@nanobpm/nano-workforce 0.206.2 → 0.206.3

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.206.3](https://github.com/nanobpm/nano-workforce/compare/v0.206.2...v0.206.3) (2026-11-09)
+
+### Bug Fixes
+
+* **merge:** never escalate a PR that already landed when the queue landing timeout fires ([#935](https://github.com/nanobpm/nano-workforce/issues/935)) ([f731dc6](https://github.com/nanobpm/nano-workforce/commit/f731dc60dc0cb7480b425e88d1d216b95d63a5c1)), closes [#933](https://github.com/nanobpm/nano-workforce/issues/933)
+
 ## [0.206.2](https://github.com/nanobpm/nano-workforce/compare/v0.206.1...v0.206.2) (2026-11-09)
 
 ### Bug Fixes

package/app/mergeBlockedThreads.test.ts

@@ -17,6 +17,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { assert, assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -73,6 +74,8 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
     table: (n: string, pk?: string) => tbl(n, pk),
     open: () => ({
       exec: async (sql: string, params: any[] = []) => {
+        const cas = memStatusCas(stores, sql, params);
+        if (cas) return cas;
         const m = sql.match(/^\s*DELETE\s+FROM\s+"?(\w+)"?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s*$/i);
         if (!m) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
         const rows = (stores[m[1]] ??= [] as any[]);

package/app/mergeLoopBehaviour.test.ts

@@ -52,6 +52,7 @@ const ALL_JOB_TYPES = [
   "pr.arm-merge",
   "pr.merge",
   "pr.merge-stall-probe",
+  "pr.landed-probe",
   "pr.mark-merged",
   "senior:fix-ci",
   "senior:rebase",
@@ -66,6 +67,7 @@ const DEFAULT_RESPONSES: Record<string, Responder> = {
   "pr.record-dependency": {},
   "pr.answer-escalation": {},
   "pr.persist-escalation": { escalated: true },
+  "pr.landed-probe": { landedVerdict: "waiting" },
 };
 
 // Every FEEL expression in the model references these; start them defined (null,
@@ -239,6 +241,30 @@ test("a queued merge that never lands escalates when the landing timeout fires (
   assertStringIncludes(String(escalation(engine).question ?? ""), "did not land within the merge-queue landing timeout", "the escalation must name the landing-timeout trigger");
 });
 
+test("a landing timeout firing on a PR that already MERGED completes merged with no escalation (#933)", async () => {
+  // The queue landed the PR, but the timer won the `eg-landed` race before the poller published
+  // `merge-landed`. The timeout arm must re-read ground truth and finalize — never escalate a landed PR.
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "landed" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompleted().hasNoIncident().hasCompletedElements("landed-probe", "mark-merged");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "a landed PR must never be escalated");
+});
+
+test("a landing timeout on a PR evicted from the queue re-arms the merge poller (#933)", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "evicted" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "an evicted PR re-arms rather than escalating");
+});
+
 test("answering the landing-timeout escalation re-arms the merge poller (#556)", async () => {
   const engine = await boot({ responses: { "pr.merge": { mergeStatus: "queued" } } });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });

