@nanobpm/nano-workforce 0.208.1 → 0.208.3

package/app/terminalReaderBehaviour.test.ts

@@ -104,6 +104,10 @@ test("submitPr re-opens a derive-only-terminated PR (base 'converging', derived
           status: "converging", // base transient FROZEN — reconciler no longer writes the terminal
           derived_status: "abandoned", // ADR-0065 derive-only terminal
           current_round: 3,
+          // A PRIOR run's operator Dismiss + provenance must not survive the reopen (PR #944 review).
+          acknowledged_at: "2024-01-05",
+          termination_reason: "operator cancel",
+          termination_process_key: "PI-1",
         }],
         key: "pr_key",
       },
@@ -126,24 +130,31 @@ test("submitPr re-opens a derive-only-terminated PR (base 'converging', derived
     assertEquals(pr.status, "converging");
     assertEquals(pr.current_round, 1); // re-opened for a fresh run
     assertEquals(pr.process_key, "PI-9");
+    assertEquals(pr.acknowledged_at, null, "a prior run's Dismiss never acknowledges this run's orphaning");
+    assertEquals(pr.termination_reason, null);
+    assertEquals(pr.termination_process_key, null);
   });
 });
 
-// #503 / #497 phantom: `activePrs` filters on `derived_status`, so a derive-only-terminated PR drops
-// off the Convergence tab instead of showing "active" indefinitely.
-test("activePrs excludes a derive-only-terminated PR and keeps a genuinely active one", async () => {
+// #503 / #497 phantom: `activePrs` classifies on `derived_status`, so a derive-only-terminated PR never
+// reads as its frozen in-flight base status. Issue #943: if NO reason was recorded for the termination
+// (an orphan) it is surfaced as `orphaned` rather than silently dropped; a recorded reason or an
+// operator Dismiss (`acknowledged_at`) excludes it.
+test("activePrs never reports a derive-only-terminated PR as active — orphaned if unexplained, excluded if explained/dismissed", async () => {
   const stores: Stores = {
     pull_requests: {
       rows: [
         { pr_key: "o/r#1", repo: "o/r", number: 1, url: "u1", status: "converging", derived_status: "abandoned", current_round: 2, updated_at: "2024-01-02" },
         { pr_key: "o/r#2", repo: "o/r", number: 2, url: "u2", status: "converging", derived_status: "converging", current_round: 1, updated_at: "2024-01-01" },
+        { pr_key: "o/r#3", repo: "o/r", number: 3, url: "u3", status: "converging", derived_status: "abandoned", process_key: "PI-3", termination_reason: "operator cancel", termination_process_key: "PI-3", current_round: 1, updated_at: "2024-01-03" },
+        { pr_key: "o/r#4", repo: "o/r", number: 4, url: "u4", status: "converging", derived_status: "abandoned", acknowledged_at: "2024-01-05", current_round: 1, updated_at: "2024-01-04" },
       ],
       key: "pr_key",
     },
     escalations: { rows: [], key: "id" },
   };
   const active = await activePrs(memData(stores));
-  assertEquals(active.map((p) => p.prKey), ["o/r#2"]);
+  assertEquals(active.map((p) => [p.prKey, p.status]), [["o/r#1", "orphaned"], ["o/r#2", "converging"]]);
 });
 
 // #503: `pollIncidentsImpl` classifies a dead instance on `derived_status`, so a derive-only-terminated

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.208.1",
-  "gitSha": "9080010a73e54c922991be86b54d3f76a1b264e8",
-  "gitTag": "v0.208.1",
-  "builtAt": "2026-11-10T07:05:28.202Z"
+  "version": "0.208.3",
+  "gitSha": "ff42e2a6fa77fd780949822adf3d4f2b9caefc38",
+  "gitTag": "v0.208.3",
+  "builtAt": "2026-11-11T02:35:58.462Z"
 }

