@nanobpm/nano-workforce 0.206.1 → 0.206.3

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.206.3](https://github.com/nanobpm/nano-workforce/compare/v0.206.2...v0.206.3) (2026-11-09)
+
+### Bug Fixes
+
+* **merge:** never escalate a PR that already landed when the queue landing timeout fires ([#935](https://github.com/nanobpm/nano-workforce/issues/935)) ([f731dc6](https://github.com/nanobpm/nano-workforce/commit/f731dc60dc0cb7480b425e88d1d216b95d63a5c1)), closes [#933](https://github.com/nanobpm/nano-workforce/issues/933)
+
+## [0.206.2](https://github.com/nanobpm/nano-workforce/compare/v0.206.1...v0.206.2) (2026-11-09)
+
+### Bug Fixes
+
+* **merge:** let a DIRTY state outrank absent required checks so a conflicting PR reaches the rebase arm ([#930](https://github.com/nanobpm/nano-workforce/issues/930)) ([71984d5](https://github.com/nanobpm/nano-workforce/commit/71984d5d607151b2c3690a12d6b05537b24c3ece)), closes [#392](https://github.com/nanobpm/nano-workforce/issues/392) [nanobpm/nano-bpm#1444](https://github.com/nanobpm/nano-bpm/issues/1444) [#929](https://github.com/nanobpm/nano-workforce/issues/929)
+
 ## [0.206.1](https://github.com/nanobpm/nano-workforce/compare/v0.206.0...v0.206.1) (2026-11-08)
 
 ### Bug Fixes

package/app/github.test.ts

@@ -719,6 +719,49 @@ const MERGE_CASES: MergeCase[] = [
     protocol: protocolWith({ requiredChecks: reqChecks("build"), waitForChecks: true }),
     want: "waiting",
   },
+  // ── DIRTY outranks an ABSENT/PENDING required check (issue #929) ─────────────────────────────
+  // GitHub does not run `pull_request` workflows on a PR with merge conflicts, so a DIRTY head
+  // reports its declared-required checks as ABSENT (or skipped). Mapping that absence to `waiting`
+  // deadlocks the merge loop: the checks can never arrive until the conflict is resolved, and the
+  // conflict is never routed to the rebase arm because the checks read as "not yet run". The
+  // conflict is ground truth whose remedy (a rebase) is also exactly what re-triggers CI, so DIRTY
+  // outranks absence — but NOT a red declared-required check, which still routes to fix-ci.
+  {
+    name: "DIRTY + declared-required check ABSENT -> conflict, not waiting (the #929 deadlock)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "summary", conclusion: "SKIPPED" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("typecheck + test (Node)", "whole-repo invariants") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + no check runs at all -> conflict (absence is a consequence of the conflict)",
+    state: { mergeStateStatus: "DIRTY" },
+    protocol: protocolWith({ requiredChecks: reqChecks("build"), waitForChecks: true }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + declared-required check PENDING -> conflict (rebase, then CI re-runs on the new head)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "QUEUED" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + declared-required check present-but-unconcluded -> conflict",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "IN_PROGRESS" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
+  {
+    name: "DIRTY + RED declared-required check -> blocked (a red check still outranks the conflict)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "FAILURE" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "blocked",
+  },
+  {
+    name: "DIRTY + green declared-required checks -> conflict (unchanged pre-#929 behaviour)",
+    state: { mergeStateStatus: "DIRTY", rollup: [{ name: "build", conclusion: "SUCCESS" }] },
+    protocol: protocolWith({ requiredChecks: reqChecks("build") }),
+    want: "conflict",
+  },
 ];
 
 for (const c of MERGE_CASES) {

package/app/github.ts

@@ -1621,7 +1621,6 @@ export function classifyMergeability(s: PrState, protocol?: MergeProtocol): Merg
   // settled-thread routing below.
   const gate = requiredChecksVerdict(s, protocol);
   if (gate === "blocked") return "blocked";
-  if (gate === "waiting") return "waiting";
   // A GitHub-identified merge conflict (`mergeStateStatus: "DIRTY"`) is ground truth whose remedy is
   // a rebase, dispatched off the `conflict` verdict. It outranks the thread gate below (PR #922
   // review, thread 1): a FAILED thread probe (`THREAD_PROBE_FAILED`) returning `waiting` here would
@@ -1630,7 +1629,18 @@ export function classifyMergeability(s: PrState, protocol?: MergeProtocol): Merg
   // round that cannot clear it. Surface the conflict first; the threads are re-triaged once the
   // rebased head is re-read. (A red declared-required check still outranks even this — see the
   // backstop above — so a conflicting PR with failing CI routes to fix-ci, not a doomed rebase.)
+  //
+  // DIRTY also outranks a `waiting` required-checks verdict (issue #929): GitHub does NOT run
+  // `pull_request` workflows on a PR with merge conflicts, so a conflicting head reports its
+  // declared-required checks as ABSENT (or skipped) — and `requiredChecksVerdict` maps absence to
+  // `waiting`. Evaluated in the old order that deadlocked the merge loop: the checks can never
+  // arrive until the conflict is resolved, and the conflict was never routed to the rebase arm
+  // because the absent checks read as "not yet run". The absence is a CONSEQUENCE of the conflict,
+  // and the conflict's remedy (a rebase) is exactly what re-triggers CI on the new head — so the
+  // conflict owns the verdict. Only a RED declared-required check (`blocked`, handled above) may
+  // still outrank DIRTY.
   if (s.mergeStateStatus === "DIRTY") return "conflict";
+  if (gate === "waiting") return "waiting";
   // The merge-stage thread gate (issue #921, PR #922 review): a read that opted into the
   // review-threads probe and found ≥1 open thread (`unresolvedThreads > 0`) is NEVER merge-ready,
   // whatever `mergeStateStatus` says. A repo without branch-protection

package/app/mergeBlockedThreads.test.ts

@@ -17,6 +17,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { assert, assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -73,6 +74,8 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
     table: (n: string, pk?: string) => tbl(n, pk),
     open: () => ({
       exec: async (sql: string, params: any[] = []) => {
+        const cas = memStatusCas(stores, sql, params);
+        if (cas) return cas;
         const m = sql.match(/^\s*DELETE\s+FROM\s+"?(\w+)"?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s*$/i);
         if (!m) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
         const rows = (stores[m[1]] ??= [] as any[]);

package/app/mergeLoopBehaviour.test.ts

@@ -52,6 +52,7 @@ const ALL_JOB_TYPES = [
   "pr.arm-merge",
   "pr.merge",
   "pr.merge-stall-probe",
+  "pr.landed-probe",
   "pr.mark-merged",
   "senior:fix-ci",
   "senior:rebase",
@@ -66,6 +67,7 @@ const DEFAULT_RESPONSES: Record<string, Responder> = {
   "pr.record-dependency": {},
   "pr.answer-escalation": {},
   "pr.persist-escalation": { escalated: true },
+  "pr.landed-probe": { landedVerdict: "waiting" },
 };
 
