@nanobpm/nano-workforce 0.206.4 → 0.208.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.208.0](https://github.com/nanobpm/nano-workforce/compare/v0.207.0...v0.208.0) (2026-11-10)
+
+### Features
+
+* **merge:** request the head-current Copilot review after a loop-authored head move ([#941](https://github.com/nanobpm/nano-workforce/issues/941)) ([0e2d50e](https://github.com/nanobpm/nano-workforce/commit/0e2d50e8610beb5e939cd3a143d28e62d690f272)), closes [#939](https://github.com/nanobpm/nano-workforce/issues/939)
+
+## [0.207.0](https://github.com/nanobpm/nano-workforce/compare/v0.206.4...v0.207.0) (2026-11-09)
+
+### Features
+
+* **status:** surface engine incidents on loop and delivery rows with a retry action ([#938](https://github.com/nanobpm/nano-workforce/issues/938)) ([e3955c8](https://github.com/nanobpm/nano-workforce/commit/e3955c8145a966a29806400872b7a9c362d1d992)), closes [#931](https://github.com/nanobpm/nano-workforce/issues/931) [#931](https://github.com/nanobpm/nano-workforce/issues/931)
+
 ## [0.206.4](https://github.com/nanobpm/nano-workforce/compare/v0.206.3...v0.206.4) (2026-11-09)
 
 ### Bug Fixes

package/SPEC.md

@@ -855,6 +855,24 @@ start ─► wait: deps merged ─► arm merge ─► wait: mergeable ─┬─
     sets `ciBlockedReconciled`), and escalates only if the PR is **still** blocked on the
     re-derived state.
 
+- **Head-current review after a loop-authored head move — request it, don't escalate**
+  (issue #939) — `pr.merge` refuses to land without a Copilot review of the PR's
+  current HEAD (#923 backstop). When the loop's own rebase / merge-from-base / fix push
+  moved the head, the only remedy is mechanical, so instead of escalating the worker
+  returns `mergeStatus: "review-pending"` and the model **requests the review itself**
+  (`pr.request-review` — REST `requested_reviewers` POST of
+  `copilot-pull-request-reviewer[bot]`; on a re-request whose prior ask is still pending,
+  i.e. silently ignored, it withdraws then re-adds the reviewer), waits on a timer
+  (`reviewRequestWait`, derived from the review-nudge window) and re-arms the poller so
+  the backstop re-checks the new head. It repeats up to `reviewRequestMax` (3) requests;
+  only when no review arrives in that budget — or Copilot is not an assignable reviewer —
+  does it escalate, with a question stating what was tried. A head-current review whose
+  summary reports open findings returns `mergeStatus: "review-findings"`: `pr.reconverge`
+  hands the PR back to the convergence loop through the canonical `submitPr` (declaring
+  the owning merge-loop instance as `handoffFrom`) and the merge loop ends — the fresh
+  convergence run fixes, pushes, re-reviews and starts a new merge loop on convergence.
+  An *unreadable* review/head still fails closed to a human (#927).
+
 - **Discovered dependency** — a `senior:fix-ci` or `senior:rebase` agent may find that
   the PR cannot land because **another PR must merge first** (a required linked-issue
   gate a sibling PR will close, a stacked base PR, or a `Depends-on:` the agent read

package/app/deliveryGraphReadModel.test.ts

@@ -39,7 +39,7 @@ import { applyMigrationSet, readMigrationSetFromDisk } from "../test/migrations.
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const READ_MODEL_MIGRATION = "121_delivery_graph_read_model_auto_resolve.sql";
+const READ_MODEL_MIGRATION = "129_delivery_graph_read_model_incidents.sql";
 
 // A minimal in-memory DB carrying the base `delivery_graph_runs` / `pull_requests` shapes the VIEW
 // reads, plus stand-ins for the managed `<table>__tracking` derived VIEWs urban provisions at mount
@@ -53,7 +53,9 @@ function viewDb(): DatabaseSync {
        run_key TEXT PRIMARY KEY, process_key TEXT, process_definition_id TEXT, digest TEXT,
        status TEXT, side_effecting INTEGER, node_count INTEGER, human_node_count INTEGER,
        side_effect_count INTEGER, title TEXT, phase TEXT, phase_node_id TEXT, human_labels TEXT,
-       created_at TEXT, updated_at TEXT, acknowledged_at TEXT, auto_resolve_escalations INTEGER, derived_status_override TEXT);
+       created_at TEXT, updated_at TEXT, acknowledged_at TEXT, auto_resolve_escalations INTEGER,
+       incident_key TEXT, incident_type TEXT, incident_message TEXT, incident_since TEXT,
+       derived_status_override TEXT);
      CREATE TABLE pull_requests (pr_key TEXT PRIMARY KEY, root_request_key TEXT, status TEXT,
        derived_status_override TEXT);`,
   );

