@nanobpm/nano-workforce 0.208.1 → 0.208.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.208.2](https://github.com/nanobpm/nano-workforce/compare/v0.208.1...v0.208.2) (2026-11-10)
+
+### Bug Fixes
+
+* **status:** batch the /status merge-policy engine read into one call ([#937](https://github.com/nanobpm/nano-workforce/issues/937)) ([a9778e1](https://github.com/nanobpm/nano-workforce/commit/a9778e1c7db7205fe0b3b5dfebc597468c4e66f4)), closes [issue-#916](https://github.com/nanobpm/issue-/issues/916) [#916](https://github.com/nanobpm/nano-workforce/issues/916) [#936](https://github.com/nanobpm/nano-workforce/issues/936)
+
 ## [0.208.1](https://github.com/nanobpm/nano-workforce/compare/v0.208.0...v0.208.1) (2026-11-10)
 
 ### Bug Fixes

package/app/mergeStatus.test.ts

@@ -53,16 +53,22 @@ function memData(stores: Stores) {
   } as any;
 }
 
-/** A fake engine whose `searchVariables` serves the given per-instance variables. */
+/** A fake engine whose `searchVariables` serves the given per-instance variables. A name-less,
+ *  key-less query (`{}` — the batched /status read, issue #936) returns EVERY variable across all
+ *  instances, each row carrying its owning `processInstanceKey`, exactly as the real engine does. */
 function fakeEngine(varsByInstance: Record<string, Record<string, unknown>>) {
   return {
-    searchVariables: (q: { processInstanceKey?: string; name?: string }) => {
-      const vars = varsByInstance[String(q.processInstanceKey)] ?? {};
-      return Promise.resolve(
-        Object.entries(vars)
-          .filter(([name]) => q.name == null || name === q.name)
-          .map(([name, v]) => ({ name, value: JSON.stringify(v) })),
-      );
+    searchVariables: (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      const rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[] = [];
+      for (const [piKey, vars] of Object.entries(varsByInstance)) {
+        if (q.processInstanceKey != null && piKey !== String(q.processInstanceKey)) continue;
+        if (q.scopeKey != null && piKey !== String(q.scopeKey)) continue;
+        for (const [name, v] of Object.entries(vars)) {
+          if (q.name != null && name !== q.name) continue;
+          rows.push({ name, value: JSON.stringify(v), processInstanceKey: piKey, scopeKey: piKey });
+        }
+      }
+      return Promise.resolve(rows);
     },
   } as any;
 }
@@ -167,3 +173,52 @@ test("merge policy: NANO_PR_AUTO_MERGE=0 blocks a requested merge as env, never
     else process.env["NANO_PR_AUTO_MERGE"] = prev;
   }
 });
+
+function activeStores() {
+  return {
+    pull_requests: { rows: [prRow({})], key: "pr_key" },
+    user_tasks: { rows: [], key: "id" },
+  } satisfies Stores;
+}
+
+type Row = { name: string; value: string; processInstanceKey: string; scopeKey: string };
+const row = (name: string, v: unknown): Row => ({ name, value: JSON.stringify(v), processInstanceKey: "PI-1", scopeKey: "PI-1" });
+
+test("merge policy: an unusable autoMerge row still probes a page-cut convergeOnly (PR #937 review)", async () => {
+  // Batch: autoMerge present but null (unusable), convergeOnly cut from its page; the root probe finds it.
+  const engine = {
+    searchVariables: (q: { processInstanceKey?: string; name?: string }) => {
+      if (q.processInstanceKey == null) {
+        if (q.name === "autoMerge") return Promise.resolve([row("autoMerge", null)]);
+        if (q.name === "humanApproval") return Promise.resolve([row("humanApproval", false)]);
+        return Promise.resolve([]);
+      }
+      return Promise.resolve(q.name === "convergeOnly" ? [row("convergeOnly", true)] : []);
+    },
+  } as any;
+  const [pr] = await activePrs(memData(activeStores()), engine);
+  assertEquals(pr.merge.requested, false, "the legacy convergeOnly:true must be honoured when autoMerge is unusable");
+});
+
+test("merge policy: a delayed successful probe cannot resurrect a policy after a sibling probe failed (PR #937 review)", async () => {
+  // Batch cuts every name. PI-1: autoMerge probe rejects early, humanApproval:true resolves late.
+  // PI-2 (another PR) has a slower probe, so the projection is still pending when PI-1's late probe lands.
+  const stores = {
+    pull_requests: {
+      rows: [prRow({}), prRow({ pr_key: "owner/repo#2", number: 2, process_key: "PI-2" })],
+      key: "pr_key",
+    },
+    user_tasks: { rows: [], key: "id" },
+  } satisfies Stores;
+  const engine = {
+    searchVariables: (q: { processInstanceKey?: string; name?: string }) => {
+      if (q.processInstanceKey == null) return Promise.resolve([]);
+      if (q.processInstanceKey === "PI-2") return new Promise<Row[]>((r) => setTimeout(() => r([]), 60));
+      if (q.name === "autoMerge") return Promise.reject(new Error("boom"));
+      return new Promise<Row[]>((r) => setTimeout(() => r([row(q.name ?? "", true)]), 20));
+    },
+  } as any;
+  const prs = await activePrs(memData(stores), engine);
+  const pr = prs.find((p: { prKey?: string; pr_key?: string; number?: number }) => p.number === 1);
+  assertEquals(pr?.merge, { requested: true, enabled: true, effective: true, blockedBy: null }, "failed probe → default, not a half-read policy");
+});