package/app/mergeOutOfBandTerminal.test.ts

@@ -13,6 +13,7 @@
 // message THAT wait correlates to; this test asserts the class over every (status × merged/closed).
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -45,7 +46,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 
@@ -176,3 +186,49 @@ test("still-open waiting_deps PR with an unmerged dep publishes nothing and stay
   assertEquals(messages.length, 0);
   assertEquals(stores["pull_requests"][0].status, "waiting_deps");
 });
+
+// PR #935 review: a poll pass reads `queued`, then stalls on GitHub while the process's own landing
+// timeout path completes `mark-merged` (status → `merged`). When the delayed pass resumes, its flip
+// must NOT clobber the terminal `merged` with `merging` (no pass scans `merging`, so it would stick)
+// nor publish a `merge-landed` whose subscription is gone. The flip is a compare-and-set on the
+// status the pass read; a lost race skips the publish entirely.
+// Asserted on `waiting_deps` (the flip is the one shared helper every merge-stage wait uses).
+test("a delayed merge-stage poll never overwrites a concurrently-written terminal status", async () => {
+  const { data, stores } = memData();
+  const { engine, messages } = recordingEngine();
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  const inner = githubFetch(new Map<number, Live>([[100, "merged"]]));
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevFetch = globalThis.fetch;
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  // While the poll awaits GitHub, the timeout path's `mark-merged` lands the terminal status.
+  globalThis.fetch = ((url: string | URL | Request, init?: RequestInit) => {
+    // Replace (not mutate) the row: a real DB read hands the pass a snapshot, not a live reference.
+    stores["pull_requests"][0] = { ...stores["pull_requests"][0], status: "merged" };
+    return inner(url, init);
+  }) as typeof fetch;
+  try {
+    await pollMerges(data, engine, "tok");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode === undefined) delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    else process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+  }
+  assertEquals(messages.length, 0, "a lost race must not publish to a vanished subscription");
+  assertEquals(stores["pull_requests"][0].status, "merged");
+});
+
+// The publish-failure revert is conditional too: it only undoes its OWN `merging`.
+test("a failed publish reverts merging back to the read status", async () => {
+  const { data, stores } = memData();
+  const engine = {
+    async publishMessage() {
+      throw new Error("boom");
+    },
+  } as any as EngineClient;
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  await withGithub(new Map<number, Live>([[100, "merged"]]), () => pollMerges(data, engine, "tok").catch(() => {}));
+  assertEquals(stores["pull_requests"][0].status, "waiting_deps");
+});

package/app/mergeQueueEviction.test.ts

@@ -10,6 +10,7 @@
 // token-transport GitHub stub that serves BOTH the REST PR view and the GraphQL merge-queue probe.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { fetchMergeQueueMembership } from "./github.ts";
 import { pollMerges } from "./service.ts";
@@ -42,7 +43,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 

package/app/service.ts

@@ -1572,24 +1572,44 @@ async function classifyWaveTarget(
  * otherwise wedge the PR there forever — the next pass would never pick it back up. Reverting on
  * failure keeps the PR on a pollable status so the next pass retries. Single source of truth for
  * the flip-then-publish handoff shared by all merge-stage waits below. */
-async function flipToMergingThenPublish(
+export async function flipToMergingThenPublish(
   data: DataLayer,
   engine: EngineClient,
   prKey: string,
   prevStatus: string,
   message: Parameters<EngineClient["publishMessage"]>[0],
-) {
-  await prs(data).update(prKey, { status: "merging", updated_at: now() });
+): Promise<boolean> {
+  // Compare-and-set (#935 review): the flip only wins if the row is STILL on the status this pass
+  // read. A pass that read `queued`, then stalled on GitHub while the process's own timeout path
+  // completed `mark-merged`, must not clobber the terminal `merged` with `merging` (no pass scans
+  // `merging`, and the completed loop has no worker left to restore it) nor publish a message whose
+  // subscription is gone. A lost race skips the publish entirely.
+  const db = data.open();
+  const flipped = await db.exec(
+    "UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?",
+    ["merging", now(), prKey, prevStatus],
+  );
+  if (flipped.changed === 0) {
+    console.log(`[poller] ${prKey} left ${prevStatus} concurrently — skipping ${message.name}`);
+    return false;
+  }
   try {
     await engine.publishMessage(message);
   } catch (err) {
     try {
-      await prs(data).update(prKey, { status: prevStatus, updated_at: now() });
+      // Conditional revert too: only undo OUR `merging`, never a status another actor wrote since.
+      await db.exec("UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?", [
+        prevStatus,
+        now(),
+        prKey,
+        "merging",
+      ]);
     } catch (revertErr) {
       console.error(`[poller] revert ${prKey} -> ${prevStatus} failed: ${revertErr}`);
     }
     throw err;
   }
+  return true;
 }
 
 export async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<PrLaneDecision | null> {