package/app/deliveryGraphRun.ts

@@ -56,6 +56,14 @@ export interface DeliveryGraphRun {
   /** Opt-in escalation steward (120_escalation_auto_resolutions.sql, issue #889): 1 ⇒ this run's
    * escalations are eligible for steward auto-resolution. Default 0. */
   auto_resolve_escalations: number;
+  /** Technical-incident mirror (127_delivery_graph_run_incidents.sql, issue #931), written by the
+   *  poller's `pollIncidents` pass — the delivery-side twin of the PR incident columns (017/126).
+   *  All NULL when the run's instance has no active incident; `/status` derives the `incident`
+   *  overlay from these columns (see `activeDeliveries` in app/service.ts). */
+  incident_key: string | null;
+  incident_type: string | null;
+  incident_message: string | null;
+  incident_since: string | null;
 }
 
 /** The run lifecycle. `awaiting-approval` is RESERVED but no longer produced (issue #460 moved dispatch
@@ -530,5 +538,9 @@ export function buildDeliveryGraphRunRow(input: {
     created_at: input.createdAt ?? at,
     updated_at: at,
     acknowledged_at: null,
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
   };
 }

package/app/github.ts

@@ -743,6 +743,35 @@ export async function requestCopilotReview(
   throw new Error(`github ${r.status} ${r.statusText}: ${(await r.text()).slice(0, 300)}`.trim());
 }
 
+/** Withdraw a pending Copilot review request (REST reviewers DELETE). Used by the merge loop's
+ * head-current review request (issue #939) when a prior request was silently ignored: Copilot stays
+ * listed as pending but never reviews, and a second POST is a no-op — removing and re-adding it is
+ * the equivalent that re-triggers the review. `null` when no transport is usable; throws on a
+ * genuine transport failure. */
+export async function removeCopilotReviewer(
+  repo: string,
+  number: number | string,
+  token: string,
+): Promise<"removed" | null> {
+  const path = `repos/${repo}/pulls/${number}/requested_reviewers`;
+  if (await useGh()) {
+    await runGh(["api", path, "-X", "DELETE", "-f", `reviewers[]=${COPILOT_REVIEWER}`]);
+    return "removed";
+  }
+  if (!token) return null;
+  const r = await fetch(`https://api.github.com/${path}`, {
+    method: "DELETE",
+    headers: {
+      authorization: `Bearer ${token}`,
+      accept: "application/vnd.github+json",
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({ reviewers: [COPILOT_REVIEWER] }),
+  });
+  if (r.ok) return "removed";
+  throw new Error(`github ${r.status} ${r.statusText}: ${(await r.text()).slice(0, 300)}`.trim());
+}
+
 // ── Merge stage (SPEC §11) ──────────────────────────────────────────────────
 // The same two-transport model (gh | token) backs the merge stage: read a PR's merge state to
 // decide when it is landable, and perform the merge (directly or via the repo's merge queue).

