared merge-esc-conflict wording. A rebase agent that returns a bogus `mergeState:"ready"`
+  // must NOT be able to rewrite a "could not resolve the conflict" escalation into a
+  // green-checks/approval message: the trusted `end_reb_blocked` end event re-stamps the verdict.
+  const engine = await boot({ responses: { "senior:rebase": { status: "blocked", mergeState: "ready" } } });
+  await driveToRebase(engine);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-attempt");
+  assertStringIncludes(String(escalation(engine).question ?? ""), "rebase agent could not resolve", "the question must name the conflict trigger, not the spoofed verdict");
+  assertThatInstance(engine, byProcessId("merge-loop")).hasVariable("mergeState", "conflict");
+});
+
+test("a fix-ci agent cannot spoof the escalation verdict by returning mergeState (#930 self-review)", async () => {
+  // Same guard on the CI-fix side: a fix-ci agent that exhausts its budget after returning a bogus
+  // `mergeState` must still escalate with the CI-fix wording — `end_ci_esc` re-stamps the verdict.
+  const engine = await boot({ responses: { "senior:fix-ci": { status: "blocked", pushed: true, mergeState: "ready" } } });
+  await driveToCiFix(engine);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-attempt");
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "could not make the required checks green", "the question must name the CI-fix failure, not the spoofed verdict");
+  assertThatInstance(engine, byProcessId("merge-loop")).hasVariable("mergeState", "blocked");
+});
+
 test("a rebase that cannot resolve escalates with a conflict question", async () => {
   const engine = await boot({ responses: { "senior:rebase": { status: "blocked" } } });
   await driveToRebase(engine);
@@ -967,6 +1174,10 @@ test("the rebase agent SLA interrupts the sub-process and escalates as not-merge
   assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-conflict");
   // #879 regression: the trusted rebase SLA arm must deliver its job-type marker to the shared sink.
   assertEquals(escalation(engine).agentSlaJobType, "senior:rebase", "the rebase SLA arm must reach the recorder with its job-type marker");
+  // The SLA escalation must never surface the stale `conflict` verdict's wording — the recorder's
+  // SLA builder (keyed on the trusted marker) owns the question, not the verdict FEEL.
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("CONFLICTING") && !q.includes("merge conflict with the base branch"), "an SLA escalation must not read as a verdict escalation");
 });
 
 test("a non-SLA escalation carrying a spoofed agentSlaJobType is scrubbed before the recorder (#879 fail-closed)", async () => {