package/db/migrations/130_pull_requests_termination_reason.sql

@@ -0,0 +1,17 @@
+-- Loop-termination provenance (issue #943). A merge loop was terminated in-app (the waiting-merge →
+-- convergence hand-off) with no successor and no escalation, and nothing on the row said why — the PR
+-- silently dropped off `/status`. Every APP-INITIATED cancel of a PR's convergence/merge loop now
+-- stamps a one-line reason here (via `terminatePrLoop` in app/service.ts), naming the outcome it
+-- led to (a successor convergence instance, or the PR's terminal GitHub state). NULL when the current
+-- run was never cancelled by the app. `/status` surfaces it, and an `orphaned` overlay flags a PR
+-- whose loop ended with NO recorded reason, no successor and no escalation.
+ALTER TABLE pull_requests ADD COLUMN termination_reason TEXT;
+
+-- The instance the reason describes (PR #944 review): provenance is bound to the CANCELLED instance and
+-- only explains a termination while it equals the row's `process_key`, so a predecessor's reason can
+-- never mask the later orphaning of a successor.
+ALTER TABLE pull_requests ADD COLUMN termination_process_key TEXT;
+
+-- A handed-off predecessor merge loop whose retirement has not yet succeeded (PR #944 review): durable
+-- so the poller retries it every pass instead of dropping the key. NULL when nothing is pending.
+ALTER TABLE pull_requests ADD COLUMN retire_pending_key TEXT;

package/db/migrations/131_pull_requests_read_model_termination_reason.sql

@@ -0,0 +1,48 @@
+-- Re-create the `pull_requests_read_model` VIEW so it re-exports the new base column (the VIEW must pass
+-- through EVERY base `pull_requests` column — app/pullRequestReadModel.test.ts DRIFT GUARD). A mechanical
+-- re-emission of 128 with `termination_reason` added; the derived columns are emitted VERBATIM from
+-- app/pullRequestReadModel.ts and are unchanged. No BEGIN/COMMIT (the runner wraps each file). Numbered after 130.
+
+DROP VIEW IF EXISTS pull_requests_read_model;
+
+CREATE VIEW pull_requests_read_model AS
+SELECT
+  pr.pr_key AS pr_key,
+  pr.repo AS repo,
+  pr.number AS number,
+  pr.url AS url,
+  pr.title AS title,
+  COALESCE(pr.derived_status, pr.status) AS status,
+  pr.current_round AS current_round,
+  pr.process_key AS process_key,
+  pr.waiting_since AS waiting_since,
+  pr.last_review_id AS last_review_id,
+  pr.outcome AS outcome,
+  pr.created_at AS created_at,
+  pr.updated_at AS updated_at,
+  pr.converged_at AS converged_at,
+  pr.merged_at AS merged_at,
+  pr.active_worker AS active_worker,
+  pr.lease_until AS lease_until,
+  pr.last_nudge_at AS last_nudge_at,
+  pr.fresh_head_run_head AS fresh_head_run_head,
+  pr.abandon_token AS abandon_token,
+  pr.incident_key AS incident_key,
+  pr.incident_type AS incident_type,
+  pr.incident_since AS incident_since,
+  pr.incident_message AS incident_message,
+  pr.last_round_head AS last_round_head,
+  pr.last_progress_job_key AS last_progress_job_key,
+  pr.last_progress_result AS last_progress_result,
+  pr.last_progress_agent_watermark AS last_progress_agent_watermark,
+  pr.churn_escalated_round AS churn_escalated_round,
+  pr.root_request_key AS root_request_key,
+  pr.epic_phase_label AS epic_phase_label,
+  pr.acknowledged_at AS acknowledged_at,
+  pr.auto_resolve_escalations AS auto_resolve_escalations,
+  pr.termination_reason AS termination_reason,
+  pr.termination_process_key AS termination_process_key,
+  pr.retire_pending_key AS retire_pending_key,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND (NOT COALESCE(COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open
+FROM pull_requests__tracking pr;