package/app/incidentStatus.test.ts

@@ -0,0 +1,175 @@
+// Red/green for issue #931 — an engine incident parked on a convergence loop's job must be VISIBLE
+// on the `/status` row, not hide behind a healthy-looking `status: "converging"`.
+//
+// The defect (observed on merlin, 2026-11-09): a loop whose `senior:pr-review` job exhausted its
+// retries (`JOB_NO_RETRIES`, the agent idle-timeout) sat dead for hours while `/status` reported
+// `status: "converging"`, `openEscalation: null`, `activeWorker: null` — indistinguishable from a
+// healthy queued run. `pollIncidents` mirrored the incident onto `incident_key`/`incident_message`
+// (issue #94), but the `/status` projection never READ those columns, so the only discovery path
+// was a hand-run `POST /v2/incidents/search`.
+//
+// The fix surfaces the mirrored incident on every ActivePr/ActiveDelivery row:
+//   status   — overlaid to "incident" while the row carries an ACTIVE incident (the base
+//              `pull_requests.status` workflow transient is untouched; the overlay is derived at
+//              read time so it can never wedge the status machine), and
+//   incident — { key, type, message, since }: the engine incidentKey, errorType, errorMessage and
+//              creationTime the poller mirrored, so an operator sees WHAT broke and WHEN without
+//              opening the engine.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
+import { activeDeliveries, activePrs } from "./service.ts";
+
+function memTable(rows: any[], key: string) {
+  return {
+    get: (k: any) => Promise.resolve(rows.find((r) => r[key] === k) ?? null),
+    all: () => Promise.resolve([...rows]),
+    find: (q: any) =>
+      Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v))),
+    findOne: (q: any) =>
+      Promise.resolve(rows.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null),
+    insert: (r: any) => {
+      rows.push(r);
+      return Promise.resolve(r);
+    },
+    update: (k: any, patch: any) => {
+      const r = rows.find((x) => x[key] === k);
+      if (r) Object.assign(r, patch);
+      return Promise.resolve(r);
+    },
+    delete: (k: any) => {
+      for (let i = rows.length - 1; i >= 0; i--) if (rows[i][key] === k) rows.splice(i, 1);
+      return Promise.resolve();
+    },
+  };
+}
+
+type Stores = Record<string, { rows: any[]; key: string }>;
+
+function memData(stores: Stores) {
+  return {
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+  } as any;
+}
+
+/** A fake engine whose `searchVariables` serves the given per-instance variables (none here — the
+ *  merge policy degrades to its historical default, which these tests do not exercise). */
+function fakeEngine() {
+  return {
+    searchVariables: () => Promise.resolve([]),
+  } as any;
+}
+
+function prRow(over: Record<string, unknown>) {
+  return {
+    pr_key: "owner/repo#1",
+    repo: "owner/repo",
+    number: 1,
+    url: "https://github.com/owner/repo/pull/1",
+    title: "t",
+    status: "converging",
+    current_round: 1,
+    process_key: "PI-1",
+    updated_at: "2024-01-01",
+    ...over,
+  };
+}
+
+async function statusOf(rowOver: Record<string, unknown> = {}) {
+  const stores: Stores = {
+    pull_requests: { rows: [prRow(rowOver)], key: "pr_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [pr] = await activePrs(memData(stores), fakeEngine());
+  return pr;
+}
+
+test("incident surfacing: a PR row carrying an ACTIVE incident reads status 'incident', not 'converging' (the #931 defect)", async () => {
+  const pr = await statusOf({
+    incident_key: "598235",
+    incident_type: "JOB_NO_RETRIES",
+    incident_message: 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)',
+    incident_since: "2026-11-09T01:00:00.000Z",
+  });
+  assertEquals(pr.status, "incident");
+  assertEquals(pr.incident, {
+    key: "598235",
+    type: "JOB_NO_RETRIES",
+    message: 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)',
+    since: "2026-11-09T01:00:00.000Z",
+  });
+});
+
+test("incident surfacing: a healthy PR row keeps its workflow status and a null incident", async () => {
+  const pr = await statusOf({
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
+  });
+  assertEquals(pr.status, "converging");
+  assertEquals(pr.incident, null);
+});
+
+test("incident surfacing: the overlay applies to any live workflow status (e.g. waiting_merge), never just converging", async () => {
+  const pr = await statusOf({
+    status: "waiting_merge",
+    incident_key: "INC-9",
+    incident_type: "EXTRACT_VALUE_ERROR",
+    incident_message: "failed to evaluate expression",
+    incident_since: "2026-11-09T02:00:00.000Z",
+  });
+  assertEquals(pr.status, "incident");
+  assertEquals(pr.incident?.key, "INC-9");
+});
+
+test("incident surfacing: a delivery run carrying an ACTIVE incident reads status 'incident' with the incident block", async () => {
+  const run = {
+    run_key: "dg-1",
+    title: "ship it",
+    status: "running",
+    phase: "Running",
+    process_key: "PI-DG-1",
+    updated_at: "2024-01-01",
+    auto_resolve_escalations: 0,
+    incident_key: "INC-DG-1",
+    incident_type: "JOB_NO_RETRIES",
+    incident_message: "delivery node job exhausted retries",
+    incident_since: "2026-11-09T03:00:00.000Z",
+  };
+  const stores: Stores = {
+    delivery_graph_runs: { rows: [run], key: "run_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [delivery] = await activeDeliveries(memData(stores));
+  assertEquals(delivery.status, "incident");
+  assertEquals(delivery.incident, {
+    key: "INC-DG-1",
+    type: "JOB_NO_RETRIES",
+    message: "delivery node job exhausted retries",
+    since: "2026-11-09T03:00:00.000Z",
+  });
+});
+
+test("incident surfacing: a healthy delivery run keeps its status and a null incident", async () => {
+  const run = {
+    run_key: "dg-2",
+    title: "ship it",
+    status: "running",
+    phase: "Running",
+    process_key: "PI-DG-2",
+    updated_at: "2024-01-01",
+    auto_resolve_escalations: 0,
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
+  };
+  const stores: Stores = {
+    delivery_graph_runs: { rows: [run], key: "run_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [delivery] = await activeDeliveries(memData(stores));
+  assertEquals(delivery.status, "running");
+  assertEquals(delivery.incident, null);
+});