package/app/pollReviewsTerminal.test.ts

@@ -0,0 +1,175 @@
+// Regression for issue #927 §3 (nano-bpm#1467): after the PR merged, the convergence loop kept
+// re-requesting Copilot reviews on the MERGED PR for six rounds and finally escalated a review
+// timeout. `pollReviews` must check the PR's live state before re-soliciting: a merged/closed PR
+// retires the parked convergence instance and closes the row out — no reviewer-request POST.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
+import { pollReviews } from "./service.ts";
+
+const REPO = "owner/repo";
+const NUMBER = 9;
+
+function memTable(rows: any[], key: string, lookups: unknown[] = []) {
+  return {
+    get: (k: any) => Promise.resolve(rows.find((r) => r[key] === k) ?? null),
+    all: () => Promise.resolve([...rows]),
+    find: (q: any) => Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v))),
+    findOne: (q: any) => {
+      lookups.push(q);
+      return Promise.resolve(rows.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null);
+    },
+    insert: (r: any) => {
+      rows.push(r);
+      return Promise.resolve(r);
+    },
+    update: (k: any, patch: any) => {
+      const r = rows.find((x) => x[key] === k);
+      if (r) Object.assign(r, patch);
+      return Promise.resolve(r);
+    },
+    delete: () => Promise.resolve(),
+  };
+}
+
+type Opts = { reviewsFail?: boolean; reviews?: unknown[]; cancelFails?: boolean; searchState?: string | null };
+
+async function run(prState: { merged: boolean; state: string }, opts: Opts = {}) {
+  const row: any = {
+    pr_key: `${REPO}#${NUMBER}`,
+    repo: REPO,
+    number: NUMBER,
+    status: "waiting_review",
+    last_review_id: 0,
+    waiting_since: "2026-11-08T15:08:58Z",
+    last_nudge_at: "2000-01-01T00:00:00Z",
+    process_key: "589000",
+    updated_at: "t0",
+  };
+  const planLookups: unknown[] = [];
+  const stores: Record<string, { rows: unknown[]; key: string }> = {
+    pull_requests: { rows: [row], key: "pr_key" },
+    merges: { rows: [], key: "id" },
+    plan_tasks: { rows: [], key: "id" },
+  };
+  const data = {
+    table: withTrackingViews((name: string, key: string) => {
+      stores[name] ??= { rows: [], key };
+      return memTable(stores[name].rows, stores[name].key, name === "plan_tasks" ? planLookups : []);
+    }),
+  } as any;
+  const cancelled: string[] = [];
+  const published: string[] = [];
+  const engine = {
+    publishMessage: (m: { name: string }) => {
+      published.push(m.name);
+      return Promise.resolve();
+    },
+    cancelInstance: (a: { processInstanceKey: string }) => {
+      if (opts.cancelFails) return Promise.reject(new Error("transient engine error"));
+      cancelled.push(a.processInstanceKey);
+      return Promise.resolve();
+    },
+    searchProcessInstances: () =>
+      Promise.resolve(
+        opts.searchState === null ? [] : [{ processInstanceKey: "589000", state: opts.searchState ?? "ACTIVE" }],
+      ),
+  } as any;
+  const posts: string[] = [];
+  const prevFetch = globalThis.fetch;
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevTok = process.env["GITHUB_TOKEN"];
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  process.env["GITHUB_TOKEN"] = "test-token";
+  globalThis.fetch = ((url: string | URL | Request, init?: RequestInit) => {
+    const u = String(url);
+    const method = (init?.method ?? "GET").toUpperCase();
+    const json = (b: unknown, status = 200) => Promise.resolve(new Response(JSON.stringify(b), { status }));
+    if (method !== "GET") posts.push(`${method} ${u}`);
+    if (u.includes(`/pulls/${NUMBER}/requested_reviewers`)) return method === "GET" ? json({ users: [] }) : json({}, 201);
+    if (u.includes(`/pulls/${NUMBER}/reviews`) && opts.reviewsFail) return json({ message: "bad gateway" }, 502);
+    if (u.includes(`/pulls/${NUMBER}/reviews`)) return json(opts.reviews ?? []); // default: review requested, none arrived
+    if (u.includes("/git/ref")) return json({ object: { sha: "e597b399" } });
+    if (u.endsWith(`/pulls/${NUMBER}`)) return json({ ...prState, mergeable_state: "clean", head: { sha: "e597b399" } });
+    return json({}, 404);