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.206.2",
-  "gitSha": "71984d5d607151b2c3690a12d6b05537b24c3ece",
-  "gitTag": "v0.206.2",
-  "builtAt": "2026-11-09T11:18:01.340Z"
+  "version": "0.206.3",
+  "gitSha": "f731dc60dc0cb7480b425e88d1d216b95d63a5c1",
+  "gitTag": "v0.206.3",
+  "builtAt": "2026-11-09T21:25:41.376Z"
 }

package/nano.app.json

@@ -148,6 +148,10 @@
       "taskType": "pr.mark-merged",
       "handler": "workers/mark-merged/worker.ts"
     },
+    {
+      "taskType": "pr.landed-probe",
+      "handler": "workers/landed-probe/worker.ts"
+    },
     {
       "taskType": "pr.merge-stall-probe",
       "handler": "workers/merge-stall-probe/worker.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.206.2",
+  "version": "0.206.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/merge-loop.bpmn

@@ -56,6 +56,14 @@
           <nano:extend name="reviewThreads" type="integer" optional="true" />
           <nano:extend name="pendingChecks" type="integer" optional="true" />
         </nano:shape>
+        <nano:shape id="LandedProbeIn" name="Landed probe — input">
+          <nano:extend name="prKey" type="string" />
+          <nano:extend name="repo" type="string" />
+          <nano:extend name="prNumber" type="integer" />
+        </nano:shape>
+        <nano:shape id="LandedProbeOut" name="Landed probe — result">
+          <nano:extend name="landedVerdict" type="string" />
+        </nano:shape>
         <nano:shape id="MergeReady" name="merge-ready message payload">
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
@@ -125,6 +133,7 @@
       <bpmn:incoming>f_ci_rearm</bpmn:incoming>
       <bpmn:incoming>f_reb_rearm</bpmn:incoming>
       <bpmn:incoming>f_m_evicted</bpmn:incoming>
+      <bpmn:incoming>f_lp_evicted</bpmn:incoming>
       <bpmn:incoming>f_m_escReenter</bpmn:incoming>
       <bpmn:incoming>f_mr_go</bpmn:incoming>
       <bpmn:outgoing>f_m_arm</bpmn:outgoing>
@@ -234,11 +243,28 @@
     </bpmn:intermediateCatchEvent>
     <bpmn:intermediateCatchEvent id="wait-landed-timeout" name="Wait: merge-queue landing timeout">
       <bpmn:incoming>f_eg_landedTimeout</bpmn:incoming>
-      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedProbe</bpmn:outgoing>
       <bpmn:timerEventDefinition id="ted_landedTimeout">
         <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=landedWaitTimeout</bpmn:timeDuration>
       </bpmn:timerEventDefinition>
     </bpmn:intermediateCatchEvent>
+    <bpmn:serviceTask id="landed-probe" name="Probe: did the queued PR land?">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.landed-probe" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="LandedProbeIn" />
+          <zeebe:property name="io.nanobpm.dataEnvelope.out" value="LandedProbeOut" />
+        </zeebe:properties>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_m_landedProbe</bpmn:incoming>
+      <bpmn:outgoing>f_lp_gate</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:exclusiveGateway id="gw-landed-probe" name="landed?" default="f_m_landedStalled">
+      <bpmn:incoming>f_lp_gate</bpmn:incoming>
+      <bpmn:outgoing>f_lp_landed</bpmn:outgoing>
+      <bpmn:outgoing>f_lp_evicted</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
     <bpmn:serviceTask id="mark-merged" name="Mark merged">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="pr.mark-merged" />
@@ -248,6 +274,7 @@
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_gMerged</bpmn:incoming>
       <bpmn:incoming>f_m_landed</bpmn:incoming>
+      <bpmn:incoming>f_lp_landed</bpmn:incoming>
       <bpmn:outgoing>f_m_done</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:endEvent id="MergeEnd" name="Merged">
@@ -792,7 +819,15 @@
     <bpmn:sequenceFlow id="f_eg_landed" sourceRef="eg-landed" targetRef="wait-landed" />
     <bpmn:sequenceFlow id="f_eg_evicted" sourceRef="eg-landed" targetRef="wait-evicted" />
     <bpmn:sequenceFlow id="f_eg_landedTimeout" sourceRef="eg-landed" targetRef="wait-landed-timeout" />
-    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="wait-landed-timeout" targetRef="merge-esc-landed" />
+    <bpmn:sequenceFlow id="f_m_landedProbe" sourceRef="wait-landed-timeout" targetRef="landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_gate" sourceRef="landed-probe" targetRef="gw-landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_landed" sourceRef="gw-landed-probe" targetRef="mark-merged">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "landed"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_lp_evicted" sourceRef="gw-landed-probe" targetRef="arm-merge">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "evicted"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="gw-landed-probe" targetRef="merge-esc-landed" />
     <bpmn:sequenceFlow id="f_m_escLanded" sourceRef="merge-esc-landed" targetRef="gw-merge-escalated" />
     <bpmn:sequenceFlow id="f_m_evicted" sourceRef="wait-evicted" targetRef="arm-merge" />
     <bpmn:sequenceFlow id="f_m_gBlocked" name="blocked" sourceRef="gw-merge" targetRef="merge-esc-attempt" />
@@ -879,7 +914,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-merge" bpmnElement="gw-merge" isMarkerVisible="true">
         <dc:Bounds x="1363" y="255" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1362" y="350" width="53" height="28" />
+          <dc:Bounds x="1302" y="290" width="53" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-retry" bpmnElement="gw-merge-retry" isMarkerVisible="true">