package/app/service.test.ts

@@ -1358,13 +1358,15 @@ function captureRoot() {
     open: () => memOpen(stores),
   } as any;
   let captured: unknown;
+  let vars: Record<string, unknown> | undefined;
   const engine = {
     createInstance: (req: { variables?: Record<string, unknown> }) => {
       captured = req.variables?.rootRequestKey;
+      vars = req.variables;
       return Promise.resolve({ processInstanceKey: "PI-1" });
     },
   } as any;
-  return { data, engine, stores, get: () => captured };
+  return { data, engine, stores, get: () => captured, vars: () => vars };
 }
 
 test("submitPr persists root_request_key and threads it onto the convergence instance", async () => {
@@ -1447,6 +1449,21 @@ test("startMerge reads root_request_key off the PR row onto the merge instance",
   });
 });
 
+test("startMerge seeds the merge-policy triple so /status needs no per-instance probes (PR #937)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, vars } = captureRoot();
+    await startMerge(data, engine, {
+      repo: "owner/repo",
+      number: 9,
+      url: "https://github.com/owner/repo/pull/9",
+      prKey: "owner/repo#9",
+      round: 1,
+    });
+    const seeded = vars() ?? {};
+    assertEquals([seeded.autoMerge, seeded.convergeOnly, seeded.humanApproval], [true, false, false]);
+  });
+});
+
 // The repository envelope drives the c8ctl harness's isolated workspace provisioning: it is
 // emitted under the reserved `io.nanobpm.agentTask` namespace with the PR head branch as the
 // checkout ref, and omitted entirely when the head branch couldn't be resolved (so the harness

package/app/service.ts

@@ -1091,6 +1091,12 @@ export async function startMerge(
       reviewRequest: null,
       // Lineage (issue #245): thread the origin identity onto the merge instance (see startMerge).
       rootRequestKey,
+      // Merge policy (issue #936): a merge loop only starts for a requested, approved merge. Seeding
+      // the policy triple keeps it in /status's batched reads (no per-instance probes). Inert here —
+      // the merge-loop process reads none of them.
+      autoMerge: true,
+      convergeOnly: false,
+      humanApproval: false,
       abandonUrl: abUrl,
       abandonBrief: renderAbandonBrief(abUrl),
       // Host-git provisioning (c8ctl): same repository envelope as the convergence loop, so the
@@ -1230,15 +1236,21 @@ export async function activePrs(
     openEscByPr.set(t.subject_key, toOpenEscalation(t));
   }
   // Merge intent (issue #916): read the loop's `autoMerge` / `convergeOnly` / `humanApproval`
-  // variables per PR so the effective merge policy is visible without opening the engine. One
-  // best-effort read per PR; a failure (engine unreachable, instance gone) degrades to the
-  // historical default (merge requested) rather than failing the whole status read.
+  // variables per PR so the effective merge policy is visible without opening the engine.
+  //
+  // A CONSTANT number of batched engine reads per /status call (issue #936) — never a per-row
+  // fan-out. The pre-#936 shape issued 3 `searchVariables` round-trips PER active PR (12 calls at 4
+  // rows ≈ 13 s; concurrent callers stacked until the console proxy 502'd). See
+  // `readMergePolicyVars` for the completeness contract (single-page seam, root scope only, one
+  // per-name root probe only for a page cut or legacy instance). Best-effort: a failed batched read degrades every
+  // PR to the historical default (merge requested); a failed per-instance fallback degrades only
+  // that PR.
   const mergeByPr = new Map<string, MergePolicy>();
-  await Promise.all(
-    active.map(async (p) => {
-      mergeByPr.set(p.pr_key, await mergePolicyFor(p.process_key ?? null, engine));
-    }),
-  );
+  const activeKeys = active.map((p) => p.process_key).filter((k): k is string => k != null && k !== "");
+  const varsByInstance = await readMergePolicyVars(engine, activeKeys);
+  for (const p of active) {
+    mergeByPr.set(p.pr_key, mergePolicyFromVars(varsByInstance?.get(p.process_key ?? "")));
+  }
   return active.map((p) => {
     // Issue #931: an ACTIVE engine incident parked on the loop's instance must be VISIBLE — the row
     // kept reading `converging` for hours while nothing ran. Overlay the derived `incident` status
@@ -1284,44 +1296,134 @@ function mergePolicyFrom(requested: boolean, humanApproval: boolean): MergePolic
   return { requested, enabled, effective, blockedBy };
 }
 