+  }) as typeof fetch;
+  try {
+    await pollReviews(data, engine, "test-token");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode !== undefined) process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+    else delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    if (prevTok !== undefined) process.env["GITHUB_TOKEN"] = prevTok;
+    else delete process.env["GITHUB_TOKEN"];
+  }
+  return { row, posts, cancelled, published, stores, planLookups };
+}
+
+test("pollReviews #927: a PR MERGED while awaiting review retires the loop — no review re-request", async () => {
+  const { row, posts, cancelled, published } = await run({ merged: true, state: "closed" });
+  assertEquals(posts.length, 0, "no reviewer-request POST on a merged PR");
+  assertEquals(cancelled, ["589000"], "the parked convergence instance is retired");
+  assertEquals(published.length, 0);
+  assertEquals(row.status, "merged");
+  assertEquals(typeof row.merged_at, "string");
+});
+
+test("pollReviews #927: a PR CLOSED unmerged while awaiting review is abandoned — no review re-request", async () => {
+  const { row, posts, cancelled, stores } = await run({ merged: false, state: "closed" });
+  assertEquals(posts.length, 0);
+  assertEquals(cancelled, ["589000"]);
+  assertEquals((stores.merges.rows as any[]).some((m) => m.method === "pr-closed"), true);
+  assertEquals(row.status === "waiting_review", false);
+});
+
+test("pollReviews #927: an OPEN PR awaiting review is still re-solicited (control)", async () => {
+  const { row, posts, cancelled } = await run({ merged: false, state: "open" });
+  assertEquals(cancelled.length, 0);
+  assertEquals(row.status, "waiting_review");
+  assertEquals(posts.length, 1, "the review nudge still fires for a live PR");
+});
+
+const HEAD_CURRENT_REVIEW = [
+  { id: 77, state: "COMMENTED", submitted_at: "2026-11-08T16:00:00Z", commit_id: "e597b399", user: { login: "copilot-pull-request-reviewer[bot]" } },
+];
+
+for (const [label, prState] of [
+  ["MERGED", { merged: true, state: "closed" }],
+  ["CLOSED", { merged: false, state: "closed" }],
+] as const) {
+  test(`pollReviews #927: a HEAD-CURRENT review on a ${label} PR retires the loop — never resumes a round`, async () => {
+    const { row, posts, cancelled, published } = await run(prState, { reviews: HEAD_CURRENT_REVIEW });
+    assertEquals(published.length, 0, "no readiness-ready published for a terminal PR");
+    assertEquals(posts.length, 0);
+    assertEquals(cancelled, ["589000"]);
+    assertEquals(row.status === "waiting_review" || row.status === "converging", false);
+  });
+}
+
+test("pollReviews #927: a failed cancel of a still-LIVE instance leaves the row pollable", async () => {
+  const { row, posts, published } = await run({ merged: true, state: "closed" }, { cancelFails: true, searchState: "ACTIVE" });
+  assertEquals(row.status, "waiting_review", "not finalized while the instance (and its timer) lives");
+  assertEquals(posts.length, 0, "no re-solicit this pass");
+  assertEquals(published.length, 0);
+});
+
+for (const searchState of ["COMPLETED", null] as const) {
+  test(`pollReviews #927: a failed cancel of an already-${searchState ?? "gone"} instance still finalizes`, async () => {
+    const { row } = await run({ merged: true, state: "closed" }, { cancelFails: true, searchState });
+    assertEquals(row.status, "merged");
+  });
+}
+
+test("pollReviews #927: a PR merged externally while awaiting review runs the retro hook", async () => {
+  // maybeStartRetro resolves the PR's plan via `plan_tasks`; the lookup proves the hook ran.
+  const { planLookups } = await run({ merged: true, state: "closed" });
+  assertEquals(planLookups, [{ pr_key: `${REPO}#${NUMBER}` }]);
+});
+
+test("pollReviews #927: a MERGED PR whose review fetch FAILS is still retired (terminal check precedes fetch)", async () => {
+  const { row, posts, cancelled, published } = await run({ merged: true, state: "closed" }, { reviewsFail: true });
+  assertEquals(cancelled, ["589000"]);
+  assertEquals(published.length, 0);
+  assertEquals(posts.length, 0);
+  assertEquals(row.status, "merged");
+});