@@ -909,16 +944,25 @@
       <bpmndi:BPMNShape id="BPMNShape_wait-landed-timeout" bpmnElement="wait-landed-timeout">
         <dc:Bounds x="1720" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1596" y="143" width="84" height="56" />
+          <dc:Bounds x="1716" y="143" width="84" height="56" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_landed-probe" bpmnElement="landed-probe">
+        <dc:Bounds x="1888" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-landed-probe" bpmnElement="gw-landed-probe" isMarkerVisible="true">
+        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="2087" y="76" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_mark-merged" bpmnElement="mark-merged">
-        <dc:Bounds x="1888" y="240" width="100" height="80" />
+        <dc:Bounds x="2238" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeEnd" bpmnElement="MergeEnd">
-        <dc:Bounds x="2095" y="262" width="36" height="36" />
+        <dc:Bounds x="2445" y="262" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2088" y="303" width="50" height="14" />
+          <dc:Bounds x="2438" y="303" width="50" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeAbandoned" bpmnElement="MergeAbandoned">
@@ -937,19 +981,19 @@
         <dc:Bounds x="1138" y="1680" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-escalated" bpmnElement="gw-merge-escalated" isMarkerVisible="true">
-        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <dc:Bounds x="2438" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2056" y="170" width="74" height="28" />
+          <dc:Bounds x="2406" y="150" width="74" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-landed" bpmnElement="merge-esc-landed">
-        <dc:Bounds x="1888" y="80" width="100" height="80" />
+        <dc:Bounds x="2238" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-merge-answer" bpmnElement="wait-merge-answer">
-        <dc:Bounds x="2238" y="80" width="100" height="80" />
+        <dc:Bounds x="2588" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-merge-answer" bpmnElement="record-merge-answer">
-        <dc:Bounds x="2438" y="80" width="100" height="80" />
+        <dc:Bounds x="2788" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-ci-fix" bpmnElement="gw-ci-fix" isMarkerVisible="true">
         <dc:Bounds x="1163" y="1055" width="50" height="50" />
@@ -1021,14 +1065,14 @@
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gMerged" bpmnElement="f_m_gMerged">
         <di:waypoint x="1413" y="280" />
-        <di:waypoint x="1888" y="280" />
+        <di:waypoint x="2238" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1721" y="258" width="49" height="14" />
+          <dc:Bounds x="1866" y="258" width="49" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_done" bpmnElement="f_m_done">
-        <di:waypoint x="1988" y="280" />
-        <di:waypoint x="2095" y="280" />
+        <di:waypoint x="2338" y="280" />
+        <di:waypoint x="2445" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_rearm" bpmnElement="f_ci_rearm">
         <di:waypoint x="1563" y="1265" />
@@ -1075,54 +1119,62 @@
         <di:waypoint x="1463" y="1060" />
         <di:waypoint x="1688" y="1060" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1391" y="749" width="67" height="28" />
+          <dc:Bounds x="1468" y="829" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_giveup" bpmnElement="f_mr_giveup">
         <di:waypoint x="1588" y="760" />
         <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1605" y="765" width="67" height="28" />
+          <dc:Bounds x="1595" y="765" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_landed" bpmnElement="f_eg_landed">
         <di:waypoint x="1588" y="440" />
         <di:waypoint x="1720" y="440" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2238" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+        <di:waypoint x="2338" y="120" />
+        <di:waypoint x="2438" y="120" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_landed" bpmnElement="f_m_landed">
         <di:waypoint x="1756" y="440" />
-        <di:waypoint x="1938" y="440" />
-        <di:waypoint x="1938" y="320" />
+        <di:waypoint x="2288" y="440" />
+        <di:waypoint x="2288" y="320" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escC" bpmnElement="f_m_escC">
         <di:waypoint x="1788" y="1080" />
-        <di:waypoint x="2288" y="1080" />
-        <di:waypoint x="2288" y="160" />
+        <di:waypoint x="2638" y="1080" />
+        <di:waypoint x="2638" y="160" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escA" bpmnElement="f_m_escA">
         <di:waypoint x="1788" y="760" />
-        <di:waypoint x="2151" y="760" />
-        <di:waypoint x="2151" y="145" />
-        <di:waypoint x="2158" y="145" />
-        <di:waypoint x="2158" y="120" />
-        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2501" y="760" />
+        <di:waypoint x="2501" y="145" />
+        <di:waypoint x="2508" y="145" />
+        <di:waypoint x="2508" y="120" />
+        <di:waypoint x="2488" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escReenter" bpmnElement="f_m_escReenter">
-        <di:waypoint x="2113" y="95" />
-        <di:waypoint x="2113" y="60" />
+        <di:waypoint x="2463" y="95" />
+        <di:waypoint x="2463" y="60" />
         <di:waypoint x="402" y="60" />