 // Every FEEL expression in the model references these; start them defined (null,
@@ -239,6 +241,30 @@ test("a queued merge that never lands escalates when the landing timeout fires (
   assertStringIncludes(String(escalation(engine).question ?? ""), "did not land within the merge-queue landing timeout", "the escalation must name the landing-timeout trigger");
 });
 
+test("a landing timeout firing on a PR that already MERGED completes merged with no escalation (#933)", async () => {
+  // The queue landed the PR, but the timer won the `eg-landed` race before the poller published
+  // `merge-landed`. The timeout arm must re-read ground truth and finalize — never escalate a landed PR.
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "landed" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompleted().hasNoIncident().hasCompletedElements("landed-probe", "mark-merged");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "a landed PR must never be escalated");
+});
+
+test("a landing timeout on a PR evicted from the queue re-arms the merge poller (#933)", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "evicted" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "an evicted PR re-arms rather than escalating");
+});
+
 test("answering the landing-timeout escalation re-arms the merge poller (#556)", async () => {
   const engine = await boot({ responses: { "pr.merge": { mergeStatus: "queued" } } });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
@@ -498,7 +524,9 @@ test("the 'waiting' re-poll is bounded — exhausting mergeStallMax escalates to
   const engine = await boot({
     vars: { mergeStallMax: 0 },
     responses: {
-      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "" },
+      // The probe always emits the full tri-state (a failed read reports reviewThreads: -1) — the
+      // escalation wording reads it, so the test payload must carry it.
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
     },
   });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
@@ -509,6 +537,186 @@ test("the 'waiting' re-poll is bounded — exhausting mergeStallMax escalates to
   assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("wait-mergeable-repoll", "merge-stall-probe", "merge-esc-conflict");
 });
 