package/app/service.ts

@@ -100,6 +100,7 @@ import { ENGINE_TERMINAL_STATES } from "./reconcile.ts";
 // (submitPr/startMerge) and re-exported below so the long-standing `import { repoEnvelopeVars } from
 // "./service.ts"` call sites (and its tests) keep resolving.
 import { repoEnvelopeVars } from "./repoEnvelope.ts";
+import { maybeStartRetro } from "./retro.ts";
 import { clampNudgeMinutes, isoDurationToMs, isReviewStale, reviewWaitTimeout } from "./reviewWait.ts";
 import { trialMergeAudits } from "./trialMerge.ts";
 import {
@@ -1283,6 +1284,13 @@ export async function pollReviews(data: DataLayer, engine: EngineClient, token:
     const { repo, number, pr_key: prKey } = pr;
     const lastId = pr.last_review_id ?? 0;
     try {
+      // #927: a PR that already landed/closed must never resume or re-solicit a review — whatever
+      // the review freshness (no review, stale review, OR a head-current one landing after the
+      // merge). Check terminal state FIRST — before even fetching reviews, so a failing
+      // reviews endpoint (e.g. 502) can't strand a merged PR in `waiting_review` with a live timer — so no branch below can route a merged PR back into a
+      // review round. `null` → handled-but-not-finalized (cancel failed): skip this pass, stay pollable.
+      const retired = await retireTerminalReviewWait(data, engine, pr, token);
+      if (retired !== false) continue;
       const reviews = await fetchPrReviews(repo, number, token);
       if (reviews === null) return; // no usable transport (no gh, no token) → idle
       const fresh = reviews
@@ -1342,6 +1350,60 @@ export async function pollReviews(data: DataLayer, engine: EngineClient, token:
   }
 }
 
+/** Review-wait out-of-band terminal check (issue #927). nano-bpm#1467 landed while its convergence
+ * loop was parked at `wait-review`; the poller then kept re-requesting Copilot reviews on the MERGED
+ * PR for six rounds and finally escalated a review timeout no human could act on. Before any
+ * re-solicitation, read the PR's live state: if it is terminal (merged or closed) the review wait is
+ * moot, so RETIRE the parked convergence instance (`process_key`) and close the row out — `merged`
+ * (with `merged_at`) for a landed PR, the canonical `abandonClosedPr` for a closed-unmerged one.
+ * Conservative: an unreadable/open state returns `false` and the caller re-solicits as before.
+ * Exported for tests. */
+export async function retireTerminalReviewWait(
+  data: DataLayer,
+  engine: EngineClient,
+  pr: PullRequest,
+  token: string,
+): Promise<boolean | null> {
+  const st = await fetchPrState(pr.repo, pr.number, token).catch(() => null);
+  const liveness = classifyPrLiveness(st);
+  if (liveness !== "merged" && liveness !== "closed") return false;
+  if (pr.process_key != null) {
+    const key = String(pr.process_key);
+    try {
+      await engine.cancelInstance({ processInstanceKey: key });
+    } catch (err) {
+      // Only finalize the row once the instance is confirmed gone/terminal: a transiently-failed
+      // cancel would otherwise drop the row from `waiting_review` scans while the live instance's
+      // review-timeout timer still escalates a human. Unconfirmed → stay pollable, retry next pass.
+      let confirmedTerminal = false;
+      try {
+        const match = (await engine.searchProcessInstances({ processInstanceKeys: [key] })).find(
+          (s) => String(s.processInstanceKey) === key,
+        );
+        confirmedTerminal = !match || ENGINE_TERMINAL_STATES.has(String(match.state ?? "").trim().toUpperCase());
+      } catch {
+        confirmedTerminal = false;
+      }
+      if (!confirmedTerminal) {
+        console.error(`[poller] ${pr.pr_key}: retire review-wait instance ${key} failed, retrying next pass: ${err}`);
+        return null;
+      }
+    }
+  }
+  if (liveness === "merged") {
+    const ts = now();
+    await prs(data).update(pr.pr_key, { status: "merged", merged_at: ts, updated_at: ts });
+    // Reuse the merged-completion side effect `pr.mark-merged`/`pr.finalize` run: an externally
+    // merged PR may be its plan's last to settle, so its automatic retrospective must still start.
+    // `maybeStartRetro` is best-effort and never throws.
+    await maybeStartRetro(data, engine, pr.pr_key);
+  } else {
+    await abandonClosedPr(data, pr.pr_key, "PR was closed on GitHub while awaiting review — retiring the convergence loop");
+  }
+  console.log(`[poller] ${liveness} while waiting for review -> retired loop ${pr.pr_key}`);
+  return true;
+}
+
 /** Ensure a Copilot review is in flight for a PR still waiting, throttled to one attempt per
  * REVIEW_NUDGE_MS window. Skips when Copilot is already a pending reviewer (a review is coming);
  * otherwise re-requests one and records the nudge. This is the primary liveness mechanism — the