         <di:waypoint x="402" y="240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1221" y="13" width="74" height="42" />
+          <dc:Bounds x="1396" y="13" width="74" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answerRecord" bpmnElement="f_m_answerRecord">
-        <di:waypoint x="2338" y="120" />
-        <di:waypoint x="2438" y="120" />
+        <di:waypoint x="2688" y="120" />
+        <di:waypoint x="2788" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answer" bpmnElement="f_m_answer">
-        <di:waypoint x="2488" y="160" />
-        <di:waypoint x="2488" y="340" />
+        <di:waypoint x="2838" y="160" />
+        <di:waypoint x="2838" y="340" />
         <di:waypoint x="402" y="340" />
         <di:waypoint x="402" y="320" />
       </bpmndi:BPMNEdge>
@@ -1241,15 +1293,15 @@
         <di:waypoint x="1213" y="440" />
         <di:waypoint x="1233" y="440" />
         <di:waypoint x="1233" y="465" />
-        <di:waypoint x="2158" y="465" />
-        <di:waypoint x="2158" y="75" />
-        <di:waypoint x="2558" y="75" />
-        <di:waypoint x="2558" y="1125" />
+        <di:waypoint x="2508" y="465" />
+        <di:waypoint x="2508" y="75" />
+        <di:waypoint x="2908" y="75" />
+        <di:waypoint x="2908" y="1125" />
         <di:waypoint x="1318" y="1125" />
         <di:waypoint x="1318" y="1380" />
         <di:waypoint x="1338" y="1380" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2334" y="42" width="49" height="28" />
+          <dc:Bounds x="2684" y="42" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gQueued" bpmnElement="f_m_gQueued">
@@ -1263,13 +1315,13 @@
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gRetry" bpmnElement="f_m_gRetry">
         <di:waypoint x="1388" y="255" />
         <di:waypoint x="1388" y="235" />
-        <di:waypoint x="2218" y="235" />
-        <di:waypoint x="2218" y="805" />
+        <di:waypoint x="2568" y="235" />
+        <di:waypoint x="2568" y="805" />
         <di:waypoint x="1538" y="805" />
         <di:waypoint x="1563" y="805" />
         <di:waypoint x="1563" y="785" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1852" y="772" width="78" height="28" />
+          <dc:Bounds x="2485" y="766" width="78" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_evicted" bpmnElement="f_eg_evicted">
@@ -1286,30 +1338,26 @@
         <di:waypoint x="1700" y="120" />
         <di:waypoint x="1720" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_landed" bpmnElement="f_lp_landed">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="280" />
+        <di:waypoint x="2238" y="280" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gBlocked" bpmnElement="f_m_gBlocked">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="638" />
-        <di:waypoint x="1668" y="638" />
-        <di:waypoint x="1668" y="740" />
-        <di:waypoint x="1688" y="740" />
+        <di:waypoint x="1413" y="280" />
+        <di:waypoint x="1668" y="280" />
+        <di:waypoint x="1668" y="760" />
+        <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1932" y="616" width="53" height="14" />
+          <dc:Bounds x="1610" y="412" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gAbandoned" bpmnElement="f_m_gAbandoned">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="920" />
-        <di:waypoint x="1581" y="920" />
+        <di:waypoint x="1388" y="305" />
+        <di:waypoint x="1388" y="920" />
+        <di:waypoint x="1545" y="920" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2131" y="849" width="82" height="28" />
+          <dc:Bounds x="1301" y="599" width="82" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_waitDep" bpmnElement="f_ci_waitDep">
@@ -1343,25 +1391,25 @@
         <di:waypoint x="1438" y="1400" />
         <di:waypoint x="1538" y="1400" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedProbe" bpmnElement="f_m_landedProbe">
         <di:waypoint x="1756" y="120" />
         <di:waypoint x="1888" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_gate" bpmnElement="f_lp_gate">
         <di:waypoint x="1988" y="120" />
         <di:waypoint x="2088" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escT" bpmnElement="f_m_escT">
         <di:waypoint x="1238" y="1720" />
-        <di:waypoint x="2008" y="1720" />
-        <di:waypoint x="2008" y="145" />
-        <di:waypoint x="2068" y="145" />
-        <di:waypoint x="2068" y="120" />
-        <di:waypoint x="2088" y="120" />
+        <di:waypoint x="2358" y="1720" />
+        <di:waypoint x="2358" y="145" />
+        <di:waypoint x="2418" y="145" />
+        <di:waypoint x="2418" y="120" />
+        <di:waypoint x="2438" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escWait" bpmnElement="f_m_escWait">
-        <di:waypoint x="2138" y="120" />
-        <di:waypoint x="2238" y="120" />
+        <di:waypoint x="2488" y="120" />
+        <di:waypoint x="2588" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_recheck" bpmnElement="f_ci_recheck">
         <di:waypoint x="1563" y="1265" />
@@ -1396,6 +1444,12 @@
           <dc:Bounds x="946" y="772" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_evicted" bpmnElement="f_lp_evicted">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="340" />
+        <di:waypoint x="402" y="340" />
+        <di:waypoint x="402" y="320" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_evicted" bpmnElement="f_m_evicted">
         <di:waypoint x="1738" y="618" />
         <di:waypoint x="1738" y="638" />

