@nanobpm/nano-workforce 0.206.2 → 0.206.4

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.206.4](https://github.com/nanobpm/nano-workforce/compare/v0.206.3...v0.206.4) (2026-11-09)
+
+### Bug Fixes
+
+* **delivery:** accept affirmative-completion aliases as producer terminal-success statuses ([#934](https://github.com/nanobpm/nano-workforce/issues/934)) ([b8c5e4e](https://github.com/nanobpm/nano-workforce/commit/b8c5e4e5cb59ce42bb2d6573e107d1865393fa27)), closes [731/#760](https://github.com/731/nano-workforce/issues/760) [nano-bpm#1337](https://github.com/nanobpm/nano-bpm/issues/1337) [#1464](https://github.com/nanobpm/nano-workforce/issues/1464) [nano-bpm#1463](https://github.com/nanobpm/nano-bpm/issues/1463) [#1476](https://github.com/nanobpm/nano-workforce/issues/1476) [#731](https://github.com/nanobpm/nano-workforce/issues/731) [#760](https://github.com/nanobpm/nano-workforce/issues/760) [#761](https://github.com/nanobpm/nano-workforce/issues/761)
+
+## [0.206.3](https://github.com/nanobpm/nano-workforce/compare/v0.206.2...v0.206.3) (2026-11-09)
+
+### Bug Fixes
+
+* **merge:** never escalate a PR that already landed when the queue landing timeout fires ([#935](https://github.com/nanobpm/nano-workforce/issues/935)) ([f731dc6](https://github.com/nanobpm/nano-workforce/commit/f731dc60dc0cb7480b425e88d1d216b95d63a5c1)), closes [#933](https://github.com/nanobpm/nano-workforce/issues/933)
+
 ## [0.206.2](https://github.com/nanobpm/nano-workforce/compare/v0.206.1...v0.206.2) (2026-11-09)
 
 ### Bug Fixes

package/SPEC.md

@@ -1289,7 +1289,9 @@ reserved — with **one exception**: an agent emitting `pr` (the canonical
 result field holds, and the retry reset correctly clears both — reserving them would
 forbid that flagship pattern. The exception is the agent completion-control **`status`**:
 the producer status gate reads that same node-local field as the node's completion status
-and accepts only `done`/`opened`/`skipped`, so an agent emit named `status` carrying any
+and accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES` — the
+canonical `done`/`opened`/`skipped` plus the issue-#932 affirmative-completion aliases
+`completed`/`succeeded`/`success`), so an agent emit named `status` carrying any
 other routing value (`approved`, …) always escalates, and `status="done"` can never take an
 `approved` branch — the emit contract and the gate conflict. `status` is therefore reserved
 for an **`agent`** (a connector has no producer status gate, so a connector `status` emit

package/app/deliveryGraph.test.ts

@@ -538,7 +538,7 @@ test("invalid-fact-name: an AGENT emit named `status` is reserved — the produc
   // Regression guard (PR #863 Copilot Medium "Previously missed", deliveryGraph.ts:418): the result-set
   // exemption was too broad for an agent emit named `status`. The producer status gate
   // (`agentContractProceedCondition`) interprets that same node-local field as the completion status and
-  // accepts only `done`/`opened`/`skipped`, while the emit contract may require a different routing
+  // accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES`), while the emit contract may require a different routing
   // value — `status="approved"` always escalates, and `status="done"` can never take an `approved`
   // branch. Unlike an aligned result fact such as `pr` (whose emit value and result field agree),
   // `status` is CONSTRAINED by the gate, so the two uses conflict. Reserve the agent completion-control

package/app/deliveryGraph.ts

@@ -458,7 +458,9 @@ export const DELIVERY_SCAFFOLDING_VARS = ["boundFacts", "nodeInputs", "nodeInput
  * correctly clears both. Reserving the whole set would forbid the flagship
  * `agent → connector[converge] → wait[pr]` pattern. The exception is the agent completion-control
  * `status`: the producer status gate reads that SAME node-local field as the node's completion status
- * and accepts only `done`/`opened`/`skipped`, so an agent emit named `status` whose routing value is
+ * and accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES` — the canonical
+ * `done`/`opened`/`skipped` plus the #932 affirmative-completion aliases), so an agent emit named
+ * `status` whose routing value is
  * anything else (`approved`, …) ALWAYS escalates, and `status="done"` can never take an `approved`
  * branch — the emit contract and the gate conflict. `status` is therefore reserved for an `agent`
  * (a connector has no producer status gate, so its `status` emit collides with nothing and stays

package/app/deliveryGraphCompiler.test.ts

@@ -15,7 +15,7 @@ import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { DeliveryGraph } from "../nano-generated/api-io.d.ts";
 import { missingExternalMarkerAgentTaskTypes } from "./agentic/vocab/job-types.ts";
-import { compileDeliveryGraph, digestInvisibleRawValues, graphCarriesRedactedSecrets, nodeDisplay, redactFreeText, resumeValidVar } from "./deliveryGraphCompiler.ts";
+import { AGENT_TERMINAL_SUCCESS_STATUSES, compileDeliveryGraph, digestInvisibleRawValues, graphCarriesRedactedSecrets, nodeDisplay, redactFreeText, resumeValidVar } from "./deliveryGraphCompiler.ts";
 import { isDeliveryEscalationTwin } from "./deliveryHuman.ts";
 
 /** Compile and assert success, returning the narrowed ok-result. */
@@ -2131,7 +2131,11 @@ test("#731 producer status gate: an agent node inserts a post-completion contrac
   assert(g0, "the contract-met success flow exists");
   assert(g0![1].includes(`=${el}_contractMet = true`), "the success flow reads the node-unique contract decision");
   const cond = contractMetExpr(r.bpmn, el);
-  assert(cond.includes('list contains(["done", "opened", "skipped"], status)'), "the success flow gates on the terminal-success status allowlist");
+  // The gate's FEEL allowlist is DERIVED from the single source of truth (AGENT_TERMINAL_SUCCESS_STATUSES)
+  // — assert against the derived rendering, not a hand-copied literal, so this test can never drift from
+  // the vocabulary it guards (issue #932).
+  const derivedList = `[${AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `"${s}"`).join(", ")}]`;
+  assert(cond.includes(`list contains(${derivedList}, status)`), `the success flow gates on the derived terminal-success status allowlist, got: ${cond}`);
   assert(cond.includes("not(is defined(status)) or status = null"), "an absent/null status is not itself the failure mode — it still proceeds");
   // The contract escalation's read-only context names the node and its reported status (#731).
   const esc = escBlockForNodeSuffix(r.bpmn, "open", "contract");
@@ -2139,6 +2143,49 @@ test("#731 producer status gate: an agent node inserts a post-completion contrac
   assert(esc.includes("Reported status="), "the context surfaces the actual reported status");
 });
 