package/app/mcpExclusions.test.ts

@@ -31,9 +31,10 @@ function projectedOperations() {
 }
 
 // The operator-only cockpit doors: the staged delivery-graph lifecycle (stage -> dispatch ->
-// dismiss) whose approval is a human click in the cockpit (ADR 0005 Decision 7). These — and ONLY
-// these — must be excluded from the projected MCP tool surface.
-const EXPECTED_EXCLUDED = ["stageDeliveryGraph", "dispatchDeliveryGraph", "dismissProposal"];
+// dismiss) whose approval is a human click in the cockpit (ADR 0005 Decision 7), plus the
+// incident-retry remediation door (issue #931) — the human unstick action on an incident-parked
+// run. These — and ONLY these — must be excluded from the projected MCP tool surface.
+const EXPECTED_EXCLUDED = ["stageDeliveryGraph", "dispatchDeliveryGraph", "dismissProposal", "retryIncident"];
 
 // A representative set of agent-facing operations that MUST stay exposed as tools — the drive doors
 // (submit PR / epic / delivery-graph set), the pure compile/preview doors, and the read/orientation

package/app/mcpToolSurface.ts

@@ -87,8 +87,12 @@ export const FRAMEWORK_TOOL_PREFIX = "urban_debug_";
  * regression guard, not the reduction itself: the reduction an agent actually experiences comes from
  * importing {@link CURATED_MCP_TOOLS} rather than `["*"]`, and the transport-level shrink of the
  * framework tool family is tracked upstream (nano-ide#488).
+ *
+ * RAISE PROVENANCE — 60 → 61 (#931): the read-only `listIncidents` door (sibling of
+ * `listEscalations`) stays on the surface per the `x-mcp` convention that read/orient doors are
+ * exposed; its operator-only remedy `retryIncident` is excluded. Deliberate, documented growth.
  */
-export const MCP_TOOL_COUNT_BUDGET = 60;
+export const MCP_TOOL_COUNT_BUDGET = 61;
 
 /**
  * Hard CEILING on the serialized byte size of the full `tools/list` payload (the schema bytes a
@@ -138,8 +142,13 @@ export const MCP_TOOL_COUNT_BUDGET = 60;
  * intended description text (a correctness fix, not new surface). Measured 90,420 bytes serialized
  * (over the old ceiling's 920-byte headroom). Deliberate, documented growth of restored description
  * text — not schema fat.
+ *
+ * RAISE PROVENANCE — 91_000 → 92_000 (#931): the read-only `listIncidents` tool (engine-incident
+ * liveness sibling of `listEscalations`) plus the `incident` field on the status row schemas.
+ * Measured 91,069 bytes serialized (over the old ceiling's headroom). Deliberate, documented growth
+ * of a real new read surface — not schema fat.
  */
-export const MCP_SURFACE_BYTES_BUDGET = 91_000;
+export const MCP_SURFACE_BYTES_BUDGET = 92_000;
 
