@nanobpm/nano-workforce 0.208.3 → 0.208.5

package/app/service.ts

@@ -64,6 +64,7 @@ import { pollLineage } from "./lineage.ts";
 import { mergeableRepollInterval, mergeableWaitTimeout } from "./mergeableWait.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { mergeLandedWaitTimeout } from "./mergeLandedWait.ts";
+import { withMergePolicyLock } from "./mergePolicyLock.ts";
 import {
   freshHeadRunAction,
   headRunPresenceCount,
@@ -431,6 +432,16 @@ export interface PullRequest {
   // Operator Dismiss stamp (app/acknowledge.ts). Run-scoped: cleared on reopen so a dismissal of a
   // PRIOR run never hides an orphaning of the current one.
   acknowledged_at?: string | null;
+  // Durable merge-policy projection (132_pull_requests_merge_policy.sql, issue #947): the run's
+  // merge intent (`merge_requested` 0|1) and its decided merge-approval state
+  // (`merge_human_approval` NULL = outstanding/undecided, 0|1 once decided), stamped by the writers
+  // that already know them — `submitPr` (submit/reopen, and the gated-adopt `setVariables` branch),
+  // `completeUserTaskAttributed` (a `merge-approval` approve clears it to 0, app/agentCompletion.ts),
+  // and `startMerge` — so `/status` serves the policy from the app's own DB with ZERO engine reads.
+  // `merge_requested` NULL marks a row written before this projection existed; only those legacy
+  // rows fall back to the #937 batched engine read. Run-scoped: reset by the atomic reopen.
+  merge_requested?: number | null;
+  merge_human_approval?: number | null;
 }
 
 interface PrDependency {
@@ -742,8 +753,27 @@ async function submitPrCritical(
         (s) => String(s.processInstanceKey) === loopKey,
       );
       const state = match ? String(match.state ?? "").trim().toUpperCase() : null;
-      if (state !== null && !ENGINE_TERMINAL_STATES.has(state)) {
+      // Only the CONVERGENCE loop reads `humanApproval` (PR #950 review): mid-handoff `startMerge`
+      // has already re-pointed `process_key` at the merge-loop (and stamped its approval policy), so a
+      // key that resolves to any other definition must never be gated.
+      const isConvergenceLoop = match?.processDefinitionId == null || match.processDefinitionId === PROCESS_ID;
+      if (state !== null && !ENGINE_TERMINAL_STATES.has(state) && isConvergenceLoop) {
+        // Serialized with merge-approval completion on this loop (PR #950 review): the engine write
+        // and projection stamp form one pair, so an approval can never interleave between them.
+        await withMergePolicyLock(loopKey, async () => {
         await engine.setVariables({ scopeKey: loopKey, variables: { humanApproval: true } });
+        // Mirror the gate onto the durable /status projection (issue #947): the loop variable is
+        // the process's own copy; the row column is what `/status` reads without an engine
+        // round-trip. NULL would read as "outstanding" too, but stamping 1 keeps the projection
+        // explicit (decided-and-gated) rather than undecided.
+        // Atomic compare-and-set on the SAME owner we gated, still pre-finalization: a concurrent
+        // merge handoff (re-pointed key) or reopen between the read and this write leaves its own
+        // policy intact instead of being overwritten with a stale gate.
+        await data.open().exec(
+          `UPDATE "pull_requests" SET "merge_human_approval" = 1 WHERE "pr_key" = ? AND "process_key" = ? AND "converged_at" IS NULL`,
+          [parsed.prKey, loopKey],
+        );
+        });
       }
     }
     // Steward opt-in is monotonic too (issue #889 review): an opted-in caller adopting a live loop —
@@ -838,6 +868,12 @@ async function submitPrCritical(
       abandon_token: abandonToken,
       root_request_key: effectiveRoot,
       auto_resolve_escalations: autoResolveEscalations ? 1 : 0,
+      // Merge-policy projection (issue #947): stamp the run's intent so `/status` serves it from
+      // the row with no engine read. The approve at the `merge-approval` gate later maps to 0.
+      merge_requested: mergeIntent ? 1 : 0,
+      // Mirror the engine seed EXACTLY (PR #950 review): an ungated loop is seeded
+      // `humanApproval: false` (decided — no gate), a gated one `true` (outstanding).
+      merge_human_approval: gated ? 1 : 0,
       created_at: ts,
       updated_at: ts,
     });
@@ -935,7 +971,16 @@ async function submitPrCritical(
   let reopened = false;
   // Snapshot BEFORE the reopen write — the row object may be a live reference the update mutates.
   const prior = existing
-    ? { status: existing.status, current_round: existing.current_round, process_key: existing.process_key }
+    ? {
+        status: existing.status,
+        current_round: existing.current_round,
+        process_key: existing.process_key,
+        // Restore the merge-policy projection WITH ownership (PR #950 review): a rollback that put the
+        // old `process_key` back but kept the failed run's policy would serve a mismatched policy as
+        // authoritative (`stale: false`) in `/status`.
+        merge_requested: existing.merge_requested ?? null,
+        merge_human_approval: existing.merge_human_approval ?? null,
+      }
     : null;
   try {
     if (existing) {
@@ -993,6 +1038,10 @@ async function submitPrCritical(
         // Record the opt-in on the row (the durable source the steward's eligibility reads) so a
         // fresh run's flag is authoritative even across a reopen (issue #889).
         auto_resolve_escalations: autoResolveEscalations ? 1 : 0,
+        // Merge-policy projection (issue #947): run-scoped like every other field in this reset —
+        // the fresh run's intent wins, and the approval state mirrors the fresh loop's `humanApproval` seed.
+        merge_requested: mergeIntent ? 1 : 0,
+        merge_human_approval: gated ? 1 : 0,
         // Publish the fresh run's identity in the SAME write as the status flip (may be null if the
         // instance could not be created — a phantom row a retry re-enrolls, as on first submit).
         process_key: processKey,
@@ -1129,7 +1178,15 @@ export async function startMerge(
     },
   });
   if (processInstanceKey != null) {
-    await prs(data).update(pr.prKey, { process_key: String(processInstanceKey), updated_at: now() });
+    await prs(data).update(pr.prKey, {
+      process_key: String(processInstanceKey),
+      // Merge-policy projection (issue #947): a merge loop only starts for a requested, approved
+      // merge (`pr.finalize`'s gate), so the merge-stage policy is known here — stamp it and the
+      // merge stage of `/status` never pays an engine read either.
+      merge_requested: 1,
+      merge_human_approval: 0,
+      updated_at: now(),
+    });
   }
   return { prKey: pr.prKey, mergeProcessKey: processInstanceKey };
 }
@@ -1150,6 +1207,11 @@ export interface MergePolicy {
    * (convergence-loop.bpmn), so the blocker lifts as soon as approval is complete — even while
    * the `pr.finalize` handoff is still queued or incidented. */
   blockedBy: "env" | "human-approval" | null;
+  /** The timing-guard marker (issue #947): `true` when the policy could not be verified and the row
+   *  was served from the historical default instead of blocking the serve (a legacy row — written
+   *  before the durable projection existed — whose fallback engine read failed). Rows served from
+   *  the `pull_requests` projection always read `false`. */
+  stale: boolean;
 }
 