+test("#932 producer status gate: the affirmative-completion synonyms agents actually report are allowlisted terminal-success statuses, derived from one source", () => {
+  // Issue #932: agents keep self-reporting `status: "completed"` (and other unambiguous success
+  // synonyms) after FULLY delivering — every required emit present — yet the #731 gate accepted only
+  // `done`/`opened`/`skipped`, so a fully-delivered node parked on a human "Continue" escalation as a
+  // contract violation (nano-bpm#1337 → PR #1464 escalation 584376; nano-bpm#1463 → PR #1476
+  // escalation 599960). The fix is the CLASS fix: the affirmative-completion aliases are
+  // terminal-success statuses in the ONE canonical vocabulary (AGENT_TERMINAL_SUCCESS_STATUSES), which
+  // the gate's FEEL AND the #760 prompt contract both derive from. Pin the vocabulary content so a
+  // future "tidy-up" cannot silently re-narrow it (a removed synonym re-introduces the escalation).
+  for (const synonym of ["completed", "success", "succeeded"]) {
+    assert(
+      AGENT_TERMINAL_SUCCESS_STATUSES.includes(synonym),
+      `"${synonym}" — an unambiguous affirmative-completion alias agents report — must be a terminal-success status (issue #932)`,
+    );
+  }
+  // The canonical statuses stay.
+  for (const canonical of ["done", "opened", "skipped"]) {
+    assert(AGENT_TERMINAL_SUCCESS_STATUSES.includes(canonical), `the canonical "${canonical}" status stays allowlisted`);
+  }
+  // And the vocabulary remains CLOSED to ambiguous non-success reports: a failure/give-up/in-progress
+  // self-report must NEVER be normalised to success (the gate stays fail-closed for those).
+  for (const nonSuccess of ["in_progress", "blocked", "failed", "escalated", "needs_input"]) {
+    assert(
+      !AGENT_TERMINAL_SUCCESS_STATUSES.includes(nonSuccess),
+      `"${nonSuccess}" is not a success claim — it must stay OFF the terminal-success allowlist`,
+    );
+  }
+});
+
+test("#932 producer status gate: the compiled contract gate accepts a `completed` report (the observed failure) as terminal-success", async () => {
+  // The compile-level half of the #932 regression guard: the gate's FEEL allowlist (derived from
+  // AGENT_TERMINAL_SUCCESS_STATUSES) must literally contain `completed`, so a fully-delivered node
+  // reporting it passes the producer gate instead of escalating (the e2e half, in
+  // e2e/delivery-graph.e2e.ts, proves the routing end-to-end).
+  const r = await compileOk(PRODUCER_GATE);
+  const el = elementForNode(r.bpmn, "open");
+  const cond = contractMetExpr(r.bpmn, el);
+  assert(cond.includes('"completed"'), `the gate's status allowlist contains "completed", got: ${cond}`);
+  // The escalation context line names the SAME derived vocabulary (never a stale hand-typed list).
+  const esc = escBlockForNodeSuffix(r.bpmn, "open", "contract");
+  assert(esc.includes("completed"), "the escalation context names the widened vocabulary");
+});
+
 test("#731 required-emit gate: a producer's declared emit consumed as a required data dependency adds a non-null gate clause and a resumable escalation NAMING the fact", async () => {
   const r = await compileOk(PRODUCER_GATE);
   const el = elementForNode(r.bpmn, "open");

package/app/deliveryGraphCompiler.ts

@@ -254,11 +254,22 @@ export function resumeValidVar(esc: string): string {
  * and escalates AT the node instead of threading an incomplete result into a downstream consumer. An
  * ABSENT/null status passes the gate (a status-less completion — an older fleet worker or a bare test
  * stub — is not itself the failure mode; the required-emit gate still catches a missing data fact).
+ *
+ * The list deliberately includes the unambiguous AFFIRMATIVE-COMPLETION aliases agents actually report
+ * — `completed`/`success`/`succeeded` (issue #932: agents kept reporting `status: "completed"` after
+ * FULLY delivering — every required emit present — and the narrow list parked that good work on a
+ * human "Continue" escalation as a contract violation; nano-bpm#1337 → PR #1464 escalation 584376,
+ * nano-bpm#1463 → PR #1476 escalation 599960). An affirmative alias is normalised to terminal-success
+ * AT THE GATE: it routes onward exactly like `done` — the required-emit clauses still gate it, so a
+ * `completed` WITHOUT its required emits still escalates. Only UNAMBIGUOUS success claims belong here:
+ * a failure / input-required / in-progress report (`failed`, `needs_input`, `in_progress`, …) is NOT a
+ * completion claim and must NEVER be added — the gate stays fail-closed for those.
+ *
  * Sorted for the compiler's byte-identical-output determinism. Exported as the SINGLE SOURCE OF TRUTH:
  * the compiler's contract gate reads it here, and the runner's `renderProducerContract` (#760) derives
  * the agent-facing status vocabulary from the SAME list — changing it changes both the gate and the
  * prompt at once, so the two representations of the producer contract can never drift. */
-export const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["done", "opened", "skipped"];
+export const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["completed", "done", "opened", "skipped", "succeeded", "success"];
 
 /** A never-reached exhaustiveness guard: `compileNode`'s `switch` covers every allowlisted kind, so
  * the closed union narrows to `never` here. If a future kind is added to the vocabulary without a

package/app/deliveryRunner.test.ts

@@ -279,6 +279,25 @@ test("producer contract semantics coverage (#761 follow-up): renderProducerContr
 });
 