package/openapi.yaml

@@ -94,7 +94,15 @@ components:
         - autoResolveEscalations
         - merge
         - incident
+        - terminationReason
       properties:
+        terminationReason:
+          type: string
+          nullable: true
+          description: >-
+            Why the app (or an operator) last cancelled this PR's current loop instance (issue #943),
+            naming the successor/outcome; null when never. An `orphaned` status means the loop ended
+            with no recorded reason, successor, or escalation.
         prKey:
           type: string
         repo:
@@ -4357,6 +4365,51 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorBody"
+  /actions/cancel-pr:
+    post:
+      operationId: cancelPrRun
+      # x-mcp exclusion: the page-only twin of `cancelInstance` (the per-row Cancel button). Agents use
+      # the guarded `/actions/cancel` door.
+      x-mcp:
+        exclude: true
+      summary: "Page-facing record-consistent cancel (issue #943): identical to `cancelInstance` (shared implementation, records termination provenance) but unguarded, because the declarative page action cannot attach x-hook-secret (see operations/cancelPrRun.ts)."
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CancelInstanceIntent"
+      responses:
+        "200":
+          description: The instance was terminated; its record derives/flips to `abandoned` and drops out of `listActivePrs`.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CancelInstanceResult"
+        "400":
+          description: Missing/invalid `processInstanceKey`.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorBody"
+        "404":
+          description: "No tracked record owns the key (a clean no-op — the engine is never touched). Body is a CancelInstanceResult with `ok:false`, `state:\"gone\"`, `reconciled:0`."
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CancelInstanceResult"
+        "502":
+          description: "The cancel did not fully take: EITHER the engine did NOT stop the instance (the cancel was not committed; the run may still be live), OR the engine stopped it but the tracked record did not settle to a terminal edge (`ok:false`, `reconciled:0`) — a wedged record the caller must not read as done."
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CancelInstanceResult"
+        "503":
+          description: The app has no data source configured, so the cancel cannot be reconciled into the record.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorBody"
   /actions/incident/retry:
     post:
       operationId: retryIncident

package/operations/cancelInstance.test.ts

@@ -293,3 +293,12 @@ test("record routing also covers PR/plan aggregates (a resolved pull_requests ke
   assertEquals(res.body.ok, true);
   assertEquals(res.body.reconciled, 1);
 });
+
+test("PR#944: operator-cancel provenance is recorded even when the record fails to reconcile (502)", async () => {
+  const rows: any[] = [{ pr_key: "o/r#4", process_key: "400", status: "converging" }];
+  const { app } = makeRecordApp({ pull_requests: { rows, key: "pr_key" } }, { readBackState: "TERMINATED" });
+  const res = await call(app, { processInstanceKey: "400" });
+  assertEquals(res.status, 502, "the unreconciled record still surfaces as 502");
+  assertEquals(rows[0].termination_process_key, "400", "provenance is stamped once the engine confirms termination");
+  assert(typeof rows[0].termination_reason === "string" && rows[0].termination_reason.length > 0);
+});

package/operations/cancelInstance.ts

@@ -37,9 +37,12 @@
 // door, when NANO_PR_WEBHOOK_SECRET is set callers must present it via the x-hook-secret header —
 // mirroring `reconcileEngineState`/`agentCompleteEscalation`.
 
+import type { AppApi } from "@nanobpm/urban";
 import { cancelInstanceReconciling } from "@nanobpm/urban";
 import { engineBackedBindings, resolveTrackedInstance } from "../app/instanceTracking.ts";
+import { recordOperatorCancelProvenance } from "../app/service.ts";
 import { envVar } from "../app/version.ts";
+import type { CancelInstanceResponse } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
 