-/** Read one boolean process variable off a live instance; undefined when absent/unreadable. */
-async function readBoolVar(
-  engine: Pick<EngineClient, "searchVariables">,
-  processKey: string,
-  name: string,
-): Promise<boolean | undefined> {
-  const [row] = await engine.searchVariables({ processInstanceKey: processKey, name });
-  if (!row) return undefined;
+/** The merge-policy variable triple for one instance: the values of `autoMerge`, `convergeOnly`,
+ *  and `humanApproval`, each `undefined` when the instance does not carry it (or it is not a
+ *  boolean). */
+type MergePolicyVars = {
+  autoMerge: boolean | undefined;
+  convergeOnly: boolean | undefined;
+  humanApproval: boolean | undefined;
+};
+
+function emptyMergePolicyVars(): MergePolicyVars {
+  return { autoMerge: undefined, convergeOnly: undefined, humanApproval: undefined };
+}
+
+function parseBoolValue(value: string): boolean | undefined {
   try {
-    const v: unknown = JSON.parse(row.value);
+    const v: unknown = JSON.parse(value);
     return typeof v === "boolean" ? v : undefined;
   } catch {
     return undefined;
   }
 }
 
-/** Derive a PR's effective merge policy from its loop's process variables (issue #916). The
- * canonical positive `autoMerge` wins; the legacy inverted `convergeOnly` is the fallback for
- * in-flight loops seeded before `autoMerge` existed. Best-effort: any read failure degrades to the
- * historical default (merge requested) rather than failing the status read. */
-async function mergePolicyFor(
-  processKey: string | null,
+const MERGE_POLICY_NAMES = ["autoMerge", "convergeOnly", "humanApproval"] as const;
+type MergePolicyName = (typeof MERGE_POLICY_NAMES)[number];
+
+function isMergePolicyName(name: string): name is MergePolicyName {
+  return MERGE_POLICY_NAMES.some((n) => n === name);
+}
+
+/** Batched merge-policy read (issue #936): ONE name-filtered engine-wide read per policy variable
+ *  (3 concurrent calls, independent of row count), bucketed by owning instance.
+ *
+ *  Completeness: the engine seam returns a single page with no cursor, so an engine-wide read can
+ *  silently omit rows, and the three name pages truncate independently. Completeness is therefore
+ *  tracked per (instance, name): every name an active instance is missing from is re-probed with a
+ *  name-filtered root read (<=1 row, cannot be truncated). Every loop seeds all three names at
+ *  creation (submitPr for the review loop, startMerge for the merge loop), so the steady state is a
+ *  constant 3 calls; probes are paid only for genuine page cuts or legacy instances.
+ *
+ *  Scope: only the PROCESS-ROOT variable (`scopeKey === processInstanceKey`) is the loop's policy; a
+ *  same-named child-scope variable is ignored so it can never overwrite the root value.
+ *
+ *  Failure isolation: a failed BATCH read rejects the whole projection (its page is partial, so
+ *  absence can no longer be distinguished from a page cut) and the caller degrades every row to
+ *  the default. A failed TARGETED read degrades only its own instance (its partial entry is dropped,
+ *  so it projects the default, never a half-read policy) — the policies already
+ *  fetched for every other PR are preserved (a rejected fallback must not discard a sibling's
+ *  `autoMerge:false` or `humanApproval:true` and silently un-block its merge).
+ *
+ *  Skips the engine entirely when no active row carries a process key. Returns `undefined` when no
+ *  engine was handed in or a batched read fails — the caller degrades every row to the default. */
+async function readMergePolicyVars(
   engine: Pick<EngineClient, "searchVariables"> | undefined,
-): Promise<MergePolicy> {
-  if (processKey == null || !engine) return mergePolicyDefault();
+  activeKeys: readonly string[],
+): Promise<Map<string, MergePolicyVars> | undefined> {
+  if (!engine || activeKeys.length === 0) return undefined;
+  const wanted = new Set(activeKeys);
   try {
-    const [autoMerge, convergeOnly, humanApproval] = await Promise.all([
-      readBoolVar(engine, processKey, "autoMerge"),
-      readBoolVar(engine, processKey, "convergeOnly"),
-      readBoolVar(engine, processKey, "humanApproval"),
-    ]);
-    const requested = autoMerge ?? (convergeOnly === undefined ? true : !convergeOnly);
-    return mergePolicyFrom(requested, humanApproval === true);
+    const byInstance = new Map<string, MergePolicyVars>();
+    const seen = new Map<string, Set<MergePolicyName>>();
+    const record = (row: { name: string; processInstanceKey: string; scopeKey: string; value: string }) => {
+      const pk = String(row.processInstanceKey);
+      if (!wanted.has(pk) || String(row.scopeKey) !== pk) return;
+      if (!isMergePolicyName(row.name)) return;
+      const vars = byInstance.get(pk) ?? emptyMergePolicyVars();
+      vars[row.name] = parseBoolValue(row.value);
+      byInstance.set(pk, vars);
+      const names = seen.get(pk) ?? new Set<MergePolicyName>();
+      names.add(row.name);
+      seen.set(pk, names);
+    };
+    await Promise.all(
+      MERGE_POLICY_NAMES.map(async (name) => {
+        for (const row of await engine.searchVariables({ name })) if (row.name === name) record(row);
+      }),
+    );
+    // Completeness is tracked per (instance, NAME), not per instance: the three name pages truncate
+    // independently, so an instance present in one page (e.g. `autoMerge`) may still have been cut
+    // from another (e.g. `humanApproval`). Each name an instance is missing from is re-probed with a
+    // name-filtered ROOT read — a <=1-row result that cannot be truncated, so it proves absence.
+    // `convergeOnly` is skipped once a usable boolean `autoMerge` is known (the canonical intent wins). Every loop
+    // seeds all three names at creation (submitPr; startMerge seeds the merge loop's policy too), so
+    // the steady state is exactly 3 calls; probes are only paid for page cuts and legacy instances.
+    await Promise.all(
+      [...wanted].map(async (pk) => {
+        const got = seen.get(pk);
+        const probe = MERGE_POLICY_NAMES.filter(
+          (name) =>
+            !got?.has(name) &&
+            !(name === "convergeOnly" && byInstance.get(pk)?.autoMerge !== undefined),
+        );
+        if (probe.length === 0) return;
+        try {
+          // Collect ALL probe results first and record only once every probe succeeded: recording
+          // inside each probe would let a slower successful sibling re-create the entry the catch
+          // below deleted after an earlier rejection, exposing a half-read policy.
+          const results = await Promise.all(
+            probe.map(async (name) =>
+              (await engine.searchVariables({ processInstanceKey: pk, scopeKey: pk, name })).filter(
+                (row) => row.name === name,
+              ),
+            ),
+          );
+          for (const rows of results) for (const row of rows) record(row);
+        } catch {
+          // Degrade ONLY this instance — and fully: drop any partial entry the batch recorded so
+          // the caller projects the default for it, never a half-read policy.
+          byInstance.delete(pk);
+        }
+      }),
+    );
+    return byInstance;
   } catch {
-    return mergePolicyDefault();
+    return undefined;
   }
 }
 