+// ---------------------------------------------------------------------------
+// #929 — a DIRTY PR whose required checks are ABSENT (GitHub skips pull_request
+// workflows on a conflicting head) must route to the rebase arm, never to the
+// misleading "all checks green … needs approval" escalation.
+// ---------------------------------------------------------------------------
+
+test("a DIRTY PR with absent required checks reaches SP_rebase via the stall probe (#929)", async () => {
+  // The incident (nanobpm/nano-bpm#1444): REST reported mergeable=false/dirty and every
+  // declared-required check was ABSENT (GitHub skips CI on a conflicting head), yet the loop
+  // escalated "needs approval" twice and never dispatched the rebase. With the classifier fix,
+  // the stall probe re-derives `conflict` and the token reaches the rebase agent.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  // The poller's pre-fix verdict was `waiting` (absent required checks outranked DIRTY), so the
+  // instance is parked on the mergeable wait when the stall timer fires.
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("merge-stall-probe", "rebase") // the rebase agent ran — SP_rebase was reached
+    .hasVariable("rebaseRound", 1);
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "a DIRTY PR must rebase, not escalate 'needs approval'");
+  const openTasks = await engine.searchUserTasks({});
+  assert(!openTasks.some((t) => t.elementId === "wait-merge-answer"), "no human escalation on the rebase path");
+});
+
+test("a stall escalation on a DIRTY PR never claims 'all checks green' — it names the conflict (#929)", async () => {
+  // The pre-fix escalation built "all checks green (none failing, none pending)" from
+  // `failingChecks = 0 and pendingChecks = 0` — but on a DIRTY head those zeros mean GitHub
+  // SKIPPED the required checks, not that they passed. The approval wording must stay gated on a
+  // PROBED-and-clear thread count; a DIRTY PR (whose `conflict` verdict is only reachable via the
+  // rebase arm) that still lands here keeps the conservative wording instead of the false claim.
+  const engine = await boot({
+    vars: { mergeStallMax: 0, rebaseMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-stall-probe", "merge-esc-conflict");
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("all checks green"), "absent/unprobed checks must never read as 'all checks green'");
+  assert(!q.includes("required review approval"), "a conflict must never read as a review-approval wait");
+  assertStringIncludes(q, "merge conflict", "the conflict escalation must name the conflict");
+  // PR #930 review: the verdict alone does not establish that the required checks are ABSENT —
+  // a conflicting head can carry successful required checks, and a failed read reports the same
+  // zeros — so the escalation may only note that GitHub MAY not have run them, never assert it.
+  assert(!q.includes("absent, NOT green"), "the verdict alone never establishes that the required checks are absent");
+  assertStringIncludes(q, "may not have run", "the escalation notes the check-skip caveat without asserting it");
+});
+
+test("a conflict-verdict escalation with GREEN required checks still names only the conflict (#930 review)", async () => {
+  // The mirror case the review called out: `conflict` with every required check successful. The
+  // escalation must not claim the checks are absent or not-green — only the conflict is known.
+  const engine = await boot({
+    vars: { mergeStallMax: 0, rebaseMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "merge conflict", "the conflict escalation must name the conflict");
+  assert(!q.includes("NOT green"), "green required checks must never be described as not-green");
+  assert(!q.includes("all checks green"), "the escalation asserts the conflict, not the check state either way");
+});
+
+test("a stalled 'waiting' with clear threads and zero checks never asserts the required checks ran (#930 review)", async () => {
+  // `waiting` + reviewThreads>0 + failing=0/pending=0 is ambiguous: the required checks may be
+  // absent (never ran on a conflicting head) rather than green. The escalation must float both
+  // candidates — a conflict whose checks never ran, or a review-approval requirement — and send
+  // the human to the PR, never assert "no failing or pending checks" as if the rollup were green.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: 0, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-stall-probe", "merge-esc-conflict");
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("all checks green"), "zero counts with clear threads must never claim green checks");
+  assert(!q.includes("NO failing or pending checks"), "zero counts do not establish that the required checks ran");
+  assert(!q.includes("required review approval is outstanding"), "an ambiguous read must never assert a verified review-approval blocker");
+  assertStringIncludes(q, "not verified", "the approval blocker must be floated, not asserted");
+  assertStringIncludes(q, "may never have run", "the escalation must allow that the required checks never ran");
+});
+
+test("a stalled 'waiting' with unresolved threads reports their count and asks to resolve them (#930 review)", async () => {
+  // Absent required checks can yield `waiting` before the thread gate runs; the verified unresolved
+  // threads must be surfaced, since resolving a conflict or approving does not clear them.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: 2, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "2 unresolved review thread(s)", "the verified thread count must be reported");
+  assertStringIncludes(q, "Resolve those conversations", "the operator must be asked to resolve the threads");
+  assertStringIncludes(q, "may never have run", "the check state stays unverified");
+  assert(!q.includes("all checks green"), "never claim green checks");
+});
+
+test("a stall escalation after a FAILED GitHub read says the state could not be read — never a confirmed conflict (#930 review)", async () => {
+  // The stall probe's catch maps a failed read to `waiting`, reviewThreads -1, zero checks — the
+  // exact payload the pre-fix wording read as a confirmed conflict. The escalation must report an
+  // unreadable state and nothing more specific.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "could not be fully read", "a failed read must be named as such");
+  assert(!q.includes("CONFLICTING"), "a failed read must never assert a confirmed conflict");
+  assert(!q.includes("required review approval"), "a failed read must never assert a review-approval blocker");
+});
+
+test("a stall give-up with no remediation attempted never claims a remediation budget was exhausted (#930 review)", async () => {
+  for (const mergeState of ["conflict", "blocked"]) {
+    const engine = await boot({
+      vars: { mergeStallMax: 0 },
+      responses: {
+        "pr.merge-stall-probe": { mergeState, failingChecks: mergeState === "blocked" ? 1 : 0, failingChecksList: mergeState === "blocked" ? "ci" : "", reviewThreads: 0, pendingChecks: 0 },
+      },
+    });
+    await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+    await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+    const q = String(escalation(engine).question ?? "");
+    if (q === "") continue; // routed to a remediation agent rather than the direct give-up
+    assert(!/budget|exhausted/.test(q), `${mergeState}: the escalation must not claim an exhausted budget: ${q}`);
+  }
+});
+
+test("answering 'retry' on a DIRTY PR's escalation re-arms the poller, which re-derives conflict and rebases (#929)", async () => {
+  // The incident's second half: a human answered "retry" and the loop re-classified the same way
+  // and escalated again — the rebase was never reached. Post-fix the retry re-arms the poller; the
+  // next verdict for the still-DIRTY PR is `conflict`, which dispatches the rebase agent.
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  // The human replies "retry" — the answer reconciles then re-arms the poller.
+  await engine.completeUserTask(await mergeAnswerTaskKey(engine), { answer: "retry" });
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  // The re-armed poller now classifies the DIRTY PR as `conflict` (absent required checks no
+  // longer outrank DIRTY) and the rebase agent is dispatched.
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "conflict" } });
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("record-merge-answer", "rebase")
+    .hasVariable("rebaseRound", 1);
+});
+
 test("an unclassified verdict routes to auto-rebase (DEFAULT), not to a human (#774)", async () => {
   // The DEFAULT arm is a last-resort self-heal, not a page: an unexpected/garbage `mergeState` routes
   // to the bounded rebase agent (which reconciles from ground truth), never straight to a human.
@@ -637,7 +845,7 @@ test("the 'never settled' question is reserved for a genuinely unreadable/unsett
   const engine = await boot({
     vars: { mergeStallMax: 0 },
     responses: {
-      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1 },
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "", reviewThreads: -1, pendingChecks: 0 },
     },
   });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
@@ -645,8 +853,8 @@ test("the 'never settled' question is reserved for a genuinely unreadable/unsett
   await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
   assertStringIncludes(
     String(escalation(engine).question ?? ""),
-    "never settled",
-    "a genuinely unsettled/unreadable mergeability keeps the original message",
+    "could not be fully read",
+    "a genuinely unsettled/unreadable mergeability names the unreadable state",
   );
 });
 
@@ -871,6 +1079,31 @@ test("a conflict runs the bounded rebase agent and a rebased result re-arms the
     .hasVariable("rebaseRound", 1); // the rebase counter advanced across the sub-process boundary
 });
 
+test("a rebase agent cannot spoof the escalation verdict by returning mergeState (#930 self-review)", async () => {
+  // The agent's result keys are hoisted into process scope, and `mergeState` now selects the
+  // shared merge-esc-conflict wording. A rebase agent that returns a bogus `mergeState:"ready"`
+  // must NOT be able to rewrite a "could not resolve the conflict" escalation into a
+  // green-checks/approval message: the trusted `end_reb_blocked` end event re-stamps the verdict.
+  const engine = await boot({ responses: { "senior:rebase": { status: "blocked", mergeState: "ready" } } });
+  await driveToRebase(engine);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-attempt");
+  assertStringIncludes(String(escalation(engine).question ?? ""), "rebase agent could not resolve", "the question must name the conflict trigger, not the spoofed verdict");
+  assertThatInstance(engine, byProcessId("merge-loop")).hasVariable("mergeState", "conflict");
+});
+
+test("a fix-ci agent cannot spoof the escalation verdict by returning mergeState (#930 self-review)", async () => {
+  // Same guard on the CI-fix side: a fix-ci agent that exhausts its budget after returning a bogus
+  // `mergeState` must still escalate with the CI-fix wording — `end_ci_esc` re-stamps the verdict.
+  const engine = await boot({ responses: { "senior:fix-ci": { status: "blocked", pushed: true, mergeState: "ready" } } });
+  await driveToCiFix(engine);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-attempt");
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "could not make the required checks green", "the question must name the CI-fix failure, not the spoofed verdict");
+  assertThatInstance(engine, byProcessId("merge-loop")).hasVariable("mergeState", "blocked");
+});
+
 test("a rebase that cannot resolve escalates with a conflict question", async () => {
   const engine = await boot({ responses: { "senior:rebase": { status: "blocked" } } });
   await driveToRebase(engine);
@@ -967,6 +1200,10 @@ test("the rebase agent SLA interrupts the sub-process and escalates as not-merge
   assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("merge-esc-conflict");
   // #879 regression: the trusted rebase SLA arm must deliver its job-type marker to the shared sink.
   assertEquals(escalation(engine).agentSlaJobType, "senior:rebase", "the rebase SLA arm must reach the recorder with its job-type marker");
+  // The SLA escalation must never surface the stale `conflict` verdict's wording — the recorder's
+  // SLA builder (keyed on the trusted marker) owns the question, not the verdict FEEL.
+  const q = String(escalation(engine).question ?? "");
+  assert(!q.includes("CONFLICTING") && !q.includes("merge conflict with the base branch"), "an SLA escalation must not read as a verdict escalation");
 });
 