 const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
@@ -49,6 +52,17 @@ export default defineOperation("cancelInstance", async ({ req, body }, app) => {
     app.log.warn("cancelInstance rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
+  return cancelTrackedRun(app, body, "/actions/cancel");
+});
+
+/** The ONE record-consistent cancel implementation shared by every cancel door (this guarded API/MCP
+ * door and the unguarded page door `/actions/cancel-pr`, operations/cancelPrRun.ts), so both stamp
+ * termination provenance (issue #943, PR #944 review) and neither can drift. Auth stays per door. */
+export async function cancelTrackedRun(
+  app: AppApi,
+  body: unknown,
+  door: string,
+): Promise<{ status: number; body: CancelInstanceResponse }> {
   if (!app.data) {
     app.log.warn("cancelInstance: no data source configured — cannot reconcile the record");
     return { status: 503, body: { error: "no data source configured" } };
@@ -58,7 +72,7 @@ export default defineOperation("cancelInstance", async ({ req, body }, app) => {
   // so a numeric JSON value would already have lost precision before it reached us — accepting it
   // (and coercing it back to a string) would silently cancel the wrong instance and also contradicts
   // the OpenAPI `string` contract. Reject a non-string with a 400 rather than coerce.
-  const raw = body && typeof body === "object" ? body.processInstanceKey : undefined;
+  const raw = body && typeof body === "object" && "processInstanceKey" in body ? body.processInstanceKey : undefined;
   const processInstanceKey = typeof raw === "string" ? raw.trim() : "";
   if (!processInstanceKey) {
     return { status: 400, body: { error: "processInstanceKey is required and must be a string" } };
@@ -124,6 +138,17 @@ export default defineOperation("cancelInstance", async ({ req, body }, app) => {
   // delta lies. Re-read the resolved record and count it reconciled only when its ADR-0065
   // `derived_status` has LEFT its `activeStatuses` (become terminal → resubmittable). When we cannot
   // read the record (no default source), trust the primitive's own count.
+  // Termination provenance (issue #943): a deliberate operator cancel of a PR loop is NOT an orphan —
+  // stamp the reason (as soon as the ENGINE confirms termination, before
+  // the record re-read — a 502 on an unreconciled record must not lose it; PR #944 review) on the owning PR row so `/status` does not flag it `orphaned`. Best-effort.
+  if (canResolveRecord) {
+    try {
+      await recordOperatorCancelProvenance(app.data, processInstanceKey, door);
+    } catch (err) {
+      app.log.warn("cancelInstance: could not record termination reason", { processInstanceKey, error: String(err) });
+    }
+  }
+
   let reconciled = result.reconciled;
   let recordReconciled = true;
   if (canResolveRecord) {
@@ -163,4 +188,5 @@ export default defineOperation("cancelInstance", async ({ req, body }, app) => {
     reconciled,
   });
   return { status: 200, body: responseBody };
-});
+}
+

package/operations/cancelPrRun.ts

@@ -0,0 +1,16 @@
+// POST /app/api/actions/cancel-pr → operationId `cancelPrRun` (issue #943, PR #944 review).
+//
+// The page-facing twin of `cancelInstance` for the per-row Cancel button. The runtime's built-in
+// `/app/actions/cancel` page action bypassed the app's termination-provenance write, so a deliberate
+// UI cancel left an in-flight base status with no reason and `/status` reported it `orphaned`. Both
+// doors now route through ONE implementation (`cancelTrackedRun`), which stamps provenance.
+//
+// Auth posture is preserved: like the built-in page action it replaces (and `retryIncident`), this
+// door is INTENTIONALLY UNGUARDED by NANO_PR_WEBHOOK_SECRET — the `@nanobpm/urban` page runtime cannot
+// attach x-hook-secret, so a guard would 401 every button press on a secured deployment. The guarded
+// `/actions/cancel` stays the API/MCP door; this one is excluded from MCP (`x-mcp`).
+
+import { defineOperation } from "../nano-generated/operations.ts";
+import { cancelTrackedRun } from "./cancelInstance.ts";
+
+export default defineOperation("cancelPrRun", async ({ body }, app) => cancelTrackedRun(app, body, "/actions/cancel-pr"));