 /**
  * The eagerly-loaded curated subset MUST stay materially smaller than the full surface — otherwise it

package/app/mergeLoopBehaviour.test.ts

@@ -43,7 +43,8 @@ const MODEL = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
 const AGENT_SLA_MS = 30 * 60 * 1000; // matches the PT30M we start instances with
 const LANDED_WAIT_MS = 30 * 60 * 1000; // matches the PT30M landedWaitTimeout we start instances with
 const MERGEABLE_WAIT_MS = 30 * 60 * 1000; // matches the PT30M mergeableWaitTimeout we start instances with
-const MERGEABLE_REPOLL_MS = 2 * 60 * 1000; // matches the PT2M mergeableRepollInterval we start instances with
+const MERGEABLE_REPOLL_MS = 2 * 60 * 1000;
+const REVIEW_REQUEST_WAIT_MS = 10 * 60 * 1000; // matches the PT10M reviewRequestWait we start instances with // matches the PT2M mergeableRepollInterval we start instances with
 
 type Output = Record<string, unknown>;
 type Responder = Output | Output[] | ((job: { variables: Record<string, unknown> }) => Output);
@@ -59,6 +60,8 @@ const ALL_JOB_TYPES = [
   "pr.persist-escalation",
   "pr.answer-escalation",
   "pr.record-dependency",
+  "pr.request-review",
+  "pr.reconverge",
 ] as const;
 
 const DEFAULT_RESPONSES: Record<string, Responder> = {
@@ -68,6 +71,8 @@ const DEFAULT_RESPONSES: Record<string, Responder> = {
   "pr.answer-escalation": {},
   "pr.persist-escalation": { escalated: true },
   "pr.landed-probe": { landedVerdict: "waiting" },
+  "pr.request-review": { reviewRequest: "requested" },
+  "pr.reconverge": {},
 };
 
 // Every FEEL expression in the model references these; start them defined (null,
@@ -91,6 +96,10 @@ const DEFAULT_VARS: Record<string, unknown> = {
   mergeableRepollInterval: "PT2M",
   mergeStallRounds: 0,
   mergeStallMax: 3,
+  reviewRequestRound: 0,
+  reviewRequestMax: 3,
+  reviewRequestWait: "PT10M",
+  reviewRequest: null,
   abandonBrief: "\n\n---\nAbort if cancelled: curl …",
   failingChecksList: null,
   status: null,
@@ -413,6 +422,59 @@ test("a fix-ci agent echoing abandonBrief cannot corrupt the seeded abort brief
     .hasVariable("abandonBrief", "\n\n---\nAbort if cancelled: curl …");
 });
 
+test("a fix-ci agent echoing review-request state cannot clobber the seeded budget or timer (#941 round 4)", async () => {
+  // Same guard class as the #887 echoes: `reviewRequestRound`/`reviewRequestMax` bound the
+  // head-current review re-request loop (`reviewRequestRound < reviewRequestMax` gates a retry) and
+  // `reviewRequestWait` arms its timer. An agent completion echoing `reviewRequestMax: 0` would send
+  // the FIRST missing-review verdict straight to a human escalation, and a clobbered
+  // `reviewRequestWait` would reshape the wait. The snapshot/restore guard must pin all four.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "blocked", failingChecks: 1, failingChecksList: "build" },
+      "senior:fix-ci": {
+        status: "fixed",
+        reviewRequestRound: 99,
+        reviewRequestMax: 0,
+        reviewRequestWait: "PT1S",
+        reviewRequest: "unavailable",
+      },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("merge-stall-probe", "fix-ci")
+    .hasVariable("reviewRequestRound", 0)
+    .hasVariable("reviewRequestMax", 3)
+    .hasVariable("reviewRequestWait", "PT10M");
+  assert(instanceVars(engine).reviewRequest !== "unavailable", "a fix-ci agent must not forge reviewRequest:unavailable");
+});
+
+test("a rebase agent echoing review-request state cannot clobber the seeded budget or timer (#941 round 4)", async () => {
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": {
+        status: "rebased",
+        reviewRequestRound: 99,
+        reviewRequestMax: 0,
+        reviewRequestWait: "PT1S",
+        reviewRequest: "unavailable",
+      },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("reviewRequestRound", 0)
+    .hasVariable("reviewRequestMax", 3)
+    .hasVariable("reviewRequestWait", "PT10M");
+  assert(instanceVars(engine).reviewRequest !== "unavailable", "a rebase agent must not forge reviewRequest:unavailable");
+});
+
 test("a blocked PR probed on timeout reaches the CI-fix arm via the timeout path (#636)", async () => {
   const engine = await boot({
     responses: {
@@ -908,6 +970,79 @@ test("a worker-supplied block question (review backstop #923) reaches the human
   assert(!q.includes("Investigate why GitHub refused"), "must not be overwritten by the generic refusal text");
 });
 