 test("a non-SLA escalation carrying a spoofed agentSlaJobType is scrubbed before the recorder (#879 fail-closed)", async () => {

package/app/mergeOutOfBandTerminal.test.ts

@@ -13,6 +13,7 @@
 // message THAT wait correlates to; this test asserts the class over every (status × merged/closed).
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -45,7 +46,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 
@@ -176,3 +186,49 @@ test("still-open waiting_deps PR with an unmerged dep publishes nothing and stay
   assertEquals(messages.length, 0);
   assertEquals(stores["pull_requests"][0].status, "waiting_deps");
 });
+
+// PR #935 review: a poll pass reads `queued`, then stalls on GitHub while the process's own landing
+// timeout path completes `mark-merged` (status → `merged`). When the delayed pass resumes, its flip
+// must NOT clobber the terminal `merged` with `merging` (no pass scans `merging`, so it would stick)
+// nor publish a `merge-landed` whose subscription is gone. The flip is a compare-and-set on the
+// status the pass read; a lost race skips the publish entirely.
+// Asserted on `waiting_deps` (the flip is the one shared helper every merge-stage wait uses).
+test("a delayed merge-stage poll never overwrites a concurrently-written terminal status", async () => {
+  const { data, stores } = memData();
+  const { engine, messages } = recordingEngine();
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  const inner = githubFetch(new Map<number, Live>([[100, "merged"]]));
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevFetch = globalThis.fetch;
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  // While the poll awaits GitHub, the timeout path's `mark-merged` lands the terminal status.
+  globalThis.fetch = ((url: string | URL | Request, init?: RequestInit) => {
+    // Replace (not mutate) the row: a real DB read hands the pass a snapshot, not a live reference.
+    stores["pull_requests"][0] = { ...stores["pull_requests"][0], status: "merged" };
+    return inner(url, init);
+  }) as typeof fetch;
+  try {
+    await pollMerges(data, engine, "tok");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode === undefined) delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    else process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+  }
+  assertEquals(messages.length, 0, "a lost race must not publish to a vanished subscription");
+  assertEquals(stores["pull_requests"][0].status, "merged");
+});
+
+// The publish-failure revert is conditional too: it only undoes its OWN `merging`.
+test("a failed publish reverts merging back to the read status", async () => {
+  const { data, stores } = memData();
+  const engine = {
+    async publishMessage() {
+      throw new Error("boom");
+    },
+  } as any as EngineClient;
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  await withGithub(new Map<number, Live>([[100, "merged"]]), () => pollMerges(data, engine, "tok").catch(() => {}));
+  assertEquals(stores["pull_requests"][0].status, "waiting_deps");
+});

package/app/mergeQueueEviction.test.ts

@@ -10,6 +10,7 @@
 // token-transport GitHub stub that serves BOTH the REST PR view and the GraphQL merge-queue probe.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { fetchMergeQueueMembership } from "./github.ts";
 import { pollMerges } from "./service.ts";
@@ -42,7 +43,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 

package/app/service.ts

@@ -1572,24 +1572,44 @@ async function classifyWaveTarget(
  * otherwise wedge the PR there forever — the next pass would never pick it back up. Reverting on
  * failure keeps the PR on a pollable status so the next pass retries. Single source of truth for
  * the flip-then-publish handoff shared by all merge-stage waits below. */
-async function flipToMergingThenPublish(
+export async function flipToMergingThenPublish(
   data: DataLayer,
   engine: EngineClient,
   prKey: string,
   prevStatus: string,
   message: Parameters<EngineClient["publishMessage"]>[0],
-) {
-  await prs(data).update(prKey, { status: "merging", updated_at: now() });
+): Promise<boolean> {
+  // Compare-and-set (#935 review): the flip only wins if the row is STILL on the status this pass
+  // read. A pass that read `queued`, then stalled on GitHub while the process's own timeout path
+  // completed `mark-merged`, must not clobber the terminal `merged` with `merging` (no pass scans
+  // `merging`, and the completed loop has no worker left to restore it) nor publish a message whose
+  // subscription is gone. A lost race skips the publish entirely.
+  const db = data.open();
+  const flipped = await db.exec(
+    "UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?",
+    ["merging", now(), prKey, prevStatus],
+  );
+  if (flipped.changed === 0) {
+    console.log(`[poller] ${prKey} left ${prevStatus} concurrently — skipping ${message.name}`);
+    return false;
+  }
   try {
     await engine.publishMessage(message);
   } catch (err) {
     try {
-      await prs(data).update(prKey, { status: prevStatus, updated_at: now() });
+      // Conditional revert too: only undo OUR `merging`, never a status another actor wrote since.
+      await db.exec("UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?", [
+        prevStatus,
+        now(),
+        prKey,
+        "merging",
+      ]);
     } catch (revertErr) {
       console.error(`[poller] revert ${prKey} -> ${prevStatus} failed: ${revertErr}`);
     }
     throw err;
   }
+  return true;
 }
 
 export async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<PrLaneDecision | null> {