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.206.0",
-  "gitSha": "e5eedca0ee28db1f54167b4bb962ce4c06776e9f",
-  "gitTag": "v0.206.0",
-  "builtAt": "2026-11-08T12:12:11.017Z"
+  "version": "0.206.2",
+  "gitSha": "71984d5d607151b2c3690a12d6b05537b24c3ece",
+  "gitTag": "v0.206.2",
+  "builtAt": "2026-11-09T11:18:01.340Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.206.0",
+  "version": "0.206.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/merge-loop.bpmn

@@ -115,6 +115,9 @@
           <zeebe:output source="=null" target="status" />
           <zeebe:output source="=null" target="ciBlockedReconciled" />
           <zeebe:output source="=null" target="agentSlaJobType" />
+          <zeebe:output source="=null" target="reviewThreads" />
+          <zeebe:output source="=null" target="failingChecks" />
+          <zeebe:output source="=null" target="pendingChecks" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_deps</bpmn:incoming>
@@ -263,7 +266,7 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=&#34;blocked&#34;" target="status" />
-          <zeebe:input source="=if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads = 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with all checks green (none failing, none pending) and every review thread resolved. GitHub still reports BLOCKED, which means a required review approval (or code-owner review) is outstanding — nothing the automated loop can produce. Approve the PR (or adjust the branch-protection review requirement), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing or checks still pending after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
+          <zeebe:input source="=if agentSlaJobType != null then &#34;An automated merge-stage agent exceeded its time budget (SLA) before this PR could be merged. Check its progress or intervene, then reply to retry.&#34; else if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;conflict&#34; then &#34;This PR has a merge conflict with the base branch (GitHub reports the branch as CONFLICTING / mergeable_state=dirty). GitHub may not have run the pull_request checks on the conflicting head, so their state is unknown from this signal — the conflict alone is what is established. Resolve the conflict on the branch (git rebase / merge the base branch and push) — the rebase re-triggers CI — then reply to retry.&#34; else if mergeState = &#34;blocked&#34; then &#34;GitHub reports failing required checks on this PR, and the merge loop could not get them green automatically. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads = 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with every review thread resolved and no failing or pending checks reported. The likely cause is a required review approval (or code-owner review), but that is not verified: the declared-required checks may never have run on this head (GitHub skips pull_request workflows on a conflicting branch), so their state is not established. Check the PR on GitHub — approve it (or adjust the review requirement), or resolve any conflict (a rebase re-triggers CI) — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads != null and reviewThreads &#62; 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with &#34; + string(reviewThreads) + &#34; unresolved review thread(s). Resolve those conversations on GitHub. Separately, no failing or pending checks were reported, but the declared-required checks may never have run on this head (GitHub skips pull_request workflows on a conflicting branch), so their state is not established — the block may also be a merge conflict whose checks never ran, or a required review approval. Resolve the threads, then resolve any conflict (a rebase re-triggers CI) or approve — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and (reviewThreads = null or reviewThreads &#60; 0) and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked and its GitHub state could not be fully read (the review-thread probe was unreadable or failed), so neither a conflict nor the check/approval state is established. Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing or checks still pending after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_mDraft</bpmn:incoming>
@@ -528,6 +531,7 @@
           <zeebe:ioMapping>
             <zeebe:output source="=&#34;escalate&#34;" target="ciOutcome" />
             <zeebe:output source="=null" target="agentSlaJobType" />
+            <zeebe:output source="=&#34;blocked&#34;" target="mergeState" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_cib_esc</bpmn:incoming>
@@ -684,6 +688,7 @@
           <zeebe:ioMapping>
             <zeebe:output source="=&#34;escalate-attempt&#34;" target="rebaseOutcome" />
             <zeebe:output source="=null" target="agentSlaJobType" />
+            <zeebe:output source="=&#34;conflict&#34;" target="mergeState" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_reb_blocked</bpmn:incoming>

package/workers/merge/worker.test.ts

@@ -112,6 +112,13 @@ test("pr.merge short-circuits an already-merged PR without re-running the land p
 // would stay green if the verb regressed.
 type GithubCall = { url: string; method: string };
 