 
+test("#932 producer contract prompt: the affirmative-completion synonyms agents actually report are listed AND documented, so the prompt and the gate accept the same vocabulary", () => {
+  // Issue #932: agents kept reporting `status: "completed"` (and synonyms) after fully delivering and
+  // were parked on a human escalation, because the #731 gate accepted only `done`/`opened`/`skipped`
+  // and the #760 prompt told agents the same narrow list. The class fix puts the synonyms in the ONE
+  // canonical vocabulary (AGENT_TERMINAL_SUCCESS_STATUSES); the prompt contract is DERIVED from it, so
+  // the agent is now TOLD these are valid — pin that the observed aliases surface with semantics.
+  const rendered = renderProducerContract([]);
+  for (const synonym of ["completed", "success", "succeeded"]) {
+    assert(
+      rendered.includes(`- \`${synonym}\` — `),
+      `the prompt documents the "${synonym}" alias with its semantics (issue #932), got: ${rendered}`,
+    );
+  }
+  // The "do not invent a status" warning must name the widened list too (derived, never hand-typed).
+  const list = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `\`${s}\``).join(", ");
+  assert(rendered.includes(`Any \`status\` OUTSIDE ${list}`), `the fail-closed warning names the derived allowlist, got: ${rendered}`);
+});
+
+
 test("agent node idempotency preflight (#551): every agent prompt leads with adopt-and-report guidance; non-agent nodes are untouched", async () => {
   // #551: a delivery agent node dispatches a raw retry-carrying `senior:feature` job with no
   // PR-existence guard, so a re-dispatch opened a DUPLICATE PR (instance 43077 n0 → #979/#980). The
@@ -754,3 +773,15 @@ test("the canonical `agent → converge-merge → wait[pr merged]` graph DISPATC
   assert(r.ok, `expected the canonical fact-bound wait[pr] graph to launch, got ${JSON.stringify(r)}`);
   assertEquals(r.handle.processInstanceKey, "555");
 });
+test("PR #934 producer contract prompt: no accepted status is ever cited as a forbidden example", () => {
+  // Class: the rejection sentence named `success` as invalid after it became an accepted alias, so every
+  // agent got contradictory instructions. Every accepted status must be absent from that sentence.
+  const rendered = renderProducerContract([]);
+  const rejectLine = rendered.split("\n").find((l) => l.includes("including a free-form"));
+  assert(rejectLine !== undefined, `the fail-closed warning carries rejection examples, got: ${rendered}`);
+  const examples = rejectLine.split("including a free-form")[1] ?? "";
+  for (const s of AGENT_TERMINAL_SUCCESS_STATUSES) {
+    assert(!examples.includes(`\`${s}\``), `accepted status "${s}" must not be cited as a rejected example: ${rejectLine}`);
+  }
+  assert(examples.includes("`in_progress`"), `a genuine out-of-vocabulary example remains: ${rejectLine}`);
+});

package/app/deliveryRunner.ts

@@ -495,6 +495,13 @@ const PRODUCER_STATUS_SEMANTICS: Readonly<Record<string, string>> = {
   opened: "you opened OR adopted a PR (return it in your `pr` emit if this node declares one)",
   done: "the work completed with no PR to open",
   skipped: "there was genuinely nothing to do",
+  // Issue #932: the unambiguous AFFIRMATIVE-COMPLETION aliases agents actually self-report. They are
+  // full terminal-success statuses (normalised at the gate), documented here so the prompt and the
+  // gate accept the SAME vocabulary — an agent told only `done`/`opened`/`skipped` keeps inventing
+  // `completed` and parking good work on a human escalation.
+  completed: "an alias of `done`/`opened` — the work fully completed (with its required emits populated)",
+  succeeded: "an alias of `done`/`opened` — the work fully succeeded (with its required emits populated)",
+  success: "an alias of `done`/`opened` — the work fully succeeded (with its required emits populated)",
 };
 
 /** Render the producer-completion contract auto-injected into EVERY `agent` node's `appendPrompt`
@@ -518,6 +525,11 @@ const PRODUCER_STATUS_SEMANTICS: Readonly<Record<string, string>> = {
  * contract already tells the agent to omit an undecidable routing fact. Listing every DECLARED emit
  * here instead would contradict that guidance and push agents to guess values that should stay
  * optional (#761). */
+/** Illustrative out-of-vocabulary statuses named in the producer contract's rejection sentence. Always
+ * filtered against `AGENT_TERMINAL_SUCCESS_STATUSES` at render time, so an example that later becomes an
+ * accepted alias silently drops out instead of contradicting the accepted list. */
+const PRODUCER_REJECTED_STATUS_EXAMPLES: readonly string[] = ["in_progress", "failed", "partial", "success"];
+
 export function renderProducerContract(requiredEmits: readonly DeliveryFact[]): string {
   const list = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `\`${s}\``).join(", ");
   const semantics = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => {
@@ -530,6 +542,11 @@ export function renderProducerContract(requiredEmits: readonly DeliveryFact[]):
     }
     return `- \`${s}\` — ${doc}.`;
   });
+  // Rejection examples are FILTERED against the allowlist so the prompt can never present one status as
+  // both accepted and forbidden (PR #934 review: `success` became an alias but stayed an example).
+  const rejected = PRODUCER_REJECTED_STATUS_EXAMPLES.filter((s) => !AGENT_TERMINAL_SUCCESS_STATUSES.includes(s))
+    .map((s) => `\`${s}\``)
+    .join("/");
   const lines = [
     "",
     "",
@@ -543,7 +560,7 @@ export function renderProducerContract(requiredEmits: readonly DeliveryFact[]):
     "",
     ...semantics,
     "",
-    `Any \`status\` OUTSIDE ${list} — including a free-form \`success\`/\`in_progress\`/\`failed\` — parks the`,
+    `Any \`status\` OUTSIDE ${list} — including a free-form ${rejected} — parks the`,
     "run on a human escalation (the gate is fail-closed), EVEN when your underlying work was correct. So",
     "do not invent a status: report exactly one of the allowlisted values above.",
   ];

package/app/mergeBlockedThreads.test.ts

@@ -17,6 +17,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { assert, assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -73,6 +74,8 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
     table: (n: string, pk?: string) => tbl(n, pk),
     open: () => ({
       exec: async (sql: string, params: any[] = []) => {
+        const cas = memStatusCas(stores, sql, params);
+        if (cas) return cas;
         const m = sql.match(/^\s*DELETE\s+FROM\s+"?(\w+)"?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s*$/i);
         if (!m) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
         const rows = (stores[m[1]] ??= [] as any[]);

package/app/mergeLoopBehaviour.test.ts

@@ -52,6 +52,7 @@ const ALL_JOB_TYPES = [
   "pr.arm-merge",
   "pr.merge",
   "pr.merge-stall-probe",
+  "pr.landed-probe",
   "pr.mark-merged",
   "senior:fix-ci",
   "senior:rebase",
@@ -66,6 +67,7 @@ const DEFAULT_RESPONSES: Record<string, Responder> = {
   "pr.record-dependency": {},
   "pr.answer-escalation": {},
   "pr.persist-escalation": { escalated: true },
+  "pr.landed-probe": { landedVerdict: "waiting" },
 };
 
 // Every FEEL expression in the model references these; start them defined (null,
@@ -239,6 +241,30 @@ test("a queued merge that never lands escalates when the landing timeout fires (
   assertStringIncludes(String(escalation(engine).question ?? ""), "did not land within the merge-queue landing timeout", "the escalation must name the landing-timeout trigger");
 });
 