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.206.1",
-  "gitSha": "973c161d8b279db21915601647c5e8c43f3cac2f",
-  "gitTag": "v0.206.1",
-  "builtAt": "2026-11-08T20:26:54.809Z"
+  "version": "0.206.3",
+  "gitSha": "f731dc60dc0cb7480b425e88d1d216b95d63a5c1",
+  "gitTag": "v0.206.3",
+  "builtAt": "2026-11-09T21:25:41.376Z"
 }

package/nano.app.json

@@ -148,6 +148,10 @@
       "taskType": "pr.mark-merged",
       "handler": "workers/mark-merged/worker.ts"
     },
+    {
+      "taskType": "pr.landed-probe",
+      "handler": "workers/landed-probe/worker.ts"
+    },
     {
       "taskType": "pr.merge-stall-probe",
       "handler": "workers/merge-stall-probe/worker.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.206.1",
+  "version": "0.206.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/merge-loop.bpmn

@@ -56,6 +56,14 @@
           <nano:extend name="reviewThreads" type="integer" optional="true" />
           <nano:extend name="pendingChecks" type="integer" optional="true" />
         </nano:shape>
+        <nano:shape id="LandedProbeIn" name="Landed probe — input">
+          <nano:extend name="prKey" type="string" />
+          <nano:extend name="repo" type="string" />
+          <nano:extend name="prNumber" type="integer" />
+        </nano:shape>
+        <nano:shape id="LandedProbeOut" name="Landed probe — result">
+          <nano:extend name="landedVerdict" type="string" />
+        </nano:shape>
         <nano:shape id="MergeReady" name="merge-ready message payload">
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
@@ -115,6 +123,9 @@
           <zeebe:output source="=null" target="status" />
           <zeebe:output source="=null" target="ciBlockedReconciled" />
           <zeebe:output source="=null" target="agentSlaJobType" />
+          <zeebe:output source="=null" target="reviewThreads" />
+          <zeebe:output source="=null" target="failingChecks" />
+          <zeebe:output source="=null" target="pendingChecks" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_deps</bpmn:incoming>
@@ -122,6 +133,7 @@
       <bpmn:incoming>f_ci_rearm</bpmn:incoming>
       <bpmn:incoming>f_reb_rearm</bpmn:incoming>
       <bpmn:incoming>f_m_evicted</bpmn:incoming>
+      <bpmn:incoming>f_lp_evicted</bpmn:incoming>
       <bpmn:incoming>f_m_escReenter</bpmn:incoming>
       <bpmn:incoming>f_mr_go</bpmn:incoming>
       <bpmn:outgoing>f_m_arm</bpmn:outgoing>
@@ -231,11 +243,28 @@
     </bpmn:intermediateCatchEvent>
     <bpmn:intermediateCatchEvent id="wait-landed-timeout" name="Wait: merge-queue landing timeout">
       <bpmn:incoming>f_eg_landedTimeout</bpmn:incoming>
-      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedProbe</bpmn:outgoing>
       <bpmn:timerEventDefinition id="ted_landedTimeout">
         <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=landedWaitTimeout</bpmn:timeDuration>
       </bpmn:timerEventDefinition>
     </bpmn:intermediateCatchEvent>
+    <bpmn:serviceTask id="landed-probe" name="Probe: did the queued PR land?">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.landed-probe" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="LandedProbeIn" />
+          <zeebe:property name="io.nanobpm.dataEnvelope.out" value="LandedProbeOut" />
+        </zeebe:properties>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_m_landedProbe</bpmn:incoming>
+      <bpmn:outgoing>f_lp_gate</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:exclusiveGateway id="gw-landed-probe" name="landed?" default="f_m_landedStalled">
+      <bpmn:incoming>f_lp_gate</bpmn:incoming>
+      <bpmn:outgoing>f_lp_landed</bpmn:outgoing>
+      <bpmn:outgoing>f_lp_evicted</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
     <bpmn:serviceTask id="mark-merged" name="Mark merged">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="pr.mark-merged" />
@@ -245,6 +274,7 @@
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_gMerged</bpmn:incoming>
       <bpmn:incoming>f_m_landed</bpmn:incoming>
+      <bpmn:incoming>f_lp_landed</bpmn:incoming>
       <bpmn:outgoing>f_m_done</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:endEvent id="MergeEnd" name="Merged">
@@ -263,7 +293,7 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=&#34;blocked&#34;" target="status" />
-          <zeebe:input source="=if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads = 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with all checks green (none failing, none pending) and every review thread resolved. GitHub still reports BLOCKED, which means a required review approval (or code-owner review) is outstanding — nothing the automated loop can produce. Approve the PR (or adjust the branch-protection review requirement), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing or checks still pending after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
+          <zeebe:input source="=if agentSlaJobType != null then &#34;An automated merge-stage agent exceeded its time budget (SLA) before this PR could be merged. Check its progress or intervene, then reply to retry.&#34; else if mergeState = &#34;draft&#34; then &#34;This PR is in draft and can&#39;t be merged. Mark it ready (gh pr ready), then reply to retry.&#34; else if mergeState = &#34;conflict&#34; then &#34;This PR has a merge conflict with the base branch (GitHub reports the branch as CONFLICTING / mergeable_state=dirty). GitHub may not have run the pull_request checks on the conflicting head, so their state is unknown from this signal — the conflict alone is what is established. Resolve the conflict on the branch (git rebase / merge the base branch and push) — the rebase re-triggers CI — then reply to retry.&#34; else if mergeState = &#34;blocked&#34; then &#34;GitHub reports failing required checks on this PR, and the merge loop could not get them green automatically. Fix the failing checks on the branch (or reply with guidance), then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads = 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with every review thread resolved and no failing or pending checks reported. The likely cause is a required review approval (or code-owner review), but that is not verified: the declared-required checks may never have run on this head (GitHub skips pull_request workflows on a conflicting branch), so their state is not established. Check the PR on GitHub — approve it (or adjust the review requirement), or resolve any conflict (a rebase re-triggers CI) — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and reviewThreads != null and reviewThreads &#62; 0 and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked with &#34; + string(reviewThreads) + &#34; unresolved review thread(s). Resolve those conversations on GitHub. Separately, no failing or pending checks were reported, but the declared-required checks may never have run on this head (GitHub skips pull_request workflows on a conflicting branch), so their state is not established — the block may also be a merge conflict whose checks never ran, or a required review approval. Resolve the threads, then resolve any conflict (a rebase re-triggers CI) or approve — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; and (reviewThreads = null or reviewThreads &#60; 0) and failingChecks = 0 and pendingChecks = 0 then &#34;This PR is merge-blocked and its GitHub state could not be fully read (the review-thread probe was unreadable or failed), so neither a conflict nor the check/approval state is established. Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else if mergeState = &#34;waiting&#34; then &#34;GitHub never settled this PR&#39;s mergeability (still computing or checks still pending after repeated re-polls, or the state could not be read). Check the PR on GitHub — resolve any conflict or failing required check if present — then reply to retry.&#34; else &#34;This PR is not mergeable (state: &#34; + mergeState + &#34;). Resolve the conflict or failing required check on the branch, then reply to retry.&#34;" target="question" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_mDraft</bpmn:incoming>