 /** The status `/status` reports for a run whose instance is parked on an ACTIVE engine incident
@@ -1263,18 +1325,35 @@ export async function activePrs(
   // Merge intent (issue #916): read the loop's `autoMerge` / `convergeOnly` / `humanApproval`
   // variables per PR so the effective merge policy is visible without opening the engine.
   //
-  // A CONSTANT number of batched engine reads per /status call (issue #936) — never a per-row
-  // fan-out. The pre-#936 shape issued 3 `searchVariables` round-trips PER active PR (12 calls at 4
-  // rows ≈ 13 s; concurrent callers stacked until the console proxy 502'd). See
-  // `readMergePolicyVars` for the completeness contract (single-page seam, root scope only, one
-  // per-name root probe only for a page cut or legacy instance). Best-effort: a failed batched read degrades every
-  // PR to the historical default (merge requested); a failed per-instance fallback degrades only
-  // that PR.
+  // Issue #947: the policy is served from the app's OWN projection — the `merge_requested` /
+  // `merge_human_approval` columns `submitPr`/`startMerge` stamp on the row (the writers already
+  // know the policy) — so the hot read path pays ZERO engine round-trips. The #937 batched engine
+  // read below is kept ONLY for legacy rows (`merge_requested` NULL — written before the projection
+  // existed): it is a CONSTANT 3 name-filtered reads for the whole legacy set, never a per-row
+  // fan-out, and it shrinks to the empty set as rows reopen onto the projection. See
+  // `readMergePolicyVars` for the legacy completeness contract (single-page seam, root scope only,
+  // one per-name root probe only for a page cut or legacy instance). Best-effort: a failed batched
+  // read degrades every legacy row to the historical default (merge requested, flagged `stale`); a
+  // failed per-instance fallback degrades only that row.
   const mergeByPr = new Map<string, MergePolicy>();
-  const activeKeys = active.map((p) => p.process_key).filter((k): k is string => k != null && k !== "");
-  const varsByInstance = await readMergePolicyVars(engine, activeKeys);
+  const legacyKeys: string[] = [];
+  for (const p of active) {
+    const projected = mergePolicyFromRow(p);
+    if (projected) {
+      mergeByPr.set(p.pr_key, projected);
+    } else if (p.process_key != null && p.process_key !== "") {
+      legacyKeys.push(p.process_key);
+    }
+  }
+  const varsByInstance = await readMergePolicyVars(engine, legacyKeys);
   for (const p of active) {
-    mergeByPr.set(p.pr_key, mergePolicyFromVars(varsByInstance?.get(p.process_key ?? "")));
+    if (mergeByPr.has(p.pr_key)) continue;
+    const vars = varsByInstance?.get(p.process_key ?? "");
+    mergeByPr.set(p.pr_key, mergePolicyFromVars(vars));
+    // Self-healing hydration (PR #950 review): a legacy row whose policy the engine just proved is
+    // written back onto the projection, so it pays the engine read at most ONCE — the legacy set
+    // drains on the first serves after upgrade instead of keeping every /status on the slow path.
+    await hydrateLegacyMergePolicy(data, p, vars);
   }
   return active.map((p) => {
     // Issue #931: an ACTIVE engine incident parked on the loop's instance must be VISIBLE — the row
@@ -1352,9 +1431,25 @@ function hasOwnTerminationReason(p: {
 