package/operations/listActivePrs.test.ts

@@ -189,3 +189,292 @@ test("a delivery run with no opt-in row flag surfaces autoResolveEscalations fal
   assertEquals(res.body.deliveries[0].openEscalation, null);
   assertEquals(res.body.deliveries[0].processKey, null, "a launch-in-flight run has no stamped process_key yet");
 });
+
+// ── Issue #936: /status latency + concurrency regression guard ────────────────────────────────
+// The defect: `activePrs` fanned the merge-policy read out per row — 3 `searchVariables` engine
+// round-trips PER active PR — so 4 rows cost 12 sequential-ish upstream calls (~13 s) and K
+// concurrent callers stacked (~50 s → the console proxy 502'd). The fix batches the engine read:
+// ONE name-less `searchVariables({})` per /status serve, bucketed in memory. These tests pin the
+// contract against a fake engine with a REALISTIC per-call delay: the engine-call count must stay
+// at one per serve regardless of row count, and K concurrent serves must overlap (wall time ≈ one
+// upstream round-trip, not K ×).
+
+/** A fake engine that serves the batched variable read after a realistic upstream delay, counting
+ *  calls and tracking peak in-flight concurrency. */
+function slowEngine(varsByInstance: Record<string, Record<string, unknown>>, delayMs: number) {
+  let calls = 0;
+  let inFlight = 0;
+  let maxInFlight = 0;
+  return {
+    calls: () => calls,
+    maxInFlight: () => maxInFlight,
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      calls += 1;
+      inFlight += 1;
+      maxInFlight = Math.max(maxInFlight, inFlight);
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      inFlight -= 1;
+      const rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[] = [];
+      for (const [piKey, vars] of Object.entries(varsByInstance)) {
+        if (q.processInstanceKey != null && piKey !== String(q.processInstanceKey)) continue;
+        if (q.scopeKey != null && piKey !== String(q.scopeKey)) continue;
+        for (const [name, v] of Object.entries(vars)) {
+          if (q.name != null && name !== q.name) continue;
+          rows.push({ name, value: JSON.stringify(v), processInstanceKey: piKey, scopeKey: piKey });
+        }
+      }
+      return rows;
+    },
+  } as any;
+}
+
+function prRow936(n: number) {
+  return {
+    pr_key: `o/r#${n}`,
+    repo: "o/r",
+    number: n,
+    url: `https://github.com/o/r/pull/${n}`,
+    title: `PR ${n}`,
+    status: "converging",
+    current_round: 1,
+    process_key: `PI-${n}`,
+    updated_at: `2026-01-${String(n).padStart(2, "0")}`,
+  };
+}
+
+test("issue #936: N active rows cost a constant 3 engine variable reads, not 3N (the 13 s fan-out)", async () => {
+  const N = 8;
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  const vars: Record<string, Record<string, unknown>> = {};
+  for (let i = 1; i <= N; i++) vars[`PI-${i}`] = { autoMerge: true, convergeOnly: false, humanApproval: false };
+  const engine = slowEngine(vars, 25);
+  const app = { ...memApp(rows), engine } as AppApi;
+  const started = Date.now();
+  const res = (await handler(input(), app)) as any;
+  const elapsed = Date.now() - started;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.count, N);
+  assertEquals(
+    engine.calls(),
+    3,
+    "the merge-policy projection batches to ONE read per policy name (3) per serve — a per-row fan-out would show 3N calls",
+  );
+  assert(
+    elapsed < 25 * N,
+    `one batched ~25 ms upstream read serves ${N} rows (took ${elapsed} ms); the per-row fan-out this regresses to would take ≥ ${25 * N} ms`,
+  );
+  // The batch still projects the per-row policy correctly.
+  for (const pr of res.body.prs) {
+    assertEquals(pr.merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  }
+});
+
+test("issue #936: K concurrent /status callers overlap instead of queueing behind each other", async () => {
+  const K = 4;
+  const rows = [prRow936(1), prRow936(2)];
+  const vars = {
+    "PI-1": { autoMerge: true, convergeOnly: false, humanApproval: false },
+    "PI-2": { autoMerge: false, convergeOnly: true, humanApproval: false },
+  };
+  // A realistic slow upstream: each engine read takes 100 ms. Serialized callers would stack to
+  // K × 100 ms (the measured 35–50 s at production scale); overlapped callers finish in ~100 ms.
+  const engine = slowEngine(vars, 100);
+  const app = { ...memApp(rows), engine } as AppApi;
+  const started = Date.now();
+  const results = await Promise.all(Array.from({ length: K }, () => handler(input(), app)));
+  const elapsed = Date.now() - started;
+  for (const res of results) {
+    assertEquals((res as any).status, 200);
+    assertEquals((res as any).body.count, 2);
+  }
+  assertEquals(engine.calls(), 3 * K, "each serve issues its own batched reads (no cross-request cache serving stale policy)");
+  assertEquals(
+    engine.maxInFlight(),
+    3 * K,