@@ -528,6 +558,7 @@
           <zeebe:ioMapping>
             <zeebe:output source="=&#34;escalate&#34;" target="ciOutcome" />
             <zeebe:output source="=null" target="agentSlaJobType" />
+            <zeebe:output source="=&#34;blocked&#34;" target="mergeState" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_cib_esc</bpmn:incoming>
@@ -684,6 +715,7 @@
           <zeebe:ioMapping>
             <zeebe:output source="=&#34;escalate-attempt&#34;" target="rebaseOutcome" />
             <zeebe:output source="=null" target="agentSlaJobType" />
+            <zeebe:output source="=&#34;conflict&#34;" target="mergeState" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_reb_blocked</bpmn:incoming>
@@ -787,7 +819,15 @@
     <bpmn:sequenceFlow id="f_eg_landed" sourceRef="eg-landed" targetRef="wait-landed" />
     <bpmn:sequenceFlow id="f_eg_evicted" sourceRef="eg-landed" targetRef="wait-evicted" />
     <bpmn:sequenceFlow id="f_eg_landedTimeout" sourceRef="eg-landed" targetRef="wait-landed-timeout" />
-    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="wait-landed-timeout" targetRef="merge-esc-landed" />
+    <bpmn:sequenceFlow id="f_m_landedProbe" sourceRef="wait-landed-timeout" targetRef="landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_gate" sourceRef="landed-probe" targetRef="gw-landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_landed" sourceRef="gw-landed-probe" targetRef="mark-merged">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "landed"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_lp_evicted" sourceRef="gw-landed-probe" targetRef="arm-merge">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "evicted"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="gw-landed-probe" targetRef="merge-esc-landed" />
     <bpmn:sequenceFlow id="f_m_escLanded" sourceRef="merge-esc-landed" targetRef="gw-merge-escalated" />
     <bpmn:sequenceFlow id="f_m_evicted" sourceRef="wait-evicted" targetRef="arm-merge" />
     <bpmn:sequenceFlow id="f_m_gBlocked" name="blocked" sourceRef="gw-merge" targetRef="merge-esc-attempt" />
@@ -874,7 +914,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-merge" bpmnElement="gw-merge" isMarkerVisible="true">
         <dc:Bounds x="1363" y="255" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1362" y="350" width="53" height="28" />
+          <dc:Bounds x="1302" y="290" width="53" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-retry" bpmnElement="gw-merge-retry" isMarkerVisible="true">
@@ -904,16 +944,25 @@
       <bpmndi:BPMNShape id="BPMNShape_wait-landed-timeout" bpmnElement="wait-landed-timeout">
         <dc:Bounds x="1720" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1596" y="143" width="84" height="56" />
+          <dc:Bounds x="1716" y="143" width="84" height="56" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_landed-probe" bpmnElement="landed-probe">
+        <dc:Bounds x="1888" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-landed-probe" bpmnElement="gw-landed-probe" isMarkerVisible="true">
+        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="2087" y="76" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_mark-merged" bpmnElement="mark-merged">
-        <dc:Bounds x="1888" y="240" width="100" height="80" />
+        <dc:Bounds x="2238" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeEnd" bpmnElement="MergeEnd">
-        <dc:Bounds x="2095" y="262" width="36" height="36" />
+        <dc:Bounds x="2445" y="262" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2088" y="303" width="50" height="14" />
+          <dc:Bounds x="2438" y="303" width="50" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeAbandoned" bpmnElement="MergeAbandoned">
@@ -932,19 +981,19 @@
         <dc:Bounds x="1138" y="1680" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-escalated" bpmnElement="gw-merge-escalated" isMarkerVisible="true">
-        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <dc:Bounds x="2438" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2056" y="170" width="74" height="28" />
+          <dc:Bounds x="2406" y="150" width="74" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-landed" bpmnElement="merge-esc-landed">
-        <dc:Bounds x="1888" y="80" width="100" height="80" />
+        <dc:Bounds x="2238" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-merge-answer" bpmnElement="wait-merge-answer">
-        <dc:Bounds x="2238" y="80" width="100" height="80" />
+        <dc:Bounds x="2588" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-merge-answer" bpmnElement="record-merge-answer">
-        <dc:Bounds x="2438" y="80" width="100" height="80" />
+        <dc:Bounds x="2788" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-ci-fix" bpmnElement="gw-ci-fix" isMarkerVisible="true">
         <dc:Bounds x="1163" y="1055" width="50" height="50" />
@@ -1016,14 +1065,14 @@
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gMerged" bpmnElement="f_m_gMerged">
         <di:waypoint x="1413" y="280" />
-        <di:waypoint x="1888" y="280" />
+        <di:waypoint x="2238" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1721" y="258" width="49" height="14" />
+          <dc:Bounds x="1866" y="258" width="49" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_done" bpmnElement="f_m_done">
-        <di:waypoint x="1988" y="280" />
-        <di:waypoint x="2095" y="280" />
+        <di:waypoint x="2338" y="280" />
+        <di:waypoint x="2445" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_rearm" bpmnElement="f_ci_rearm">
         <di:waypoint x="1563" y="1265" />
@@ -1070,54 +1119,62 @@
         <di:waypoint x="1463" y="1060" />
         <di:waypoint x="1688" y="1060" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1391" y="749" width="67" height="28" />
+          <dc:Bounds x="1468" y="829" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_giveup" bpmnElement="f_mr_giveup">
         <di:waypoint x="1588" y="760" />
         <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1605" y="765" width="67" height="28" />
+          <dc:Bounds x="1595" y="765" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_landed" bpmnElement="f_eg_landed">