 /** The default merge policy when no instance variables are readable (mid-handoff row, engine
  * unreachable, or a legacy loop carrying neither variable): the pre-#916 behaviour merged by
- * default, so the projection must NOT read such a PR as review-only. */
+ * default, so the projection must NOT read such a PR as review-only. Flagged `stale` (issue #947):
+ * the policy could not be verified — the row was served from the default rather than blocking. */
 function mergePolicyDefault(): MergePolicy {
-  return mergePolicyFrom(true, false);
+  return { ...mergePolicyFrom(true, false), stale: true };
+}
+
+/** Derive a PR's effective merge policy from its DURABLE row projection (issue #947) — the
+ *  `merge_requested` / `merge_human_approval` columns `submitPr`/`startMerge` stamp. Returns
+ *  `undefined` for a legacy row (`merge_requested` NULL — written before the projection existed),
+ *  which the caller falls back to the #937 batched engine read. `merge_human_approval` NULL means
+ *  the approval is outstanding/undecided (the gate still holds); 0|1 is the decided state the
+ *  `merge-approval` task's `humanApproval` variable write mirrors. A projected policy is always
+ *  fresh (`stale: false`) — it never blocks the serve on an engine round-trip. */
+function mergePolicyFromRow(p: {
+  merge_requested?: number | null;
+  merge_human_approval?: number | null;
+}): MergePolicy | undefined {
+  if (p.merge_requested == null) return undefined;
+  return { ...mergePolicyFrom(p.merge_requested === 1, p.merge_human_approval !== 0), stale: false };
 }
 
 /** Combine a merge intent + human-approval gate with the global switch into the effective policy.
@@ -1362,7 +1457,7 @@ function mergePolicyDefault(): MergePolicy {
  *  and the `merge-approval` user task clears it on an explicit "approve", so an approved PR whose
  *  finalization is still queued/incidented reads `effective` with no blocker rather than a stale
  *  `blockedBy: "human-approval"`. */
-function mergePolicyFrom(requested: boolean, humanApproval: boolean): MergePolicy {
+function mergePolicyFrom(requested: boolean, humanApproval: boolean): Omit<MergePolicy, "stale"> {
   const enabled = AUTO_MERGE;
   const effective = requested && enabled && !humanApproval;
   const blockedBy = !requested ? null : !enabled ? "env" : humanApproval ? "human-approval" : null;
@@ -1376,6 +1471,9 @@ type MergePolicyVars = {
   autoMerge: boolean | undefined;
   convergeOnly: boolean | undefined;
   humanApproval: boolean | undefined;
+  /** True once every policy name for this instance was either seen or proven absent by an
+   *  untruncatable root probe — absence of a name is then real, not a page cut. */
+  proven?: boolean;
 };
 
 function emptyMergePolicyVars(): MergePolicyVars {
@@ -1398,6 +1496,46 @@ function isMergePolicyName(name: string): name is MergePolicyName {
   return MERGE_POLICY_NAMES.some((n) => n === name);
 }
 