+// A handler whose review backstop sees a VERIFIED head-current review, so land-protocol tests
+// exercise the protocol dispatch (the backstop now fails CLOSED on an unreadable read, #927).
+const reviewedHandler = makeHandler({
+  readReview: async () => ({ body: "lgtm", commitId: "reviewedhead" }),
+  readHeadSha: async () => "reviewedhead",
+});
+
 function withGithub(
   routes: (url: string, init: RequestInit | undefined) => Response | null,
   run: (calls: GithubCall[]) => Promise<void>,
@@ -153,7 +160,7 @@ test("pr.merge routes a mergify-queue repo through the queued branch (enqueue co
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#7", repo: "acme/widgets", prNumber: 7 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -189,7 +196,7 @@ test("pr.merge routes a refused merge through the blocked branch (escalation pay
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#9", repo: "acme/widgets", prNumber: 9 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -229,7 +236,7 @@ test("pr.merge routes a transient base-moved race through the retry branch (no e
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#11", repo: "acme/widgets", prNumber: 11 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -383,33 +390,63 @@ test("pr.merge #923: a HEAD-CURRENT review lands normally (backstop control)", a
   );
 });
 
-test("pr.merge #923: an UNREADABLE review/head fails OPEN (a transport hiccup never wedges a merge)", async () => {
-  await withGithub(
-    (url) => {
-      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
-      return backstopRoutes(url);
-    },
-    async (calls) => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => null, // no usable transport → unverifiable, NOT "no review"
-        readHeadSha: async () => {
-          throw new Error("boom");
-        },
-      });
-      const out = (await backstop(
-        { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
-        app,
-      )) as Record<string, unknown>;
+for (const [label, readReview, readHeadSha] of [
+  ["review read null", async () => null, async () => "h9"],
+  ["review read throws", async () => { throw new Error("boom"); }, async () => "h9"],
+  ["head read null", async () => ({ body: "lgtm", commitId: "h9" }), async () => null],
+  ["head read throws", async () => ({ body: "lgtm", commitId: "h9" }), async () => { throw new Error("boom"); }],
+  ["head read empty", async () => ({ body: "lgtm", commitId: "h9" }), async () => "  "],
+] as const) {
+  test(`pr.merge #927: an UNVERIFIABLE backstop read (${label}) fails CLOSED — no land, audited refusal`, async () => {
+    await withGithub(
+      (url) => {
+        if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(out.status, "blocked");
+        assertEquals((out.question as string).includes("could not be read"), true);
+        assertEquals(stores.merges.length, 1);
+        assertEquals(stores.merges[0].outcome, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+      },
+    );
+  });
+}
 
-      assertEquals(out, { mergeStatus: "merged" });
-      assertEquals(
-        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
-        true,
-      );
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    },
-  );
+test("pr.merge #927: reproduces nano-bpm#1467 — review REQUESTED but not yet arrived on a mergify-queue repo → no `@mergifyio queue`", async () => {
+  const protocol =
+    "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+  for (const readReview of [async () => ({ body: "", commitId: null }), async () => null]) {
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha: async () => "e597b399" } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#1467", repo: "acme/widgets", prNumber: 1467 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+      },
+    );
+  }
 });
 
 test("pr.merge #923: a head-current review whose summary reports OPEN findings blocks landing", async () => {
@@ -427,23 +464,6 @@ test("pr.merge #923: a head-current review whose summary reports OPEN findings b
   });
 });
 