+/** Derive a PR's effective merge policy from an already-read variable triple (issue #916). The
+ * canonical positive `autoMerge` wins; the legacy inverted `convergeOnly` is the fallback for
+ * in-flight loops seeded before `autoMerge` existed; an instance carrying neither (or absent from
+ * the batch — mid-handoff row, instance gone) degrades to the historical default (merge
+ * requested) rather than failing the status read. */
+function mergePolicyFromVars(vars: MergePolicyVars | undefined): MergePolicy {
+  if (!vars) return mergePolicyDefault();
+  const requested = vars.autoMerge ?? (vars.convergeOnly === undefined ? true : !vars.convergeOnly);
+  return mergePolicyFrom(requested, vars.humanApproval === true);
+}
+
 /** A delivery-graph run currently in flight, as reported by the status endpoint (issue #889 §1 —
  *  "Show it in `/status` for each PR or delivery"). Mirrors {@link ActivePr} for the delivery side. */
 export interface ActiveDelivery {

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.208.1",
-  "gitSha": "9080010a73e54c922991be86b54d3f76a1b264e8",
-  "gitTag": "v0.208.1",
-  "builtAt": "2026-11-10T07:05:28.202Z"
+  "version": "0.208.2",
+  "gitSha": "a9778e1c7db7205fe0b3b5dfebc597468c4e66f4",
+  "gitTag": "v0.208.2",
+  "builtAt": "2026-11-10T20:28:50.098Z"
 }