+test("a landing timeout firing on a PR that already MERGED completes merged with no escalation (#933)", async () => {
+  // The queue landed the PR, but the timer won the `eg-landed` race before the poller published
+  // `merge-landed`. The timeout arm must re-read ground truth and finalize — never escalate a landed PR.
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "landed" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompleted().hasNoIncident().hasCompletedElements("landed-probe", "mark-merged");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "a landed PR must never be escalated");
+});
+
+test("a landing timeout on a PR evicted from the queue re-arms the merge poller (#933)", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "queued" }, "pr.landed-probe": { landedVerdict: "evicted" } },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await engine.advanceTime(LANDED_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  assert(!completedElementIds(engine).has("merge-esc-landed"), "an evicted PR re-arms rather than escalating");
+});
+
 test("answering the landing-timeout escalation re-arms the merge poller (#556)", async () => {
   const engine = await boot({ responses: { "pr.merge": { mergeStatus: "queued" } } });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });

package/app/mergeOutOfBandTerminal.test.ts

@@ -13,6 +13,7 @@
 // message THAT wait correlates to; this test asserts the class over every (status × merged/closed).
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { pollMerges } from "./service.ts";
 
@@ -45,7 +46,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 
@@ -176,3 +186,49 @@ test("still-open waiting_deps PR with an unmerged dep publishes nothing and stay
   assertEquals(messages.length, 0);
   assertEquals(stores["pull_requests"][0].status, "waiting_deps");
 });
+
+// PR #935 review: a poll pass reads `queued`, then stalls on GitHub while the process's own landing
+// timeout path completes `mark-merged` (status → `merged`). When the delayed pass resumes, its flip
+// must NOT clobber the terminal `merged` with `merging` (no pass scans `merging`, so it would stick)
+// nor publish a `merge-landed` whose subscription is gone. The flip is a compare-and-set on the
+// status the pass read; a lost race skips the publish entirely.
+// Asserted on `waiting_deps` (the flip is the one shared helper every merge-stage wait uses).
+test("a delayed merge-stage poll never overwrites a concurrently-written terminal status", async () => {
+  const { data, stores } = memData();
+  const { engine, messages } = recordingEngine();
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  const inner = githubFetch(new Map<number, Live>([[100, "merged"]]));
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevFetch = globalThis.fetch;
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token";
+  // While the poll awaits GitHub, the timeout path's `mark-merged` lands the terminal status.
+  globalThis.fetch = ((url: string | URL | Request, init?: RequestInit) => {
+    // Replace (not mutate) the row: a real DB read hands the pass a snapshot, not a live reference.
+    stores["pull_requests"][0] = { ...stores["pull_requests"][0], status: "merged" };
+    return inner(url, init);
+  }) as typeof fetch;
+  try {
+    await pollMerges(data, engine, "tok");
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevMode === undefined) delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    else process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+  }
+  assertEquals(messages.length, 0, "a lost race must not publish to a vanished subscription");
+  assertEquals(stores["pull_requests"][0].status, "merged");
+});
+
+// The publish-failure revert is conditional too: it only undoes its OWN `merging`.
+test("a failed publish reverts merging back to the read status", async () => {
+  const { data, stores } = memData();
+  const engine = {
+    async publishMessage() {
+      throw new Error("boom");
+    },
+  } as any as EngineClient;
+  stores["pull_requests"] = [prRow("o/r#100", 100, "waiting_deps")];
+  stores["pr_dependencies"] = [{ pr_key: "o/r#100", depends_on_key: "o/r#200", created_at: "t" }];
+  await withGithub(new Map<number, Live>([[100, "merged"]]), () => pollMerges(data, engine, "tok").catch(() => {}));
+  assertEquals(stores["pull_requests"][0].status, "waiting_deps");
+});

package/app/mergeQueueEviction.test.ts

@@ -10,6 +10,7 @@
 // token-transport GitHub stub that serves BOTH the REST PR view and the GraphQL merge-queue probe.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { memStatusCas } from "../test/memStatusCas.ts";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { fetchMergeQueueMembership } from "./github.ts";
 import { pollMerges } from "./service.ts";
@@ -42,7 +43,16 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = {
+    table: (n: string, pk?: string) => tbl(n, pk),
+    open: () => ({
+      exec: async (sql: string, params: any[] = []) => {
+        const res = memStatusCas(stores, sql, params);
+        if (!res) throw new Error(`memData.open().exec: unsupported statement: ${sql}`);
+        return res;
+      },
+    }),
+  } as any as DataLayer;
   return { data, stores };
 }
 

package/app/service.ts

@@ -1572,24 +1572,44 @@ async function classifyWaveTarget(
  * otherwise wedge the PR there forever — the next pass would never pick it back up. Reverting on
  * failure keeps the PR on a pollable status so the next pass retries. Single source of truth for
  * the flip-then-publish handoff shared by all merge-stage waits below. */
-async function flipToMergingThenPublish(
+export async function flipToMergingThenPublish(
   data: DataLayer,
   engine: EngineClient,
   prKey: string,
   prevStatus: string,
   message: Parameters<EngineClient["publishMessage"]>[0],
-) {
-  await prs(data).update(prKey, { status: "merging", updated_at: now() });
+): Promise<boolean> {
+  // Compare-and-set (#935 review): the flip only wins if the row is STILL on the status this pass
+  // read. A pass that read `queued`, then stalled on GitHub while the process's own timeout path
+  // completed `mark-merged`, must not clobber the terminal `merged` with `merging` (no pass scans
+  // `merging`, and the completed loop has no worker left to restore it) nor publish a message whose
+  // subscription is gone. A lost race skips the publish entirely.
+  const db = data.open();
+  const flipped = await db.exec(
+    "UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?",
+    ["merging", now(), prKey, prevStatus],
+  );
+  if (flipped.changed === 0) {
+    console.log(`[poller] ${prKey} left ${prevStatus} concurrently — skipping ${message.name}`);
+    return false;
+  }
   try {
     await engine.publishMessage(message);
   } catch (err) {
     try {
-      await prs(data).update(prKey, { status: prevStatus, updated_at: now() });
+      // Conditional revert too: only undo OUR `merging`, never a status another actor wrote since.
+      await db.exec("UPDATE pull_requests SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?", [
+        prevStatus,
+        now(),
+        prKey,
+        "merging",
+      ]);
     } catch (revertErr) {
       console.error(`[poller] revert ${prKey} -> ${prevStatus} failed: ${revertErr}`);
     }
     throw err;
   }
+  return true;
 }
 
 export async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<PrLaneDecision | null> {

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.206.2",
-  "gitSha": "71984d5d607151b2c3690a12d6b05537b24c3ece",
-  "gitTag": "v0.206.2",
-  "builtAt": "2026-11-09T11:18:01.340Z"
+  "version": "0.206.4",
+  "gitSha": "b8c5e4e5cb59ce42bb2d6573e107d1865393fa27",
+  "gitTag": "v0.206.4",
+  "builtAt": "2026-11-09T21:50:28.782Z"
 }

package/docs/agent-guide.md

@@ -359,7 +359,10 @@ instruction to the agent's prompt automatically when the node declares `emits`.
 omits the fact, the `default` branch is taken.
 