+/** Write a legacy row's engine-proven merge policy back onto its `pull_requests` projection (PR #950
+ *  review). Only a COMPLETE read is persisted — a known intent (`autoMerge`, or the legacy inverted
+ *  `convergeOnly`) AND a known `humanApproval` — so a guess is never made authoritative. The UPDATE is
+ *  guarded on the row still being unstamped AND still owned by the instance read, so a concurrent
+ *  submit/reopen stamp always wins. Best-effort: a failed write just leaves the row legacy. */
+async function hydrateLegacyMergePolicy(
+  data: DataLayer,
+  row: { pr_key: string; process_key?: string | null },
+  vars: MergePolicyVars | undefined,
+): Promise<void> {
+  if (!vars || !row.process_key) return;
+  // A legacy loop that predates `humanApproval` legitimately lacks it; once a COMPLETE read proved
+  // that absence it reads as "no outstanding approval", so the row can leave the probe queue
+  // instead of starving later legacy rows (PR #950 review).
+  const humanApproval = vars.humanApproval ?? (vars.proven ? false : undefined);
+  if (humanApproval === undefined) return;
+  const requested = vars.autoMerge ?? (vars.convergeOnly === undefined ? undefined : !vars.convergeOnly);
+  if (requested === undefined) return;
+  try {
+    // `COALESCE` preserves an approval stamp written concurrently (approval / gated adoption leave
+    // `merge_requested` NULL), so a hydration that read the engine BEFORE that decision can never
+    // overwrite it with the older value (PR #950 review).
+    await data.open().exec(
+      `UPDATE "pull_requests" SET "merge_requested" = ?, "merge_human_approval" = COALESCE("merge_human_approval", ?) WHERE "pr_key" = ? AND "process_key" = ? AND "merge_requested" IS NULL`,
+      [requested ? 1 : 0, humanApproval ? 1 : 0, row.pr_key, row.process_key],
+    );
+  } catch {
+    // swallow — hydration is an optimisation; the row simply stays on the legacy read
+  }
+}
+
+/** Upper bound on legacy instances that may pay per-instance root probes in ONE /status serve (PR
+ *  #950 review). Beyond it, an instance missing from the batched pages degrades to the stale default
+ *  for this serve (and is hydrated on a later one), so request-time engine calls stay bounded at
+ *  `3 + 3 * MAX_PROBED_LEGACY_INSTANCES` regardless of how many legacy PRs exist. */
+export const MAX_PROBED_LEGACY_INSTANCES = 4;
+
+/** Rotating start offset into the legacy probe queue (see {@link readMergePolicyVars}). */
+let legacyProbeCursor = 0;
+
 /** Batched merge-policy read (issue #936): ONE name-filtered engine-wide read per policy variable
  *  (3 concurrent calls, independent of row count), bucketed by owning instance.
  *
@@ -1452,15 +1590,27 @@ async function readMergePolicyVars(
     // `convergeOnly` is skipped once a usable boolean `autoMerge` is known (the canonical intent wins). Every loop
     // seeds all three names at creation (submitPr; startMerge seeds the merge loop's policy too), so
     // the steady state is exactly 3 calls; probes are only paid for page cuts and legacy instances.
+    const needsProbe = (pk: string) =>
+      MERGE_POLICY_NAMES.filter(
+        (name) => !seen.get(pk)?.has(name) && !(name === "convergeOnly" && byInstance.get(pk)?.autoMerge !== undefined),
+      );
+    // Bound the request-time fallback (PR #950 review): only the first MAX_PROBED_LEGACY_INSTANCES
+    // instances (callers pass them most-recently-updated first) are probed; the rest degrade fully to
+    // the stale default for this serve — never a half-read policy.
+    for (const pk of wanted) {
+      const vars = byInstance.get(pk);
+      if (vars && needsProbe(pk).length === 0) vars.proven = true;
+    }
+    const probing = [...wanted].filter((pk) => needsProbe(pk).length > 0);
+    // Rotate the probe window across serves (PR #950 review) so a leading row that can never be
+    // hydrated cannot permanently starve the rows behind it.
+    const offset = probing.length > 0 ? legacyProbeCursor % probing.length : 0;
+    const rotated = [...probing.slice(offset), ...probing.slice(0, offset)];
+    legacyProbeCursor += MAX_PROBED_LEGACY_INSTANCES;
+    for (const pk of rotated.slice(MAX_PROBED_LEGACY_INSTANCES)) byInstance.delete(pk);
     await Promise.all(
-      [...wanted].map(async (pk) => {
-        const got = seen.get(pk);
-        const probe = MERGE_POLICY_NAMES.filter(
-          (name) =>
-            !got?.has(name) &&
-            !(name === "convergeOnly" && byInstance.get(pk)?.autoMerge !== undefined),
-        );
-        if (probe.length === 0) return;
+      rotated.slice(0, MAX_PROBED_LEGACY_INSTANCES).map(async (pk) => {
+        const probe = needsProbe(pk);
         try {
           // Collect ALL probe results first and record only once every probe succeeded: recording
           // inside each probe would let a slower successful sibling re-create the entry the catch
@@ -1473,6 +1623,9 @@ async function readMergePolicyVars(
             ),
           );
           for (const rows of results) for (const row of rows) record(row);
+          const vars = byInstance.get(pk) ?? emptyMergePolicyVars();
+          vars.proven = true;
+          byInstance.set(pk, vars);
         } catch {
           // Degrade ONLY this instance — and fully: drop any partial entry the batch recorded so
           // the caller projects the default for it, never a half-read policy.
@@ -1490,11 +1643,14 @@ async function readMergePolicyVars(
  * canonical positive `autoMerge` wins; the legacy inverted `convergeOnly` is the fallback for
  * in-flight loops seeded before `autoMerge` existed; an instance carrying neither (or absent from
  * the batch — mid-handoff row, instance gone) degrades to the historical default (merge
- * requested) rather than failing the status read. */
+ * requested, flagged `stale`) rather than failing the status read. */
 function mergePolicyFromVars(vars: MergePolicyVars | undefined): MergePolicy {
   if (!vars) return mergePolicyDefault();
+  if (vars.autoMerge === undefined && vars.convergeOnly === undefined && vars.humanApproval === undefined) {
+    return mergePolicyDefault();
+  }
   const requested = vars.autoMerge ?? (vars.convergeOnly === undefined ? true : !vars.convergeOnly);
-  return mergePolicyFrom(requested, vars.humanApproval === true);
+  return { ...mergePolicyFrom(requested, vars.humanApproval === true), stale: false };
 }
 