+    "all K engine reads were in flight at once — the serves overlap rather than serialise",
+  );
+  assert(
+    elapsed < K * 100,
+    `${K} concurrent serves over a 100 ms upstream finished in ${elapsed} ms (< ${K * 100} ms) — no caller queued behind another`,
+  );
+  // Mixed intents still project per row under the batched read.
+  const body = (results[0] as any).body;
+  assertEquals(body.prs.find((p: any) => p.prKey === "o/r#1").merge.requested, true);
+  assertEquals(body.prs.find((p: any) => p.prKey === "o/r#2").merge.requested, false);
+});
+
+// ── PR #937 review: completeness, root scope, idle skip ──────────────────────────────────────
+
+/** A fake engine with explicit rows (incl. child scopes) whose engine-wide reads are cut to one
+ *  `pageSize` page — the production seam returns a single page with no cursor. */
+function pagedEngine(
+  rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[],
+  pageSize: number,
+) {
+  const queries: { processInstanceKey?: string; scopeKey?: string; name?: string }[] = [];
+  return {
+    queries,
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      queries.push(q);
+      return rows
+        .filter(
+          (r) =>
+            (q.processInstanceKey == null || r.processInstanceKey === q.processInstanceKey) &&
+            (q.scopeKey == null || r.scopeKey === q.scopeKey) &&
+            (q.name == null || r.name === q.name),
+        )
+        .slice(0, pageSize);
+    },
+  } as any;
+}
+
+function v(pk: string, name: string, value: unknown, scopeKey = pk) {
+  return { name, value: JSON.stringify(value), processInstanceKey: pk, scopeKey };
+}
+
+test("PR #937: an active PR's policy cut off the first engine page is still read (targeted fallback)", async () => {
+  const rows = [];
+  // 50 unrelated (completed/other) instances fill the single page ahead of the active PR.
+  for (let i = 0; i < 50; i++) {
+    for (const n of ["autoMerge", "convergeOnly", "humanApproval"]) rows.push(v(`OTHER-${i}`, n, true));
+  }
+  rows.push(v("PI-1", "autoMerge", false), v("PI-1", "convergeOnly", true), v("PI-1", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+  assertEquals(res.body.prs[0].merge.requested, false, "autoMerge:false beyond page 1 must not degrade to requested");
+  const withApproval = pagedEngine(
+    [...rows.filter((r) => r.processInstanceKey !== "PI-1"), v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true)],
+    10,
+  );
+  const res2 = (await handler(input(), { ...memApp([prRow936(1)]), engine: withApproval } as AppApi)) as any;
+  assertEquals(res2.body.prs[0].merge.blockedBy != null, true, "the human-approval blocker beyond page 1 is not dropped");
+});
+
+for (const order of ["root-first", "child-first"] as const) {
+  test(`PR #937: child-scoped policy vars never override the root policy (${order})`, async () => {
+    const root = [v("PI-1", "autoMerge", false), v("PI-1", "humanApproval", true)];
+    const child = [v("PI-1", "autoMerge", true, "EI-9"), v("PI-1", "humanApproval", false, "EI-9")];
+    const engine = pagedEngine(order === "root-first" ? [...root, ...child] : [...child, ...root], 100);
+    const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+    assertEquals(res.body.prs[0].merge.requested, false);
+    const engine2 = pagedEngine(
+      order === "root-first"
+        ? [v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true), ...child]
+        : [...child, v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true)],
+      100,
+    );
+    const res2 = (await handler(input(), { ...memApp([prRow936(1)]), engine: engine2 } as AppApi)) as any;
+    assertEquals(res2.body.prs[0].merge.blockedBy != null, true, "a child humanApproval:false cannot hide the root gate");
+  });
+}
+
+test("PR #937: no engine read when no active row has a process key", async () => {
+  const engine = pagedEngine([], 100);
+  await handler(input(), { ...memApp([]), engine } as AppApi);
+  await handler(input(), { ...memApp([{ ...prRow936(1), process_key: null }]), engine } as AppApi);
+  assertEquals(engine.queries.length, 0);
+});
+
+// ── PR #937 round-3 review: bounded fallback fan-out, per-instance failure isolation ─────────
+
+test("PR #937 r4: populated merge-loop roots cost a constant 3 reads (startMerge seeds the policy)", async () => {
+  // Round-3 defect: merge-loop roots carry non-policy vars, so the name-less fallback was non-empty
+  // and each merging PR paid 1 + 3 probes (19 calls at N=4). startMerge now seeds the policy triple,
+  // so populated merge-loop roots are fully represented in the batch and need no probes.
+  const N = 4;
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  const vars = [];
+  for (let i = 1; i <= N; i++) {
+    const pk = `PI-${i}`;
+    vars.push(v(pk, "repo", "o/r"), v(pk, "prNumber", i), v(pk, "ciFixRound", 0));
+    vars.push(v(pk, "autoMerge", true), v(pk, "convergeOnly", false), v(pk, "humanApproval", false));