-for (const [label, readHeadSha] of [
-  ["returns null", async () => null],
-  ["throws", async () => { throw new Error("transient"); }],
-] as const) {
-  test(`pr.merge #923: an unverifiable head (read ${label}) never blocks on a possibly-stale review's open findings`, async () => {
-    await withGithub(backstopRoutes, async () => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "old" }),
-        readHeadSha,
-      });
-      await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app);
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    });
-  });
-}
-
 test("pr.merge #923: the direct merge pins the verified head SHA (no check-then-merge race)", async () => {
   let putBody = "";
   await withGithub(
@@ -485,3 +505,36 @@ test("pr.merge #923: a queue-comment repo whose head moved after the backstop re
     },
   );
 });
+
+for (const [label, finalRead] of [
+  ["null", async () => null],
+  ["throwing", async () => {
+    throw new Error("502");
+  }],
+  ["blank", async () => "  "],
+] as const) {
+  test(`pr.merge #927: a queue-comment repo whose FINAL head re-read is ${label} retries instead of enqueueing`, async () => {
+    const protocol =
+      "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        let n = 0;
+        const backstop = makeHandler({
+          readReview: async () => ({ body: "lgtm", commitId: "h3" }),
+          readHeadSha: async () => (n++ === 0 ? "h3" : finalRead()),
+        } as any);
+        const out = (await backstop({ variables: { prKey: "acme/widgets#34", repo: "acme/widgets", prNumber: 34 } } as any, app)) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "retry");
+        assertEquals(stores.merges.some((m) => m.outcome === "retry"), true, "retry audit row");
+        assertEquals(calls.some((c) => /\/issues\/\d+\/comments$/.test(c.url) && c.method === "POST"), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false, "no merge call");
+      },
+    );
+  });
+}

package/workers/merge/worker.ts

@@ -15,10 +15,9 @@
 // it reviewed — a head that MOVED between convergence and landing, or a review that never existed
 // (the #1443 fail-open), must not slip through at land time. Before running ANY land protocol this
 // worker re-checks that a HEAD-CURRENT Copilot review exists; a missing/stale review blocks the
-// landing (escalating to a human) instead of enqueueing/merging unreviewed code. The check fails
-// OPEN only when the GitHub state is UNREADABLE (no transport / a hiccup) — the merge-stage
-// mergeability polling is the independent backstop there, and a hard block on a transient read
-// would wedge every merge on a network blip.
+// landing (escalating to a human) instead of enqueueing/merging unreviewed code. An UNREADABLE
+// review/head ALSO blocks (fails CLOSED, issue #927) — the old fail-open let nano-bpm#1467 land
+// 49 s before its first review.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
@@ -59,6 +58,9 @@ const defaultReadReview: MergeReviewReader = (repo, prNumber) =>
 // bind (#786/#799), so the backstop's staleness comparison sees the exact head the gate did.
 const defaultReadHead: HeadReader = makeDefaultReadHead({ fetchPrHead, fetchBranchHead });
 
+const BLOCK_UNVERIFIABLE_REVIEW =
+  "the PR's Copilot review state or current HEAD could not be read, so a head-current reviewer verdict cannot be verified (the backstop fails CLOSED on an unverifiable read)";
+
 const BLOCK_NO_HEAD_CURRENT_REVIEW =
   "no head-current Copilot review exists for the PR's current HEAD (the head moved after the last review, or no review was ever submitted). A head-current reviewer verdict is required before landing";
 