 /** A delivery-graph run currently in flight, as reported by the status endpoint (issue #889 §1 —

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.208.3",
-  "gitSha": "ff42e2a6fa77fd780949822adf3d4f2b9caefc38",
-  "gitTag": "v0.208.3",
-  "builtAt": "2026-11-11T02:35:58.462Z"
+  "version": "0.208.5",
+  "gitSha": "c3f19d50ef6cf4f731f50ab778b5cd7ebdb3454e",
+  "gitTag": "v0.208.5",
+  "builtAt": "2026-11-11T09:26:21.393Z"
 }

package/db/migrations/132_pull_requests_merge_policy.sql

@@ -0,0 +1,22 @@
+-- Durable merge-policy projection for /status (issue #947). `/app/api/status` regressed to ~30 s
+-- (502 behind the console proxy) on merlin with only 9 PRs: the #937 batching left the merge-policy
+-- read at 3 engine-wide `searchVariables` pages plus a per-(instance, name) probe for any name cut
+-- from its (single, truncating) page — and on a loaded host each engine read costs ~1 s, so the
+-- serve was O(PRs x reads). The fix for the CLASS is to serve the hot read path from the app's own
+-- projection: the writers that already KNOW the policy stamp it on the row —
+--
+--   * `submitPr`  stamps `merge_requested` (the run's merge intent) at submit/reopen and
+--                 `merge_human_approval = 1` when a gated adopt narrows a live loop;
+--   * `completeUserTaskAttributed` (app/agentCompletion.ts) stamps `merge_human_approval = 0` when a
+--                 human APPROVES at the `merge-approval` task (mirroring the task's `humanApproval`
+--                 output mapping), so /status lifts the blocker the moment approval lands;
+--   * `startMerge` stamps `merge_requested = 1, merge_human_approval = 0` (a merge loop only starts
+--                 for a requested, approved merge).
+--
+-- `merge_requested` is NULL on every pre-#947 row: those legacy rows keep the #937 batched engine
+-- read (constant, never per-row) until they next reopen. `merge_human_approval` is NULL while an
+-- approval is outstanding and 0/1 once decided — mirroring the loop's `humanApproval` variable,
+-- which the `merge-approval` user task clears to `false` on an explicit approve. Both columns are
+-- run-scoped: `submitPr`'s atomic reopen resets them to the fresh run's intent.
+ALTER TABLE pull_requests ADD COLUMN merge_requested INTEGER;
+ALTER TABLE pull_requests ADD COLUMN merge_human_approval INTEGER;