package/operations/listActivePrs.test.ts

@@ -189,3 +189,292 @@ test("a delivery run with no opt-in row flag surfaces autoResolveEscalations fal
   assertEquals(res.body.deliveries[0].openEscalation, null);
   assertEquals(res.body.deliveries[0].processKey, null, "a launch-in-flight run has no stamped process_key yet");
 });
+
+// ── Issue #936: /status latency + concurrency regression guard ────────────────────────────────
+// The defect: `activePrs` fanned the merge-policy read out per row — 3 `searchVariables` engine
+// round-trips PER active PR — so 4 rows cost 12 sequential-ish upstream calls (~13 s) and K
+// concurrent callers stacked (~50 s → the console proxy 502'd). The fix batches the engine read:
+// ONE name-less `searchVariables({})` per /status serve, bucketed in memory. These tests pin the
+// contract against a fake engine with a REALISTIC per-call delay: the engine-call count must stay
+// at one per serve regardless of row count, and K concurrent serves must overlap (wall time ≈ one
+// upstream round-trip, not K ×).
+
+/** A fake engine that serves the batched variable read after a realistic upstream delay, counting
+ *  calls and tracking peak in-flight concurrency. */
+function slowEngine(varsByInstance: Record<string, Record<string, unknown>>, delayMs: number) {
+  let calls = 0;
+  let inFlight = 0;
+  let maxInFlight = 0;
+  return {
+    calls: () => calls,
+    maxInFlight: () => maxInFlight,
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      calls += 1;
+      inFlight += 1;
+      maxInFlight = Math.max(maxInFlight, inFlight);
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      inFlight -= 1;
+      const rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[] = [];
+      for (const [piKey, vars] of Object.entries(varsByInstance)) {
+        if (q.processInstanceKey != null && piKey !== String(q.processInstanceKey)) continue;
+        if (q.scopeKey != null && piKey !== String(q.scopeKey)) continue;
+        for (const [name, v] of Object.entries(vars)) {
+          if (q.name != null && name !== q.name) continue;
+          rows.push({ name, value: JSON.stringify(v), processInstanceKey: piKey, scopeKey: piKey });
+        }
+      }
+      return rows;
+    },
+  } as any;
+}
+
+function prRow936(n: number) {
+  return {
+    pr_key: `o/r#${n}`,
+    repo: "o/r",
+    number: n,
+    url: `https://github.com/o/r/pull/${n}`,
+    title: `PR ${n}`,
+    status: "converging",
+    current_round: 1,
+    process_key: `PI-${n}`,
+    updated_at: `2026-01-${String(n).padStart(2, "0")}`,
+  };
+}
+
+test("issue #936: N active rows cost a constant 3 engine variable reads, not 3N (the 13 s fan-out)", async () => {
+  const N = 8;
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  const vars: Record<string, Record<string, unknown>> = {};
+  for (let i = 1; i <= N; i++) vars[`PI-${i}`] = { autoMerge: true, convergeOnly: false, humanApproval: false };
+  const engine = slowEngine(vars, 25);
+  const app = { ...memApp(rows), engine } as AppApi;
+  const started = Date.now();
+  const res = (await handler(input(), app)) as any;
+  const elapsed = Date.now() - started;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.count, N);
+  assertEquals(
+    engine.calls(),
+    3,
+    "the merge-policy projection batches to ONE read per policy name (3) per serve — a per-row fan-out would show 3N calls",
+  );
+  assert(
+    elapsed < 25 * N,
+    `one batched ~25 ms upstream read serves ${N} rows (took ${elapsed} ms); the per-row fan-out this regresses to would take ≥ ${25 * N} ms`,
+  );
+  // The batch still projects the per-row policy correctly.
+  for (const pr of res.body.prs) {
+    assertEquals(pr.merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  }
+});
+
+test("issue #936: K concurrent /status callers overlap instead of queueing behind each other", async () => {
+  const K = 4;
+  const rows = [prRow936(1), prRow936(2)];
+  const vars = {
+    "PI-1": { autoMerge: true, convergeOnly: false, humanApproval: false },
+    "PI-2": { autoMerge: false, convergeOnly: true, humanApproval: false },
+  };
+  // A realistic slow upstream: each engine read takes 100 ms. Serialized callers would stack to
+  // K × 100 ms (the measured 35–50 s at production scale); overlapped callers finish in ~100 ms.
+  const engine = slowEngine(vars, 100);
+  const app = { ...memApp(rows), engine } as AppApi;
+  const started = Date.now();
+  const results = await Promise.all(Array.from({ length: K }, () => handler(input(), app)));
+  const elapsed = Date.now() - started;
+  for (const res of results) {
+    assertEquals((res as any).status, 200);
+    assertEquals((res as any).body.count, 2);
+  }
+  assertEquals(engine.calls(), 3 * K, "each serve issues its own batched reads (no cross-request cache serving stale policy)");
+  assertEquals(
+    engine.maxInFlight(),