+  }
+  const engine = pagedEngine(vars, 100);
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  assertEquals(res.body.count, N);
+  assertEquals(engine.queries.length, 3, "populated merge-loop roots need no per-instance probes");
+});
+
+test("PR #937 r4: a name cut from ONE page is re-probed even when the instance appears in another", async () => {
+  // Round-3 defect: an instance present in the autoMerge page was treated as complete, so a
+  // humanApproval:true cut from its own page was dropped and /status reported an unblocked merge.
+  const rows = [v("PI-1", "autoMerge", true), v("PI-1", "convergeOnly", false)];
+  for (let i = 0; i < 20; i++) rows.push(v(`OTHER-${i}`, "humanApproval", false));
+  rows.push(v("PI-1", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine } as AppApi)) as any;
+  assertEquals(res.body.prs[0].merge.blockedBy, "human-approval", "the cut humanApproval gate is recovered");
+  const targeted = engine.queries.filter((q: any) => q.processInstanceKey === "PI-1");
+  assertEquals(targeted.length, 1, "only the missing name is probed");
+  assertEquals(targeted[0].name, "humanApproval");
+  assertEquals(targeted[0].scopeKey, "PI-1", "the probe is confined to the process-root scope");
+});
+
+test("PR #937 r4: a failed probe after a partial batch drops the partial entry (default, not half-read)", async () => {
+  const failing = {
+    searchVariables: async (q: { processInstanceKey?: string; name?: string }) => {
+      if (q.processInstanceKey === "PI-1") throw new Error("engine read timed out");
+      if (q.name === "humanApproval") return [v("PI-1", "humanApproval", true)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+});
+
+test("PR #937 r4: a cut-off instance is recovered with name-filtered (untruncatable) root probes", async () => {
+  const rows = [];
+  for (let i = 0; i < 50; i++) {
+    for (const n of ["autoMerge", "convergeOnly", "humanApproval"]) rows.push(v(`OTHER-${i}`, n, true));
+  }
+  rows.push(v("PI-1", "autoMerge", true), v("PI-1", "convergeOnly", false));
+  rows.push(v("PI-2", "autoMerge", true), v("PI-2", "convergeOnly", false), v("PI-2", "humanApproval", true));
+  const engine = pagedEngine(rows, 10);
+  const res = (await handler(input(), { ...memApp([prRow936(1), prRow936(2)]), engine } as AppApi)) as any;
+  const pr2 = res.body.prs.find((p: any) => p.prKey === "o/r#2");
+  assertEquals(pr2.merge.requested, true);
+  assertEquals(pr2.merge.blockedBy, "human-approval");
+  for (const q of engine.queries.filter((q: any) => q.processInstanceKey != null)) {
+    assert(q.name != null, "every fallback read is name-filtered (<=1 row, cannot be truncated)");
+    assertEquals(q.scopeKey, q.processInstanceKey);
+  }
+});
+
+test("PR #937 r3: one failed targeted read degrades only its own instance, not every other PR's policy", async () => {
+  // Round-2 defect: a rejected targeted read propagated to the OUTER catch, so the whole batch
+  // read was discarded and PI-1's already-fetched policy silently degraded to "merge requested,
+  // no approval blocker". Each instance's fallback must fail independently. PI-1 requests the
+  // merge AND carries an outstanding approval gate; PI-2's fallback rejects.
+  const failing = {
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      if (q.processInstanceKey === "PI-2") throw new Error("engine read timed out");
+      if (q.name === "autoMerge") return [v("PI-1", "autoMerge", true)];
+      if (q.name === "humanApproval") return [v("PI-1", "humanApproval", true)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1), prRow936(2)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  const pr1 = res.body.prs.find((p: any) => p.prKey === "o/r#1");
+  assertEquals(pr1.merge.requested, true, "PI-1's fetched merge intent survives PI-2's failed fallback");
+  assertEquals(pr1.merge.blockedBy, "human-approval", "PI-1's fetched approval blocker survives PI-2's failed fallback");
+  const pr2 = res.body.prs.find((p: any) => p.prKey === "o/r#2");
+  assertEquals(pr2.merge.requested, true, "the failed instance degrades to the historical default (merge requested)");
+  assertEquals(pr2.merge.blockedBy, null, "the failed instance shows no approval blocker it could not verify");
+});
+
+test("PR #937 r3: a failed BATCH read still degrades every row to the default (no partial page)", async () => {
+  // The batched name reads are the completeness backbone — if one rejects, its page is partial
+  // and absence can no longer be distinguished from a page cut, so the whole projection degrades.
+  const failing = {
+    searchVariables: async (q: { name?: string }) => {
+      if (q.name === "humanApproval") throw new Error("engine read timed out");
+      if (q.name === "autoMerge") return [v("PI-1", "autoMerge", false)];
+      return [];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+});