package/test/memStatusCas.ts

@@ -0,0 +1,23 @@
+// Test-only: apply the poller's compare-and-set status flip (`flipToMergingThenPublish`, app/service.ts)
+// — `UPDATE <t> SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?` — against an
+// in-memory store, so hand-rolled `DataLayer` fakes model the real conditional write (and its
+// lost-race `changed: 0`) instead of no-op'ing it. Returns `null` for any other statement so the
+// caller can fall through to its own handling (or throw loudly).
+const CAS =
+  /^\s*UPDATE\s+"?(\w+)"?\s+SET\s+"?(\w+)"?\s*=\s*\?\s*,\s*"?(\w+)"?\s*=\s*\?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s+AND\s+"?(\w+)"?\s*=\s*\?\s*$/i;
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake over dynamic row shapes.
+export function memStatusCas(stores: Record<string, any[]>, sql: string, params: unknown[]): { changed: number } | null {
+  const m = sql.match(CAS);
+  if (!m) return null;
+  const [, table, setA, setB, keyCol, condCol] = m;
+  let changed = 0;
+  for (const r of (stores[table] ??= [])) {
+    if (r[keyCol] === params[2] && r[condCol] === params[3]) {
+      r[setA] = params[0];
+      r[setB] = params[1];
+      changed++;
+    }
+  }
+  return { changed };
+}