+// ---------------------------------------------------------------------------
+// Head-current review after a loop-authored head move (issue #939)
+// ---------------------------------------------------------------------------
+
+async function driveToAttempt(engine: WasmEngineClient): Promise<void> {
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+}
+
+test("#939: a missing head-current review requests one itself, waits, and merges on the re-check — no human", async () => {
+  const engine = await boot({ responses: { "pr.merge": [{ mergeStatus: "review-pending" }, { mergeStatus: "merged" }] } });
+  await driveToAttempt(engine);
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-review-requested");
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("request-review");
+  assertEquals(instanceVars(engine).reviewRequestRound, 1);
+  await engine.advanceTime(REVIEW_REQUEST_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable");
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompleted().hasCompletedElements("mark-merged");
+  assert(!completedElementIds(engine).has("merge-esc-attempt"), "an automatable review gap must never escalate");
+});
+
+test("#939 defect-class guard: no automatable merge-gate refusal escalates to a human on its first occurrence", async () => {
+  for (const mergeStatus of ["review-pending", "review-findings"]) {
+    const engine = await boot({ responses: { "pr.merge": { mergeStatus } } });
+    await driveToAttempt(engine);
+    const done = completedElementIds(engine);
+    assert(!done.has("merge-esc-attempt") && !done.has("merge-esc-conflict"), `${mergeStatus}: must not escalate`);
+    const open = await engine.searchUserTasks({});
+    assertEquals(open.length, 0, `${mergeStatus}: no human task on the first occurrence`);
+  }
+});
+
+test("#939: a head-current review with findings re-enters convergence and ends the merge loop", async () => {
+  const engine = await boot({ responses: { "pr.merge": { mergeStatus: "review-findings" } } });
+  await driveToAttempt(engine);
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompleted().hasCompletedElements("reconverge", "MergeReconverged");
+  assert(!completedElementIds(engine).has("mark-merged"), "findings must not merge");
+});
+
+test("#939: a review that never arrives escalates after the bounded request budget, stating what was tried", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "review-pending" } },
+    vars: { reviewRequestMax: 1 },
+  });
+  await driveToAttempt(engine);
+  await engine.advanceTime(REVIEW_REQUEST_WAIT_MS + 1);
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  const q = String(escalation(engine).question ?? "");
+  assertStringIncludes(q, "requested a Copilot review of the current HEAD 1 time(s)");
+  assertStringIncludes(q, "PT10M");
+});
+
+test("#939: a clean re-check resets the request budget so a later head move gets a fresh budget", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": [{ mergeStatus: "review-pending" }, { mergeStatus: "retry" }, { mergeStatus: "merged" }] },
+  });
+  await driveToAttempt(engine);
+  await engine.advanceTime(REVIEW_REQUEST_WAIT_MS + 1);
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "ready" } });
+  assertEquals(instanceVars(engine).reviewRequestRound, 0);
+});
+
+test("#939: Copilot not assignable escalates immediately, naming the cause", async () => {
+  const engine = await boot({
+    responses: { "pr.merge": { mergeStatus: "review-pending" }, "pr.request-review": { reviewRequest: "unavailable" } },
+  });
+  await driveToAttempt(engine);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertStringIncludes(String(escalation(engine).question ?? ""), "not an assignable reviewer");
+});
+
 // ---------------------------------------------------------------------------
 // CI-fix sub-process (SP_cifix) — mergeCiReattempt (#134), #329
 // ---------------------------------------------------------------------------

package/app/pullRequestReadModel.test.ts

@@ -33,7 +33,7 @@ import {
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const READ_MODEL_MIGRATION = "122_pull_requests_read_model_auto_resolve.sql";
+const READ_MODEL_MIGRATION = "128_pull_requests_read_model_incidents.sql";
 
 // The real base `pull_requests` columns, in schema order — DERIVED from the migration chain (not a
 // hand-kept list that could silently omit one), used by both the drift guard and the e2e stand-in.