 **Result statuses are added automatically. Don't write them into your prompt.** Every agent
-node's prompt gets the allowed terminal statuses (`done` / `opened` / `skipped`). A completion
+node's prompt gets the allowed terminal statuses (`done` / `opened` / `skipped`, plus the
+unambiguous affirmative-completion aliases `completed` / `succeeded` / `success` — issue #932:
+a fully-delivered node reporting one of those is a terminal success, never a contract
+violation). A completion
 moves on only with one of those statuses and every required emit present. Anything else parks
 the run on a human `__contract` escalation — **except** an absent/null `status`, which a legacy
 worker that populates its required emits may still advance with (the status contract binds only

package/e2e/delivery-graph.e2e.ts

@@ -373,6 +373,66 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
     assert.ok(takenFlows(app).some((f) => f.endsWith("->End")), "the satisfied producer's result reaches End");
   });
 
+  test("#932 producer contract: an agent reporting status=completed with all required emits routes onward and NEVER reaches a human escalation", async () => {
+    const app = track(await boot(freshDir()));
+
+    // Issue #932's observed failure (nano-bpm#1337 → PR #1464 escalation 584376; nano-bpm#1463 →
+    // PR #1476 escalation 599960): the agent FULLY delivered — required `pr` emit present, work done,
+    // PR later merged — but self-reported the affirmative-completion alias `status: "completed"`,
+    // which the #731 gate (accepting only `done`/`opened`/`skipped`) treated as a contract violation
+    // and parked on a human "Continue" escalation. With the synonym allowlisted in the ONE canonical
+    // vocabulary, the same result must sail through the gate: no __contract task, the downstream
+    // connector fires, the graph reaches End.
+    let agentFired = 0;
+    await app.engine.registerWorker("senior:demo", async () => {
+      agentFired++;
+      return { status: "completed", pr: "owner/repo#100", summary: "Fully delivered; PR opened and green." };
+    });
+    let connectorFired = 0;
+    await app.engine.registerWorker(
+      "pr.delivery-connector",
+      async (job) => {
+        connectorFired++;
+        const vars = job.variables as Record<string, unknown>;
+        const { target, payload, boundFacts } = readConnectorInput(vars as Parameters<typeof readConnectorInput>[0]);
+        const dedupeKey = connectorDedupeKey({
+          dedupeKey: (vars.dedupeKey as string | null | undefined) ?? null,
+          processInstanceKey: job.processInstanceKey ?? null,
+          elementId: job.elementId ?? null,
+        });
+        if (!dedupeKey) throw new Error("connector stub: no dedupe key (author-supplied or graph-derived) available");
+        return await dispatchConnector(app.db, { dedupeKey, target, payload, boundFacts }, new Date().toISOString());
+      },
+      { fetchVariables: ["boundFacts", "target", "dedupeKey", "payload"] },
+    );
+
+    const graph: DeliveryGraph = {
+      name: "e2e producer gate completed synonym",
+      nodes: [
+        { id: "open", kind: "agent", agent: { jobType: "senior:demo" }, emits: [{ name: "pr", type: "pr" }] },
+        { id: "land", kind: "connector", connector: { target: "slack", payload: { pr: "open.pr" }, dedupeKey: "land-932" } },
+      ],
+      edges: [{ from: "open.pr", to: "land" }],
+    };
+
+    const run = await runDeliveryGraph(app.engine, graph, { escalationSlaTimeout: "PT1H", repoless: true });
+    assert.ok(run.ok, `graph should deploy + run, got ${JSON.stringify(run)}`);
+    await app.settle();
+
+    // The `completed` report + all required emits is a terminal success: it routes ONWARD — no
+    // producer-contract escalation (and no escalation of any kind), the connector fired once on the
+    // real PR, and the graph reached End. A human is never in the loop.
+    assert.equal(agentFired, 1, "the agent node's job fired and completed");
+    const createdTasks = await app.engine.searchUserTasks({ state: "CREATED" });
+    assert.deepEqual(
+      createdTasks.map((t) => t.elementId),
+      [],
+      `a fully-delivered "completed" result must NEVER park a human task, got ${JSON.stringify(createdTasks.map((t) => t.elementId))}`,
+    );
+    assert.equal(connectorFired, 1, "the satisfied producer threads its result to the downstream connector");
+    assert.ok(takenFlows(app).some((f) => f.endsWith("->End")), "the completed producer's result reaches End");
+  });
+
   test("resume never double-fires: an at-least-once redelivery of the connector dedupes", async () => {
     const app = track(await boot(freshDir()));
     // The connector fired once above's-style; here prove the idempotency directly against the ledger a

package/nano.app.json

@@ -148,6 +148,10 @@
       "taskType": "pr.mark-merged",
       "handler": "workers/mark-merged/worker.ts"
     },
+    {
+      "taskType": "pr.landed-probe",
+      "handler": "workers/landed-probe/worker.ts"
+    },
     {
       "taskType": "pr.merge-stall-probe",
       "handler": "workers/merge-stall-probe/worker.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.206.2",
+  "version": "0.206.4",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/merge-loop.bpmn