package/operations/listActivePrs.ts

@@ -20,9 +20,29 @@ export default defineOperation("listActivePrs", async ({ req }, app) => {
     app.log.warn("listActivePrs rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
+  // Per-phase timing (issue #936): /status regressed to ~13 s (and serialised concurrent callers
+  // into proxy 502s) on an unprofiled per-row engine fan-out. The merge-policy engine read is now
+  // ONE batched call inside `activePrs`, and these phase timings make any future regression
+  // attributable from the logs instead of rediscovered by hand. Debug level: /status is a hot
+  // polling endpoint, so this must not spam info.
+  const t0 = Date.now();
   const [prs, deliveries] = await Promise.all([activePrs(app.data, app.engine), activeDeliveries(app.data)]);
+  const readMs = Date.now() - t0;
   // The running app's identity, derived from the SAME app/version.ts getter /version uses (never
   // re-read), so the endpoint everyone polls answers "is the fix live?" in one call (issue #925).
   const { version, gitSha } = buildVersionInfo();
+  app.log.debug("listActivePrs served", {
+    ms: readMs,
+    prRows: prs.length,
+    deliveryRows: deliveries.length,
+  });
+  if (readMs > STATUS_SLOW_MS) {
+    app.log.warn("listActivePrs slow", { ms: readMs, prRows: prs.length, deliveryRows: deliveries.length });
+  }
   return { status: 200, body: { count: prs.length, prs, deliveries, version: { version, gitSha } } };
 });
+
+/** The wall-clock budget over which a /status serve is logged as slow (issue #936). The endpoint
+ *  targets well under 1 s for a handful of rows; anything past this is a regression signal an
+ *  operator can grep for. */
+const STATUS_SLOW_MS = 1_000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.208.1",
+  "version": "0.208.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/home.page.json

@@ -247,7 +247,7 @@
             "confirm": "Cancel this PR's review run?",
             "showWhenField": "process_key",
             "action": {
-              "path": "/app/actions/cancel",
+              "path": "/app/api/actions/cancel-pr",
               "body": {
                 "processInstanceKey": "{{row.process_key}}"
               }