+    3 * K,
+    "all K engine reads were in flight at once — the serves overlap rather than serialise",
+  );
+  assert(
+    elapsed < K * 100,
+    `${K} concurrent serves over a 100 ms upstream finished in ${elapsed} ms (< ${K * 100} ms) — no caller queued behind another`,
+  );
+  // Mixed intents still project per row under the batched read.
+  const body = (results[0] as any).body;
+  assertEquals(body.prs.find((p: any) => p.prKey === "o/r#1").merge.requested, true);
+  assertEquals(body.prs.find((p: any) => p.prKey === "o/r#2").merge.requested, false);
+});
+
+// ── PR #937 review: completeness, root scope, idle skip ──────────────────────────────────────
+
+/** A fake engine with explicit rows (incl. child scopes) whose engine-wide reads are cut to one
+ *  `pageSize` page — the production seam returns a single page with no cursor. */
+function pagedEngine(
+  rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[],
+  pageSize: number,
+) {
+  const queries: { processInstanceKey?: string; scopeKey?: string; name?: string }[] = [];
+  return {
+    queries,
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      queries.push(q);
+      return rows
+        .filter(
+          (r) =>
+            (q.processInstanceKey == null || r.processInstanceKey === q.processInstanceKey) &&
+            (q.scopeKey == null || r.scopeKey === q.scopeKey) &&
+            (q.name == null || r.name === q.name),
+        )
+        .slice(0, pageSize);
+    },
+  } as any;
+}
+
+function v(pk: string, name: string, value: unknown, scopeKey = pk) {
+  return { name, value: JSON.stringify(value), processInstanceKey: pk, scopeKey };
+}
+
+test("PR #937: an active PR's policy cut off the first engine page is still read (targeted fallback)", async () => {
+  const rows = [];
+  // 50 unrelated (completed/other) instances fill the single page ahead of the active PR.
+  for (let i = 0; i < 50; i++) {
+    for (const n of ["autoMerge", "convergeOnly", "humanApproval"]) rows.push(v(`OTHER-${i}`, n, true));
+  }
+  rows.push(v("PI-1", "autoMerge", false), v("PI-1", "convergeOnly", true), v("PI-1", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+  assertEquals(res.body.prs[0].merge.requested, false, "autoMerge:false beyond page 1 must not degrade to requested");
+  const withApproval = pagedEngine(
+    [...rows.filter((r) => r.processInstanceKey !== "PI-1"), v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true)],
+    10,
+  );
+  const res2 = (await handler(input(), { ...memApp([prRow936(1)]), engine: withApproval } as AppApi)) as any;
+  assertEquals(res2.body.prs[0].merge.blockedBy != null, true, "the human-approval blocker beyond page 1 is not dropped");
+});
+
+for (const order of ["root-first", "child-first"] as const) {
+  test(`PR #937: child-scoped policy vars never override the root policy (${order})`, async () => {
+    const root = [v("PI-1", "autoMerge", false), v("PI-1", "humanApproval", true)];
+    const child = [v("PI-1", "autoMerge", true, "EI-9"), v("PI-1", "humanApproval", false, "EI-9")];
+    const engine = pagedEngine(order === "root-first" ? [...root, ...child] : [...child, ...root], 100);
+    const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+    assertEquals(res.body.prs[0].merge.requested, false);
+    const engine2 = pagedEngine(
+      order === "root-first"
+        ? [v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true), ...child]
+        : [...child, v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true)],
+      100,
+    );
+    const res2 = (await handler(input(), { ...memApp([prRow936(1)]), engine: engine2 } as AppApi)) as any;
+    assertEquals(res2.body.prs[0].merge.blockedBy != null, true, "a child humanApproval:false cannot hide the root gate");
+  });
+}
+
+test("PR #937: no engine read when no active row has a process key", async () => {
+  const engine = pagedEngine([], 100);
+  await handler(input(), { ...memApp([]), engine } as AppApi);
+  await handler(input(), { ...memApp([{ ...prRow936(1), process_key: null }]), engine } as AppApi);
+  assertEquals(engine.queries.length, 0);
+});
+
+// ── PR #937 round-3 review: bounded fallback fan-out, per-instance failure isolation ─────────
+
+test("PR #937 r4: populated merge-loop roots cost a constant 3 reads (startMerge seeds the policy)", async () => {
+  // Round-3 defect: merge-loop roots carry non-policy vars, so the name-less fallback was non-empty
+  // and each merging PR paid 1 + 3 probes (19 calls at N=4). startMerge now seeds the policy triple,
+  // so populated merge-loop roots are fully represented in the batch and need no probes.
+  const N = 4;
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  const vars = [];
+  for (let i = 1; i <= N; i++) {
+    const pk = `PI-${i}`;
+    vars.push(v(pk, "repo", "o/r"), v(pk, "prNumber", i), v(pk, "ciFixRound", 0));