package/db/migrations/133_pull_requests_read_model_merge_policy.sql

@@ -0,0 +1,51 @@
+-- Re-create the `pull_requests_read_model` VIEW so it re-exports the new base columns (the VIEW must pass
+-- through EVERY base `pull_requests` column — app/pullRequestReadModel.test.ts DRIFT GUARD). A mechanical
+-- re-emission of 131 with `merge_requested` / `merge_human_approval` (132, issue #947) added; the derived
+-- columns are emitted VERBATIM from app/pullRequestReadModel.ts and are unchanged. No BEGIN/COMMIT (the
+-- runner wraps each file). Numbered after 132.
+
+DROP VIEW IF EXISTS pull_requests_read_model;
+
+CREATE VIEW pull_requests_read_model AS
+SELECT
+  pr.pr_key AS pr_key,
+  pr.repo AS repo,
+  pr.number AS number,
+  pr.url AS url,
+  pr.title AS title,
+  COALESCE(pr.derived_status, pr.status) AS status,
+  pr.current_round AS current_round,
+  pr.process_key AS process_key,
+  pr.waiting_since AS waiting_since,
+  pr.last_review_id AS last_review_id,
+  pr.outcome AS outcome,
+  pr.created_at AS created_at,
+  pr.updated_at AS updated_at,
+  pr.converged_at AS converged_at,
+  pr.merged_at AS merged_at,
+  pr.active_worker AS active_worker,
+  pr.lease_until AS lease_until,
+  pr.last_nudge_at AS last_nudge_at,
+  pr.fresh_head_run_head AS fresh_head_run_head,
+  pr.abandon_token AS abandon_token,
+  pr.incident_key AS incident_key,
+  pr.incident_type AS incident_type,
+  pr.incident_since AS incident_since,
+  pr.incident_message AS incident_message,
+  pr.last_round_head AS last_round_head,
+  pr.last_progress_job_key AS last_progress_job_key,
+  pr.last_progress_result AS last_progress_result,
+  pr.last_progress_agent_watermark AS last_progress_agent_watermark,
+  pr.churn_escalated_round AS churn_escalated_round,
+  pr.root_request_key AS root_request_key,
+  pr.epic_phase_label AS epic_phase_label,
+  pr.acknowledged_at AS acknowledged_at,
+  pr.auto_resolve_escalations AS auto_resolve_escalations,
+  pr.termination_reason AS termination_reason,
+  pr.termination_process_key AS termination_process_key,
+  pr.retire_pending_key AS retire_pending_key,
+  pr.merge_requested AS merge_requested,
+  pr.merge_human_approval AS merge_human_approval,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND (NOT COALESCE(COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open
+FROM pull_requests__tracking pr;

package/e2e/feature-preflight.e2e.ts

@@ -159,7 +159,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       assert.ok(
         flows.includes("ensure-base-branch->record-feature-implementing") &&
           flows.includes("record-feature-implementing->implement") &&
-          flows.includes("Start->implement-task"),
+          flows.includes("slice-branch->implement-task"),
         `the run reaches the implement agent (via the implement cell) only after the gate (flows: ${flows.join(", ")})`,
       );
       // A green probe never escalates.
@@ -192,7 +192,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       assert.ok(!flows.includes("gw-readiness->readiness-preflight"), "an ungated feature never enters the preflight");
       assert.ok(
         flows.includes("record-feature-implementing->implement") &&
-          flows.includes("Start->implement-task"),
+          flows.includes("slice-branch->implement-task"),
         "an ungated feature reaches the implement agent (via the implement cell)",
       );
     } finally {

package/e2e/plan-fanout.e2e.ts

@@ -21,6 +21,7 @@ import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import type { EngineJob } from "@nanobpm/urban/runtime";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import { recoverBranchCreate } from "../app/repoEnvelope.ts";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
 import { advancePastTimer, settleFully } from "./support/time.ts";
 
@@ -127,32 +128,127 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
   const singleTaskPlan: Stub = () => ({ tasks: [{ id: "t1", title: "T1", prompt: "do t1" }] });
   const approveReview: Stub = () => ({ approved: true, findings: "" });
 