package/workers/landed-probe/worker.test.ts

@@ -0,0 +1,41 @@
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { PrState } from "../../app/github.ts";
+import { probeLanded } from "./worker.ts";
+
+const base: PrState = {
+  merged: false,
+  state: "open",
+  mergeStateStatus: "BLOCKED",
+  failingChecks: 0,
+  failingCheckNames: [],
+  totalChecks: 0,
+  presentCheckNames: [],
+  pendingCheckNames: [],
+  checkConclusions: {},
+  isDraft: false,
+  headRefOid: null,
+  mergeQueueEntry: null,
+  unresolvedThreads: -1,
+};
+const fake = (st: PrState | null, fail = false) => async () => {
+  if (fail) throw new Error("boom");
+  return st;
+};
+
+test("landed-probe: a MERGED PR reads landed (#933)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, merged: true, state: "merged" })), "landed");
+});
+test("landed-probe: still queued reads waiting", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(base)), "waiting");
+});
+test("landed-probe: dropped from the native queue reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, mergeQueueEntry: false })), "evicted");
+});
+test("landed-probe: closed unmerged reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, state: "closed" })), "evicted");
+});
+test("landed-probe: unreadable state is conservative (waiting)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(null)), "waiting");
+  assertEquals(await probeLanded("a/b", 1, "", fake(null, true)), "waiting");
+});

package/workers/landed-probe/worker.ts

@@ -0,0 +1,43 @@
+// pr.landed-probe — the merge-queue landing timer fired (issue #933). Before escalating "did not
+// land", re-read ground truth: the queue may have landed the PR after the poller's last `queued`
+// pass but before (or exactly as) the `landedWaitTimeout` timer won the `eg-landed` race — e.g. a
+// slow Mergify batch that merges right around the timeout, or a poller pass that errored/stalled
+// on this PR. Escalating a landed PR forces a pointless human "retry", so the timeout arm routes
+// through this probe and `gw-landed-probe` instead of straight to `merge-esc-landed`:
+//   • landed  → mark-merged (never escalate a landed PR)
+//   • evicted → arm-merge (re-run the mergeable gate, same as a `merge-evicted` message)
+//   • waiting → merge-esc-landed (genuinely never landed — the #556 backstop)
+// The verdict is derived by the poller's own canonical classifier (`queuedVerdict`) so the probe
+// and the poll pass can never drift. An unreadable PR reads as `waiting` (escalate — conservative).
+import type { AppJobHandler } from "@nanobpm/urban";
+import { fetchPrState } from "../../app/github.ts";
+import { queuedVerdict } from "../../app/service.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+type In = WorkerInputs["pr.landed-probe"];
+
+interface Out extends Record<string, unknown> {
+  landedVerdict: "landed" | "evicted" | "waiting";
+}
+
+export async function probeLanded(
+  repo: string,
+  prNumber: number | string,
+  token: string,
+  fetch: typeof fetchPrState = fetchPrState,
+): Promise<Out["landedVerdict"]> {
+  const st = await fetch(repo, prNumber, token, { withMergeQueue: true }).catch(() => null);
+  if (st === null) return "waiting";
+  // A PR closed WITHOUT merging can never land; re-arm so the merge poller abandons it.
+  if (!st.merged && st.state === "closed") return "evicted";
+  return queuedVerdict(st);
+}
+
+const handler: AppJobHandler<In, Out> = async (job, app) => {
+  const { repo, prNumber, prKey } = job.variables;
+  const landedVerdict = await probeLanded(repo, prNumber, process.env.GITHUB_TOKEN ?? "");
+  app.log.info("landed-probe: landing timeout fired — re-read PR state", { prKey, landedVerdict });
+  return { landedVerdict };
+};
+
+export default handler;