+    vars.push(v(pk, "autoMerge", true), v(pk, "convergeOnly", false), v(pk, "humanApproval", false));
+  }
+  const engine = pagedEngine(vars, 100);
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  assertEquals(res.body.count, N);
+  assertEquals(engine.queries.length, 3, "populated merge-loop roots need no per-instance probes");
+});
+
+test("PR #937 r4: a name cut from ONE page is re-probed even when the instance appears in another", async () => {
+  // Round-3 defect: an instance present in the autoMerge page was treated as complete, so a
+  // humanApproval:true cut from its own page was dropped and /status reported an unblocked merge.
+  const rows = [v("PI-1", "autoMerge", true), v("PI-1", "convergeOnly", false)];
+  for (let i = 0; i < 20; i++) rows.push(v(`OTHER-${i}`, "humanApproval", false));
+  rows.push(v("PI-1", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+  assertEquals(res.body.prs[0].merge.blockedBy, "human-approval", "the cut humanApproval gate is recovered");
+  const targeted = engine.queries.filter((q: any) => q.processInstanceKey === "PI-1");
+  assertEquals(targeted.length, 1, "only the missing name is probed");
+  assertEquals(targeted[0].name, "humanApproval");
+  assertEquals(targeted[0].scopeKey, "PI-1", "the probe is confined to the process-root scope");
+});
+
+test("PR #937 r4: a failed probe after a partial batch drops the partial entry (default, not half-read)", async () => {
+  const failing = {
+    searchVariables: async (q: { processInstanceKey?: string; name?: string }) => {
+      if (q.processInstanceKey === "PI-1") throw new Error("engine read timed out");
+      if (q.name === "humanApproval") return [v("PI-1", "humanApproval", true)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+});
+
+test("PR #937 r4: a cut-off instance is recovered with name-filtered (untruncatable) root probes", async () => {
+  const rows = [];
+  for (let i = 0; i < 50; i++) {
+    for (const n of ["autoMerge", "convergeOnly", "humanApproval"]) rows.push(v(`OTHER-${i}`, n, true));
+  }
+  rows.push(v("PI-1", "autoMerge", true), v("PI-1", "convergeOnly", false));
+  rows.push(v("PI-2", "autoMerge", true), v("PI-2", "convergeOnly", false), v("PI-2", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1), prRow936(2)]), engine } as AppApi)) as any;
+  const pr2 = res.body.prs.find((p: any) => p.prKey === "o/r#2");
+  assertEquals(pr2.merge.requested, true);
+  assertEquals(pr2.merge.blockedBy, "human-approval");
+  for (const q of engine.queries.filter((q: any) => q.processInstanceKey != null)) {
+    assert(q.name != null, "every fallback read is name-filtered (<=1 row, cannot be truncated)");
+    assertEquals(q.scopeKey, q.processInstanceKey);
+  }
+});
+
+test("PR #937 r3: one failed targeted read degrades only its own instance, not every other PR's policy", async () => {
+  // Round-2 defect: a rejected targeted read propagated to the OUTER catch, so the whole batch
+  // read was discarded and PI-1's already-fetched policy silently degraded to "merge requested,
+  // no approval blocker". Each instance's fallback must fail independently. PI-1 requests the
+  // merge AND carries an outstanding approval gate; PI-2's fallback rejects.
+  const failing = {
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      if (q.processInstanceKey === "PI-2") throw new Error("engine read timed out");
+      if (q.name === "autoMerge") return [v("PI-1", "autoMerge", true)];
+      if (q.name === "humanApproval") return [v("PI-1", "humanApproval", true)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1), prRow936(2)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  const pr1 = res.body.prs.find((p: any) => p.prKey === "o/r#1");
+  assertEquals(pr1.merge.requested, true, "PI-1's fetched merge intent survives PI-2's failed fallback");
+  assertEquals(pr1.merge.blockedBy, "human-approval", "PI-1's fetched approval blocker survives PI-2's failed fallback");
+  const pr2 = res.body.prs.find((p: any) => p.prKey === "o/r#2");
+  assertEquals(pr2.merge.requested, true, "the failed instance degrades to the historical default (merge requested)");
+  assertEquals(pr2.merge.blockedBy, null, "the failed instance shows no approval blocker it could not verify");
+});
+
+test("PR #937 r3: a failed BATCH read still degrades every row to the default (no partial page)", async () => {
+  // The batched name reads are the completeness backbone — if one rejects, its page is partial
+  // and absence can no longer be distinguished from a page cut, so the whole projection degrades.
+  const failing = {
+    searchVariables: async (q: { name?: string }) => {
+      if (q.name === "humanApproval") throw new Error("engine read timed out");
+      if (q.name === "autoMerge") return [v("PI-1", "autoMerge", false)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+});