@@ -56,6 +56,14 @@
           <nano:extend name="reviewThreads" type="integer" optional="true" />
           <nano:extend name="pendingChecks" type="integer" optional="true" />
         </nano:shape>
+        <nano:shape id="LandedProbeIn" name="Landed probe — input">
+          <nano:extend name="prKey" type="string" />
+          <nano:extend name="repo" type="string" />
+          <nano:extend name="prNumber" type="integer" />
+        </nano:shape>
+        <nano:shape id="LandedProbeOut" name="Landed probe — result">
+          <nano:extend name="landedVerdict" type="string" />
+        </nano:shape>
         <nano:shape id="MergeReady" name="merge-ready message payload">
           <nano:extend name="mergeState" type="string" />
           <nano:extend name="failingChecks" type="integer" optional="true" />
@@ -125,6 +133,7 @@
       <bpmn:incoming>f_ci_rearm</bpmn:incoming>
       <bpmn:incoming>f_reb_rearm</bpmn:incoming>
       <bpmn:incoming>f_m_evicted</bpmn:incoming>
+      <bpmn:incoming>f_lp_evicted</bpmn:incoming>
       <bpmn:incoming>f_m_escReenter</bpmn:incoming>
       <bpmn:incoming>f_mr_go</bpmn:incoming>
       <bpmn:outgoing>f_m_arm</bpmn:outgoing>
@@ -234,11 +243,28 @@
     </bpmn:intermediateCatchEvent>
     <bpmn:intermediateCatchEvent id="wait-landed-timeout" name="Wait: merge-queue landing timeout">
       <bpmn:incoming>f_eg_landedTimeout</bpmn:incoming>
-      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedProbe</bpmn:outgoing>
       <bpmn:timerEventDefinition id="ted_landedTimeout">
         <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=landedWaitTimeout</bpmn:timeDuration>
       </bpmn:timerEventDefinition>
     </bpmn:intermediateCatchEvent>
+    <bpmn:serviceTask id="landed-probe" name="Probe: did the queued PR land?">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.landed-probe" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="LandedProbeIn" />
+          <zeebe:property name="io.nanobpm.dataEnvelope.out" value="LandedProbeOut" />
+        </zeebe:properties>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_m_landedProbe</bpmn:incoming>
+      <bpmn:outgoing>f_lp_gate</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:exclusiveGateway id="gw-landed-probe" name="landed?" default="f_m_landedStalled">
+      <bpmn:incoming>f_lp_gate</bpmn:incoming>
+      <bpmn:outgoing>f_lp_landed</bpmn:outgoing>
+      <bpmn:outgoing>f_lp_evicted</bpmn:outgoing>
+      <bpmn:outgoing>f_m_landedStalled</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
     <bpmn:serviceTask id="mark-merged" name="Mark merged">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="pr.mark-merged" />
@@ -248,6 +274,7 @@
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_gMerged</bpmn:incoming>
       <bpmn:incoming>f_m_landed</bpmn:incoming>
+      <bpmn:incoming>f_lp_landed</bpmn:incoming>
       <bpmn:outgoing>f_m_done</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:endEvent id="MergeEnd" name="Merged">
@@ -792,7 +819,15 @@
     <bpmn:sequenceFlow id="f_eg_landed" sourceRef="eg-landed" targetRef="wait-landed" />
     <bpmn:sequenceFlow id="f_eg_evicted" sourceRef="eg-landed" targetRef="wait-evicted" />
     <bpmn:sequenceFlow id="f_eg_landedTimeout" sourceRef="eg-landed" targetRef="wait-landed-timeout" />
-    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="wait-landed-timeout" targetRef="merge-esc-landed" />
+    <bpmn:sequenceFlow id="f_m_landedProbe" sourceRef="wait-landed-timeout" targetRef="landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_gate" sourceRef="landed-probe" targetRef="gw-landed-probe" />
+    <bpmn:sequenceFlow id="f_lp_landed" sourceRef="gw-landed-probe" targetRef="mark-merged">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "landed"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_lp_evicted" sourceRef="gw-landed-probe" targetRef="arm-merge">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=landedVerdict = "evicted"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_m_landedStalled" sourceRef="gw-landed-probe" targetRef="merge-esc-landed" />
     <bpmn:sequenceFlow id="f_m_escLanded" sourceRef="merge-esc-landed" targetRef="gw-merge-escalated" />
     <bpmn:sequenceFlow id="f_m_evicted" sourceRef="wait-evicted" targetRef="arm-merge" />
     <bpmn:sequenceFlow id="f_m_gBlocked" name="blocked" sourceRef="gw-merge" targetRef="merge-esc-attempt" />
@@ -879,7 +914,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-merge" bpmnElement="gw-merge" isMarkerVisible="true">
         <dc:Bounds x="1363" y="255" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1362" y="350" width="53" height="28" />
+          <dc:Bounds x="1302" y="290" width="53" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-retry" bpmnElement="gw-merge-retry" isMarkerVisible="true">
@@ -909,16 +944,25 @@
       <bpmndi:BPMNShape id="BPMNShape_wait-landed-timeout" bpmnElement="wait-landed-timeout">
         <dc:Bounds x="1720" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1596" y="143" width="84" height="56" />
+          <dc:Bounds x="1716" y="143" width="84" height="56" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_landed-probe" bpmnElement="landed-probe">
+        <dc:Bounds x="1888" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-landed-probe" bpmnElement="gw-landed-probe" isMarkerVisible="true">
+        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="2087" y="76" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_mark-merged" bpmnElement="mark-merged">
-        <dc:Bounds x="1888" y="240" width="100" height="80" />
+        <dc:Bounds x="2238" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeEnd" bpmnElement="MergeEnd">
-        <dc:Bounds x="2095" y="262" width="36" height="36" />
+        <dc:Bounds x="2445" y="262" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2088" y="303" width="50" height="14" />
+          <dc:Bounds x="2438" y="303" width="50" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_MergeAbandoned" bpmnElement="MergeAbandoned">
@@ -937,19 +981,19 @@
         <dc:Bounds x="1138" y="1680" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-merge-escalated" bpmnElement="gw-merge-escalated" isMarkerVisible="true">
-        <dc:Bounds x="2088" y="95" width="50" height="50" />
+        <dc:Bounds x="2438" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2056" y="170" width="74" height="28" />
+          <dc:Bounds x="2406" y="150" width="74" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_merge-esc-landed" bpmnElement="merge-esc-landed">
-        <dc:Bounds x="1888" y="80" width="100" height="80" />
+        <dc:Bounds x="2238" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_wait-merge-answer" bpmnElement="wait-merge-answer">
-        <dc:Bounds x="2238" y="80" width="100" height="80" />
+        <dc:Bounds x="2588" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-merge-answer" bpmnElement="record-merge-answer">
-        <dc:Bounds x="2438" y="80" width="100" height="80" />
+        <dc:Bounds x="2788" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-ci-fix" bpmnElement="gw-ci-fix" isMarkerVisible="true">
         <dc:Bounds x="1163" y="1055" width="50" height="50" />
@@ -1021,14 +1065,14 @@
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gMerged" bpmnElement="f_m_gMerged">
         <di:waypoint x="1413" y="280" />
-        <di:waypoint x="1888" y="280" />
+        <di:waypoint x="2238" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1721" y="258" width="49" height="14" />
+          <dc:Bounds x="1866" y="258" width="49" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_done" bpmnElement="f_m_done">
-        <di:waypoint x="1988" y="280" />
-        <di:waypoint x="2095" y="280" />
+        <di:waypoint x="2338" y="280" />
+        <di:waypoint x="2445" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_rearm" bpmnElement="f_ci_rearm">
         <di:waypoint x="1563" y="1265" />
@@ -1075,54 +1119,62 @@
         <di:waypoint x="1463" y="1060" />
         <di:waypoint x="1688" y="1060" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1391" y="749" width="67" height="28" />