         <di:waypoint x="1588" y="440" />
         <di:waypoint x="1720" y="440" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2238" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+        <di:waypoint x="2338" y="120" />
+        <di:waypoint x="2438" y="120" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_landed" bpmnElement="f_m_landed">
         <di:waypoint x="1756" y="440" />
-        <di:waypoint x="1938" y="440" />
-        <di:waypoint x="1938" y="320" />
+        <di:waypoint x="2288" y="440" />
+        <di:waypoint x="2288" y="320" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escC" bpmnElement="f_m_escC">
         <di:waypoint x="1788" y="1080" />
-        <di:waypoint x="2288" y="1080" />
-        <di:waypoint x="2288" y="160" />
+        <di:waypoint x="2638" y="1080" />
+        <di:waypoint x="2638" y="160" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escA" bpmnElement="f_m_escA">
         <di:waypoint x="1788" y="760" />
-        <di:waypoint x="2151" y="760" />
-        <di:waypoint x="2151" y="145" />
-        <di:waypoint x="2158" y="145" />
-        <di:waypoint x="2158" y="120" />
-        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2501" y="760" />
+        <di:waypoint x="2501" y="145" />
+        <di:waypoint x="2508" y="145" />
+        <di:waypoint x="2508" y="120" />
+        <di:waypoint x="2488" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escReenter" bpmnElement="f_m_escReenter">
-        <di:waypoint x="2113" y="95" />
-        <di:waypoint x="2113" y="60" />
+        <di:waypoint x="2463" y="95" />
+        <di:waypoint x="2463" y="60" />
         <di:waypoint x="402" y="60" />
         <di:waypoint x="402" y="240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1221" y="13" width="74" height="42" />
+          <dc:Bounds x="1396" y="13" width="74" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answerRecord" bpmnElement="f_m_answerRecord">
-        <di:waypoint x="2338" y="120" />
-        <di:waypoint x="2438" y="120" />
+        <di:waypoint x="2688" y="120" />
+        <di:waypoint x="2788" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answer" bpmnElement="f_m_answer">
-        <di:waypoint x="2488" y="160" />
-        <di:waypoint x="2488" y="340" />
+        <di:waypoint x="2838" y="160" />
+        <di:waypoint x="2838" y="340" />
         <di:waypoint x="402" y="340" />
         <di:waypoint x="402" y="320" />
       </bpmndi:BPMNEdge>
@@ -1236,15 +1293,15 @@
         <di:waypoint x="1213" y="440" />
         <di:waypoint x="1233" y="440" />
         <di:waypoint x="1233" y="465" />
-        <di:waypoint x="2158" y="465" />
-        <di:waypoint x="2158" y="75" />
-        <di:waypoint x="2558" y="75" />
-        <di:waypoint x="2558" y="1125" />
+        <di:waypoint x="2508" y="465" />
+        <di:waypoint x="2508" y="75" />
+        <di:waypoint x="2908" y="75" />
+        <di:waypoint x="2908" y="1125" />
         <di:waypoint x="1318" y="1125" />
         <di:waypoint x="1318" y="1380" />
         <di:waypoint x="1338" y="1380" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2334" y="42" width="49" height="28" />
+          <dc:Bounds x="2684" y="42" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gQueued" bpmnElement="f_m_gQueued">
@@ -1258,13 +1315,13 @@
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gRetry" bpmnElement="f_m_gRetry">
         <di:waypoint x="1388" y="255" />
         <di:waypoint x="1388" y="235" />
-        <di:waypoint x="2218" y="235" />
-        <di:waypoint x="2218" y="805" />
+        <di:waypoint x="2568" y="235" />
+        <di:waypoint x="2568" y="805" />
         <di:waypoint x="1538" y="805" />
         <di:waypoint x="1563" y="805" />
         <di:waypoint x="1563" y="785" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1852" y="772" width="78" height="28" />
+          <dc:Bounds x="2485" y="766" width="78" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_evicted" bpmnElement="f_eg_evicted">
@@ -1281,30 +1338,26 @@
         <di:waypoint x="1700" y="120" />
         <di:waypoint x="1720" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_landed" bpmnElement="f_lp_landed">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="280" />
+        <di:waypoint x="2238" y="280" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gBlocked" bpmnElement="f_m_gBlocked">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="638" />
-        <di:waypoint x="1668" y="638" />
-        <di:waypoint x="1668" y="740" />
-        <di:waypoint x="1688" y="740" />
+        <di:waypoint x="1413" y="280" />
+        <di:waypoint x="1668" y="280" />
+        <di:waypoint x="1668" y="760" />
+        <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1932" y="616" width="53" height="14" />
+          <dc:Bounds x="1610" y="412" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gAbandoned" bpmnElement="f_m_gAbandoned">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="920" />
-        <di:waypoint x="1581" y="920" />
+        <di:waypoint x="1388" y="305" />
+        <di:waypoint x="1388" y="920" />
+        <di:waypoint x="1545" y="920" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2131" y="849" width="82" height="28" />
+          <dc:Bounds x="1301" y="599" width="82" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_waitDep" bpmnElement="f_ci_waitDep">
@@ -1338,25 +1391,25 @@
         <di:waypoint x="1438" y="1400" />
         <di:waypoint x="1538" y="1400" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedProbe" bpmnElement="f_m_landedProbe">
         <di:waypoint x="1756" y="120" />
         <di:waypoint x="1888" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_gate" bpmnElement="f_lp_gate">
         <di:waypoint x="1988" y="120" />
         <di:waypoint x="2088" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escT" bpmnElement="f_m_escT">
         <di:waypoint x="1238" y="1720" />
-        <di:waypoint x="2008" y="1720" />
-        <di:waypoint x="2008" y="145" />
-        <di:waypoint x="2068" y="145" />
-        <di:waypoint x="2068" y="120" />
-        <di:waypoint x="2088" y="120" />
+        <di:waypoint x="2358" y="1720" />
+        <di:waypoint x="2358" y="145" />
+        <di:waypoint x="2418" y="145" />
+        <di:waypoint x="2418" y="120" />
+        <di:waypoint x="2438" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escWait" bpmnElement="f_m_escWait">
-        <di:waypoint x="2138" y="120" />
-        <di:waypoint x="2238" y="120" />
+        <di:waypoint x="2488" y="120" />
+        <di:waypoint x="2588" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_recheck" bpmnElement="f_ci_recheck">
         <di:waypoint x="1563" y="1265" />
@@ -1391,6 +1444,12 @@
           <dc:Bounds x="946" y="772" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_evicted" bpmnElement="f_lp_evicted">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="340" />
+        <di:waypoint x="402" y="340" />
+        <di:waypoint x="402" y="320" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_evicted" bpmnElement="f_m_evicted">
         <di:waypoint x="1738" y="618" />
         <di:waypoint x="1738" y="638" />