package/operations/listActivePrs.ts

@@ -20,9 +20,29 @@ export default defineOperation("listActivePrs", async ({ req }, app) => {
     app.log.warn("listActivePrs rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
+  // Per-phase timing (issue #936): /status regressed to ~13 s (and serialised concurrent callers
+  // into proxy 502s) on an unprofiled per-row engine fan-out. The merge-policy engine read is now
+  // ONE batched call inside `activePrs`, and these phase timings make any future regression
+  // attributable from the logs instead of rediscovered by hand. Debug level: /status is a hot
+  // polling endpoint, so this must not spam info.
+  const t0 = Date.now();
   const [prs, deliveries] = await Promise.all([activePrs(app.data, app.engine), activeDeliveries(app.data)]);
+  const readMs = Date.now() - t0;
   // The running app's identity, derived from the SAME app/version.ts getter /version uses (never
   // re-read), so the endpoint everyone polls answers "is the fix live?" in one call (issue #925).
   const { version, gitSha } = buildVersionInfo();
+  app.log.debug("listActivePrs served", {
+    ms: readMs,
+    prRows: prs.length,
+    deliveryRows: deliveries.length,
+  });
+  if (readMs > STATUS_SLOW_MS) {
+    app.log.warn("listActivePrs slow", { ms: readMs, prRows: prs.length, deliveryRows: deliveries.length });
+  }
   return { status: 200, body: { count: prs.length, prs, deliveries, version: { version, gitSha } } };
 });
+
+/** The wall-clock budget over which a /status serve is logged as slow (issue #936). The endpoint
+ *  targets well under 1 s for a handful of rows; anything past this is a regression signal an
+ *  operator can grep for. */
+const STATUS_SLOW_MS = 1_000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.208.1",
+  "version": "0.208.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",