-  test("host-git provisioning: each slice's implement-cell agent job carries the repository envelope (#684)", async () => {
+  test("host-git provisioning: each slice's implement-cell agent job carries the repository envelope AND the deterministic branch.create (#684/#945)", async () => {
     // The whole-epic seed emits `io.nanobpm.agentTask.repository` so every slice's `senior:feature`
     // agent gets an ISOLATED clone instead of clobbering the worker's launch dir. The process variable
     // rides down through the wave subprocess + `implement-cell-call` callActivity into each agent job.
     // The epic seed carries the BASE branch as `ref` but NO `branch.create` — each slice's
-    // `feat/<task.id>` differs per MI child, so the agent cuts its own branch inside the clone.
-    let agentTask: any = null;
+    // `feat/<task.id>` differs per MI child, so it can't be named at seed time. Issue #945: the
+    // per-instance `slice-branch` worker (first step of each implement-cell) now stamps the deterministic `branch.create` (`feat/<task.id>`)
+    // onto the envelope as a FLAT dotted process variable (`io.nanobpm.agentTask.branch.create`), which
+    // the c8ctl harness deep-merges with the whole-object seed — so a retry re-derives the SAME branch
+    // and the durable WIP checkpoint restore matches (previously every retry cut a random
+    // `nano/agent-work/*` fallback and discarded the prior session's work).
+    let agentVars: Record<string, unknown> = {};
     await withApp(
       {
         "senior:plan": singleTaskPlan,
         "senior:plan-review": approveReview,
         "senior:feature": (job) => {
-          agentTask = (job.variables as Record<string, any>)["io.nanobpm.agentTask"] ?? null;
+          agentVars = job.variables as Record<string, unknown>;
           return { status: "blocked", summary: "n/a" };
         },
       },
       async ({ app }) => {
         await app.settle();
+        const agentTask = agentVars["io.nanobpm.agentTask"] as Record<string, any> | undefined;
         assert.ok(agentTask, "the epic slice's senior:feature job carried the io.nanobpm.agentTask envelope");
         const agentRepo = agentTask.repository;
         assert.equal(agentRepo.url, "https://github.com/owner/repo.git", "the harness clones the target repo");
         assert.equal(agentRepo.ref, "epic/e2e", "the epic seed checks out the BASE (integration) branch");
-        // `branch` is a top-level sibling of `repository` (#882); the epic seed omits it entirely.
-        assert.equal("branch" in agentTask, false, "the epic seed omits branch.create — the agent branches per slice");
         assert.equal(agentRepo.singleBranch, true, "the blobless/single-branch monorepo shaping rides along");
         assert.equal(agentRepo.filter, "blob:none");
+        // The whole-object seed still omits `branch` (it can't name a per-child branch)…
+        assert.equal("branch" in agentTask, false, "the whole-object seed carries no per-slice branch");
+        // …but the per-instance slice-branch worker stamps it as a FLAT dotted variable, which the harness
+        // merges onto the SAME envelope. Assert the dotted variable is present and names the
+        // deterministic `feat/<task.id>` branch (the single task here is `t1`).
+        assert.equal(
+          agentVars["io.nanobpm.agentTask.branch.create"],
+          "feat/t1",
+          "slice-branch stamps the deterministic per-slice branch.create as a flat dotted variable (#945)",
+        );
+        // Round-trip through the harness normalizer shape: the merged envelope must recover
+        // `branch.create` from the top level (proving the dotted variable and the whole-object seed
+        // merge into one envelope the harness reads).
+        assert.equal(
+          recoverBranchCreate({}, agentVars),
+          "feat/t1",
+          "the harness merges the dotted branch.create with the whole-object seed envelope (#945)",
+        );
+      },
+    );
+  });
+
+  test("sibling isolation: two parallel slices each see their OWN branch.create, never a sibling's (#945)", async () => {
+    // A per-slice branch emitted into the SHARED plan-fanout MI body lands on the epic root, so a
+    // sibling's emission overwrites it and a slice can inherit `feat/<sibling>` — sending its work and
+    // checkpoint to the wrong branch. The emitter runs inside each implement-cell instance instead, so
+    // every activation's recovered branch must be `feat/<its own task.id>`.
+    const seen: Array<{ id: unknown; branch: string | undefined }> = [];
+    await withApp(
+      {
+        "senior:plan": () => ({
+          tasks: [
+            { id: "t1", title: "T1", prompt: "do t1" },
+            { id: "t2", title: "T2", prompt: "do t2" },
+          ],
+        }),
+        "senior:plan-review": approveReview,
+        "senior:feature": (job) => {