+          <dc:Bounds x="1468" y="829" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_mr_giveup" bpmnElement="f_mr_giveup">
         <di:waypoint x="1588" y="760" />
         <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1605" y="765" width="67" height="28" />
+          <dc:Bounds x="1595" y="765" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_landed" bpmnElement="f_eg_landed">
         <di:waypoint x="1588" y="440" />
         <di:waypoint x="1720" y="440" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2238" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+        <di:waypoint x="2338" y="120" />
+        <di:waypoint x="2438" y="120" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_landed" bpmnElement="f_m_landed">
         <di:waypoint x="1756" y="440" />
-        <di:waypoint x="1938" y="440" />
-        <di:waypoint x="1938" y="320" />
+        <di:waypoint x="2288" y="440" />
+        <di:waypoint x="2288" y="320" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escC" bpmnElement="f_m_escC">
         <di:waypoint x="1788" y="1080" />
-        <di:waypoint x="2288" y="1080" />
-        <di:waypoint x="2288" y="160" />
+        <di:waypoint x="2638" y="1080" />
+        <di:waypoint x="2638" y="160" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escA" bpmnElement="f_m_escA">
         <di:waypoint x="1788" y="760" />
-        <di:waypoint x="2151" y="760" />
-        <di:waypoint x="2151" y="145" />
-        <di:waypoint x="2158" y="145" />
-        <di:waypoint x="2158" y="120" />
-        <di:waypoint x="2138" y="120" />
+        <di:waypoint x="2501" y="760" />
+        <di:waypoint x="2501" y="145" />
+        <di:waypoint x="2508" y="145" />
+        <di:waypoint x="2508" y="120" />
+        <di:waypoint x="2488" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escReenter" bpmnElement="f_m_escReenter">
-        <di:waypoint x="2113" y="95" />
-        <di:waypoint x="2113" y="60" />
+        <di:waypoint x="2463" y="95" />
+        <di:waypoint x="2463" y="60" />
         <di:waypoint x="402" y="60" />
         <di:waypoint x="402" y="240" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1221" y="13" width="74" height="42" />
+          <dc:Bounds x="1396" y="13" width="74" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answerRecord" bpmnElement="f_m_answerRecord">
-        <di:waypoint x="2338" y="120" />
-        <di:waypoint x="2438" y="120" />
+        <di:waypoint x="2688" y="120" />
+        <di:waypoint x="2788" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_answer" bpmnElement="f_m_answer">
-        <di:waypoint x="2488" y="160" />
-        <di:waypoint x="2488" y="340" />
+        <di:waypoint x="2838" y="160" />
+        <di:waypoint x="2838" y="340" />
         <di:waypoint x="402" y="340" />
         <di:waypoint x="402" y="320" />
       </bpmndi:BPMNEdge>
@@ -1241,15 +1293,15 @@
         <di:waypoint x="1213" y="440" />
         <di:waypoint x="1233" y="440" />
         <di:waypoint x="1233" y="465" />
-        <di:waypoint x="2158" y="465" />
-        <di:waypoint x="2158" y="75" />
-        <di:waypoint x="2558" y="75" />
-        <di:waypoint x="2558" y="1125" />
+        <di:waypoint x="2508" y="465" />
+        <di:waypoint x="2508" y="75" />
+        <di:waypoint x="2908" y="75" />
+        <di:waypoint x="2908" y="1125" />
         <di:waypoint x="1318" y="1125" />
         <di:waypoint x="1318" y="1380" />
         <di:waypoint x="1338" y="1380" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2334" y="42" width="49" height="28" />
+          <dc:Bounds x="2684" y="42" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gQueued" bpmnElement="f_m_gQueued">
@@ -1263,13 +1315,13 @@
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gRetry" bpmnElement="f_m_gRetry">
         <di:waypoint x="1388" y="255" />
         <di:waypoint x="1388" y="235" />
-        <di:waypoint x="2218" y="235" />
-        <di:waypoint x="2218" y="805" />
+        <di:waypoint x="2568" y="235" />
+        <di:waypoint x="2568" y="805" />
         <di:waypoint x="1538" y="805" />
         <di:waypoint x="1563" y="805" />
         <di:waypoint x="1563" y="785" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1852" y="772" width="78" height="28" />
+          <dc:Bounds x="2485" y="766" width="78" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_eg_evicted" bpmnElement="f_eg_evicted">
@@ -1286,30 +1338,26 @@
         <di:waypoint x="1700" y="120" />
         <di:waypoint x="1720" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_landed" bpmnElement="f_lp_landed">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="280" />
+        <di:waypoint x="2238" y="280" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gBlocked" bpmnElement="f_m_gBlocked">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="638" />
-        <di:waypoint x="1668" y="638" />
-        <di:waypoint x="1668" y="740" />
-        <di:waypoint x="1688" y="740" />
+        <di:waypoint x="1413" y="280" />
+        <di:waypoint x="1668" y="280" />
+        <di:waypoint x="1668" y="760" />
+        <di:waypoint x="1688" y="760" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1932" y="616" width="53" height="14" />
+          <dc:Bounds x="1610" y="412" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_gAbandoned" bpmnElement="f_m_gAbandoned">
-        <di:waypoint x="1388" y="255" />
-        <di:waypoint x="1388" y="82" />
-        <di:waypoint x="1776" y="82" />
-        <di:waypoint x="1776" y="165" />
-        <di:waypoint x="2218" y="165" />
-        <di:waypoint x="2218" y="920" />
-        <di:waypoint x="1581" y="920" />
+        <di:waypoint x="1388" y="305" />
+        <di:waypoint x="1388" y="920" />
+        <di:waypoint x="1545" y="920" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2131" y="849" width="82" height="28" />
+          <dc:Bounds x="1301" y="599" width="82" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_waitDep" bpmnElement="f_ci_waitDep">
@@ -1343,25 +1391,25 @@
         <di:waypoint x="1438" y="1400" />
         <di:waypoint x="1538" y="1400" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedStalled" bpmnElement="f_m_landedStalled">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_m_landedProbe" bpmnElement="f_m_landedProbe">
         <di:waypoint x="1756" y="120" />
         <di:waypoint x="1888" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_m_escLanded" bpmnElement="f_m_escLanded">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_gate" bpmnElement="f_lp_gate">
         <di:waypoint x="1988" y="120" />
         <di:waypoint x="2088" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escT" bpmnElement="f_m_escT">
         <di:waypoint x="1238" y="1720" />
-        <di:waypoint x="2008" y="1720" />
-        <di:waypoint x="2008" y="145" />
-        <di:waypoint x="2068" y="145" />
-        <di:waypoint x="2068" y="120" />
-        <di:waypoint x="2088" y="120" />
+        <di:waypoint x="2358" y="1720" />
+        <di:waypoint x="2358" y="145" />
+        <di:waypoint x="2418" y="145" />
+        <di:waypoint x="2418" y="120" />
+        <di:waypoint x="2438" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_escWait" bpmnElement="f_m_escWait">
-        <di:waypoint x="2138" y="120" />
-        <di:waypoint x="2238" y="120" />
+        <di:waypoint x="2488" y="120" />
+        <di:waypoint x="2588" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ci_recheck" bpmnElement="f_ci_recheck">
         <di:waypoint x="1563" y="1265" />
@@ -1396,6 +1444,12 @@
           <dc:Bounds x="946" y="772" width="49" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_lp_evicted" bpmnElement="f_lp_evicted">
+        <di:waypoint x="2113" y="145" />
+        <di:waypoint x="2113" y="340" />
+        <di:waypoint x="402" y="340" />
+        <di:waypoint x="402" y="320" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_m_evicted" bpmnElement="f_m_evicted">
         <di:waypoint x="1738" y="618" />
         <di:waypoint x="1738" y="638" />