@@ -132,26 +134,31 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // existed at all (the nano-bpm#1443 fail-open: merged with ZERO reviews), must not slip through
   // at land time. Runs AFTER the merged/closed short-circuits (an already-terminal PR needs no
   // verdict) and BEFORE any land protocol (the `@mergifyio queue` comment is itself the landing
-  // for a queue repo). Fails OPEN only when the GitHub state is UNREADABLE (no transport / a
-  // hiccup → `null` review or head): a transient read failure must not wedge every merge — the
-  // merge-stage mergeability polling is the independent backstop there.
+  // for a queue repo). Fails CLOSED on an UNREADABLE review/head too (issue #927).
   const [backstopReview, backstopHead] = await Promise.all([
     readReview(repo, prNumber).catch(() => null),
     readHeadSha(repo, prNumber).catch(() => null),
   ]);
-  if (backstopReview !== null && isReviewMissingOrStale(backstopReview.commitId, backstopHead)) {
+  // FAIL CLOSED (issue #927): a gate whose job is "never land unreviewed" must not land on an
+  // UNVERIFIABLE read. nano-bpm#1467 merged 49 s before its first Copilot review because a `null`
+  // review/head read (or an empty head) skipped this check entirely. An unreadable review or head now
+  // blocks (escalating to a human, who replies to retry) exactly like a missing/stale review.
+  const headTrimmed = (backstopHead ?? "").trim();
+  const unverifiable = backstopReview === null || headTrimmed === "";
+  if (unverifiable || isReviewMissingOrStale(backstopReview.commitId, headTrimmed)) {
+    const detail = unverifiable ? BLOCK_UNVERIFIABLE_REVIEW : BLOCK_NO_HEAD_CURRENT_REVIEW;
     await app.data.table("merges", "id").insert({
       pr_key: prKey,
       outcome: "blocked",
       method: "review-backstop",
-      detail: BLOCK_NO_HEAD_CURRENT_REVIEW,
+      detail,
       at: now,
     });
     return {
       mergeStatus: "blocked",
       status: "blocked",
       question:
-        `Merge refused: ${BLOCK_NO_HEAD_CURRENT_REVIEW}. ` +
+        `Merge refused: ${detail}. ` +
         `Push no further commits, wait for the Copilot review of the current HEAD to land (or request one: ` +
         `gh api repos/${repo}/pulls/${prNumber}/requested_reviewers -X POST -f "reviewers[]=copilot-pull-request-reviewer[bot]"), ` +
         `let the convergence loop gate on it, then reply to retry.`,
@@ -161,12 +168,8 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // A head-current review whose OWN summary still reports open findings (the same canonical
   // verdict parser the converge-gate uses) must block too: a summary-only "Changes recommended"
   // review that landed after convergence has no unresolved thread for mergeability polling to see.
-  // Only evaluate the verdict once head-currentness is VERIFIED (review read AND head read succeeded
-  // and match) — an unreadable head fails open here like the stale check above, never blocking on a
-  // possibly-stale review's body.
-  const reviewIsHeadCurrent =
-    backstopReview !== null && backstopHead !== null && backstopHead !== "" && backstopReview.commitId === backstopHead;
-  const openFindings = reviewIsHeadCurrent ? parseReviewOpenFindings(backstopReview.body) : [];
+  // Head-currentness is VERIFIED at this point (the fail-closed check above returned otherwise).
+  const openFindings = parseReviewOpenFindings(backstopReview.body);
   if (openFindings.length > 0) {
     const detail = `the head-current Copilot review reports open findings (${openFindings.join(", ")})`;
     await app.data.table("merges", "id").insert({
@@ -186,7 +189,7 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   }
   // The head the backstop verified — pinned through the land call so a push between this check
   // and the merge can never land a later, unreviewed head.
-  const verifiedHead = backstopReview !== null && backstopHead ? backstopHead : undefined;
+  const verifiedHead: string | undefined = headTrimmed;
 
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
@@ -227,10 +230,14 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
     const comment = protocol?.land.comment ?? "@mergifyio queue";
     // A comment can't pin a SHA, so re-read the head right before enqueueing: if it moved past the
     // verified head, re-enter via the bounded retry (which re-runs the backstop on the new head).
-    const headNow = verifiedHead ? await readHeadSha(repo, prNumber).catch(() => null) : null;
-    if (verifiedHead && headNow !== null && headNow !== verifiedHead) {
+    // Fail CLOSED (#927): an unreadable re-read retries rather than enqueueing an unverified head.
+    const headNow = await readHeadSha(repo, prNumber).catch(() => null);
+    if (headNow === null || headNow.trim() !== verifiedHead) {
       outcome = "retry";
-      detail = `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
+      detail =
+        headNow === null
+          ? `head could not be re-read after the review backstop; re-verifying before enqueue`
+          : `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
     } else {
       const ok = await enqueueViaComment(repo, prNumber, token, comment);
       outcome = ok ? "queued" : "blocked";