package/test/memStatusCas.ts

@@ -0,0 +1,23 @@
+// Test-only: apply the poller's compare-and-set status flip (`flipToMergingThenPublish`, app/service.ts)
+// — `UPDATE <t> SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?` — against an
+// in-memory store, so hand-rolled `DataLayer` fakes model the real conditional write (and its
+// lost-race `changed: 0`) instead of no-op'ing it. Returns `null` for any other statement so the
+// caller can fall through to its own handling (or throw loudly).
+const CAS =
+  /^\s*UPDATE\s+"?(\w+)"?\s+SET\s+"?(\w+)"?\s*=\s*\?\s*,\s*"?(\w+)"?\s*=\s*\?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s+AND\s+"?(\w+)"?\s*=\s*\?\s*$/i;
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake over dynamic row shapes.
+export function memStatusCas(stores: Record<string, any[]>, sql: string, params: unknown[]): { changed: number } | null {
+  const m = sql.match(CAS);
+  if (!m) return null;
+  const [, table, setA, setB, keyCol, condCol] = m;
+  let changed = 0;
+  for (const r of (stores[table] ??= [])) {
+    if (r[keyCol] === params[2] && r[condCol] === params[3]) {
+      r[setA] = params[0];
+      r[setB] = params[1];
+      changed++;
+    }
+  }
+  return { changed };
+}

package/workers/landed-probe/worker.test.ts

@@ -0,0 +1,41 @@
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { PrState } from "../../app/github.ts";
+import { probeLanded } from "./worker.ts";
+
+const base: PrState = {
+  merged: false,
+  state: "open",
+  mergeStateStatus: "BLOCKED",
+  failingChecks: 0,
+  failingCheckNames: [],
+  totalChecks: 0,
+  presentCheckNames: [],
+  pendingCheckNames: [],
+  checkConclusions: {},
+  isDraft: false,
+  headRefOid: null,
+  mergeQueueEntry: null,
+  unresolvedThreads: -1,
+};
+const fake = (st: PrState | null, fail = false) => async () => {
+  if (fail) throw new Error("boom");
+  return st;
+};
+
+test("landed-probe: a MERGED PR reads landed (#933)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, merged: true, state: "merged" })), "landed");
+});
+test("landed-probe: still queued reads waiting", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(base)), "waiting");
+});
+test("landed-probe: dropped from the native queue reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, mergeQueueEntry: false })), "evicted");
+});
+test("landed-probe: closed unmerged reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, state: "closed" })), "evicted");
+});
+test("landed-probe: unreadable state is conservative (waiting)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(null)), "waiting");
+  assertEquals(await probeLanded("a/b", 1, "", fake(null, true)), "waiting");
+});

package/workers/landed-probe/worker.ts

@@ -0,0 +1,43 @@
+// pr.landed-probe — the merge-queue landing timer fired (issue #933). Before escalating "did not
+// land", re-read ground truth: the queue may have landed the PR after the poller's last `queued`
+// pass but before (or exactly as) the `landedWaitTimeout` timer won the `eg-landed` race — e.g. a
+// slow Mergify batch that merges right around the timeout, or a poller pass that errored/stalled
+// on this PR. Escalating a landed PR forces a pointless human "retry", so the timeout arm routes
+// through this probe and `gw-landed-probe` instead of straight to `merge-esc-landed`:
+//   • landed  → mark-merged (never escalate a landed PR)
+//   • evicted → arm-merge (re-run the mergeable gate, same as a `merge-evicted` message)
+//   • waiting → merge-esc-landed (genuinely never landed — the #556 backstop)
+// The verdict is derived by the poller's own canonical classifier (`queuedVerdict`) so the probe
+// and the poll pass can never drift. An unreadable PR reads as `waiting` (escalate — conservative).
+import type { AppJobHandler } from "@nanobpm/urban";
+import { fetchPrState } from "../../app/github.ts";
+import { queuedVerdict } from "../../app/service.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+type In = WorkerInputs["pr.landed-probe"];
+
+interface Out extends Record<string, unknown> {
+  landedVerdict: "landed" | "evicted" | "waiting";
+}
+
+export async function probeLanded(
+  repo: string,
+  prNumber: number | string,
+  token: string,
+  fetch: typeof fetchPrState = fetchPrState,
+): Promise<Out["landedVerdict"]> {
+  const st = await fetch(repo, prNumber, token, { withMergeQueue: true }).catch(() => null);
+  if (st === null) return "waiting";
+  // A PR closed WITHOUT merging can never land; re-arm so the merge poller abandons it.
+  if (!st.merged && st.state === "closed") return "evicted";
+  return queuedVerdict(st);
+}
+
+const handler: AppJobHandler<In, Out> = async (job, app) => {
+  const { repo, prNumber, prKey } = job.variables;
+  const landedVerdict = await probeLanded(repo, prNumber, process.env.GITHUB_TOKEN ?? "");
+  app.log.info("landed-probe: landing timeout fired — re-read PR state", { prKey, landedVerdict });
+  return { landedVerdict };
+};
+
+export default handler;