package/test/memStatusCas.ts

@@ -0,0 +1,23 @@
+// Test-only: apply the poller's compare-and-set status flip (`flipToMergingThenPublish`, app/service.ts)
+// — `UPDATE <t> SET status = ?, updated_at = ? WHERE pr_key = ? AND status = ?` — against an
+// in-memory store, so hand-rolled `DataLayer` fakes model the real conditional write (and its
+// lost-race `changed: 0`) instead of no-op'ing it. Returns `null` for any other statement so the
+// caller can fall through to its own handling (or throw loudly).
+const CAS =
+  /^\s*UPDATE\s+"?(\w+)"?\s+SET\s+"?(\w+)"?\s*=\s*\?\s*,\s*"?(\w+)"?\s*=\s*\?\s+WHERE\s+"?(\w+)"?\s*=\s*\?\s+AND\s+"?(\w+)"?\s*=\s*\?\s*$/i;
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake over dynamic row shapes.
+export function memStatusCas(stores: Record<string, any[]>, sql: string, params: unknown[]): { changed: number } | null {
+  const m = sql.match(CAS);
+  if (!m) return null;
+  const [, table, setA, setB, keyCol, condCol] = m;
+  let changed = 0;
+  for (const r of (stores[table] ??= [])) {
+    if (r[keyCol] === params[2] && r[condCol] === params[3]) {
+      r[setA] = params[0];
+      r[setB] = params[1];
+      changed++;
+    }
+  }
+  return { changed };
+}

package/workers/landed-probe/worker.test.ts

@@ -0,0 +1,41 @@
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { PrState } from "../../app/github.ts";
+import { probeLanded } from "./worker.ts";
+
+const base: PrState = {
+  merged: false,
+  state: "open",
+  mergeStateStatus: "BLOCKED",
+  failingChecks: 0,
+  failingCheckNames: [],
+  totalChecks: 0,
+  presentCheckNames: [],
+  pendingCheckNames: [],
+  checkConclusions: {},
+  isDraft: false,
+  headRefOid: null,
+  mergeQueueEntry: null,
+  unresolvedThreads: -1,
+};
+const fake = (st: PrState | null, fail = false) => async () => {
+  if (fail) throw new Error("boom");
+  return st;
+};
+
+test("landed-probe: a MERGED PR reads landed (#933)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, merged: true, state: "merged" })), "landed");
+});
+test("landed-probe: still queued reads waiting", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(base)), "waiting");
+});
+test("landed-probe: dropped from the native queue reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, mergeQueueEntry: false })), "evicted");
+});
+test("landed-probe: closed unmerged reads evicted", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake({ ...base, state: "closed" })), "evicted");
+});
+test("landed-probe: unreadable state is conservative (waiting)", async () => {
+  assertEquals(await probeLanded("a/b", 1, "", fake(null)), "waiting");
+  assertEquals(await probeLanded("a/b", 1, "", fake(null, true)), "waiting");
+});

package/workers/landed-probe/worker.ts

@@ -0,0 +1,43 @@
+// pr.landed-probe — the merge-queue landing timer fired (issue #933). Before escalating "did not
+// land", re-read ground truth: the queue may have landed the PR after the poller's last `queued`
+// pass but before (or exactly as) the `landedWaitTimeout` timer won the `eg-landed` race — e.g. a
+// slow Mergify batch that merges right around the timeout, or a poller pass that errored/stalled
+// on this PR. Escalating a landed PR forces a pointless human "retry", so the timeout arm routes
+// through this probe and `gw-landed-probe` instead of straight to `merge-esc-landed`:
+//   • landed  → mark-merged (never escalate a landed PR)
+//   • evicted → arm-merge (re-run the mergeable gate, same as a `merge-evicted` message)
+//   • waiting → merge-esc-landed (genuinely never landed — the #556 backstop)
+// The verdict is derived by the poller's own canonical classifier (`queuedVerdict`) so the probe
+// and the poll pass can never drift. An unreadable PR reads as `waiting` (escalate — conservative).
+import type { AppJobHandler } from "@nanobpm/urban";
+import { fetchPrState } from "../../app/github.ts";
+import { queuedVerdict } from "../../app/service.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+type In = WorkerInputs["pr.landed-probe"];
+
+interface Out extends Record<string, unknown> {
+  landedVerdict: "landed" | "evicted" | "waiting";
+}
+
+export async function probeLanded(
+  repo: string,
+  prNumber: number | string,
+  token: string,
+  fetch: typeof fetchPrState = fetchPrState,
+): Promise<Out["landedVerdict"]> {
+  const st = await fetch(repo, prNumber, token, { withMergeQueue: true }).catch(() => null);
+  if (st === null) return "waiting";
+  // A PR closed WITHOUT merging can never land; re-arm so the merge poller abandons it.
+  if (!st.merged && st.state === "closed") return "evicted";
+  return queuedVerdict(st);
+}
+
+const handler: AppJobHandler<In, Out> = async (job, app) => {
+  const { repo, prNumber, prKey } = job.variables;
+  const landedVerdict = await probeLanded(repo, prNumber, process.env.GITHUB_TOKEN ?? "");
+  app.log.info("landed-probe: landing timeout fired — re-read PR state", { prKey, landedVerdict });
+  return { landedVerdict };
+};
+
+export default handler;