+          const vars = job.variables as Record<string, any>;
+          seen.push({ id: vars.task?.id, branch: recoverBranchCreate({}, vars) });
+          return { status: "blocked", summary: "n/a" };
+        },
+      },
+      async ({ app }) => {
+        await app.settle();
+        assert.deepEqual(
+          seen.map((s) => s.id).sort(),
+          ["t1", "t2"],
+          "both sibling slices activated their implement-task",
+        );
+        for (const s of seen) {
+          assert.equal(s.branch, `feat/${String(s.id)}`, `slice ${String(s.id)} must see its OWN branch.create`);
+        }
+      },
+    );
+  });
+
+  test("retry determinism: a re-dispatched implement-task names the SAME branch.create, so the WIP checkpoint restore matches (#945)", async () => {
+    // Issue #945's field failure: every c8ctl retry of an implement-cell slice cut a NEW random
+    // `nano/agent-work/*` fallback branch, so the durable WIP checkpoint (keyed on the deterministic
+    // `feat/<task.id>`) was NEVER restored — each retry started from the epic base and discarded the
+    // prior session's work. The fix makes `branch.create` a pure function of `task.id`, so a retry
+    // re-derives the SAME branch and the checkpoint restore matches. Drive the implement-task through
+    // TWO activations of the SAME slice (an escalation parks it; answering re-dispatches it — the same
+    // re-activation an idle-kill retry produces) and assert both carry the identical recovered
+    // `branch.create`.
+    const seenBranches: Array<string | undefined> = [];
+    await withApp(
+      {
+        "senior:plan": singleTaskPlan,
+        "senior:plan-review": approveReview,
+        "senior:feature": (job) => {
+          seenBranches.push(recoverBranchCreate({}, job.variables as Record<string, unknown>));
+          // First activation escalates (parks for a human); the resume (second activation) blocks.
+          return seenBranches.length === 1
+            ? { status: "escalated", question: "Which API should I use?", summary: "parked for a human" }
+            : { status: "blocked", summary: "resumed after answer" };
+        },
+      },
+      async ({ app, processKey }) => {
+        // First activation parked on the human-escalation task; answer it to re-dispatch the SAME slice.
+        const task = await openTask(app, processKey, "escalation");
+        await app.engine.completeUserTask(task.userTaskKey, { resolution: "answer", answer: "use v2" });
+        await app.settle();
+        assert.equal(seenBranches.length, 2, "the implement-task was activated twice (initial + retry)");
+        assert.equal(seenBranches[0], "feat/t1", "the FIRST activation carries the deterministic branch.create");
+        assert.equal(
+          seenBranches[1],
+          seenBranches[0],
+          "the RETRY activation re-derives the SAME branch.create — the WIP checkpoint restore matches (#945)",
+        );
       },
     );
   });
@@ -532,7 +628,7 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("wait-caps-resolved->implement-cell-call") && flows.includes("Start->implement-task"),
+          flows.includes("wait-caps-resolved->implement-cell-call") && flows.includes("slice-branch->implement-task"),
           `caps-resolved released the barrier into the implement cell (flows: ${flows.join(", ")})`,
         );
         assert.equal(
@@ -614,7 +710,7 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
         assert.ok(
           answered.includes("w_gw_answer->record-task-implementing") &&
             answered.includes("record-task-implementing->implement-cell-call") &&
-            answered.includes("Start->implement-task"),
+            answered.includes("slice-branch->implement-task"),
           `answering the caps escalation reset the stale question and released the barrier into the implement cell (flows: ${answered.join(", ")})`,
         );
         assert.equal(featureRan, true, "the agent was dispatched once the operator answered the caps escalation");
@@ -668,7 +764,7 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
         assert.ok(
           entered.includes("w_gw_answer->record-task-implementing") &&
             entered.includes("record-task-implementing->implement-cell-call") &&
-            entered.includes("Start->implement-task"),
+            entered.includes("slice-branch->implement-task"),
           `answering the caps escalation reset the stale question and released the barrier into the implement cell (flows: ${entered.join(", ")})`,
         );
 

package/nano.app.json

@@ -180,6 +180,10 @@
       "taskType": "pr.select-wave",
       "handler": "workers/select-wave/worker.ts"
     },
+    {
+      "taskType": "pr.slice-branch",
+      "handler": "workers/slice-branch/worker.ts"
+    },
     {
       "taskType": "pr.caps-prepare",
       "handler": "workers/caps-prepare/worker.ts"