@nanobpm/nano-workforce 0.208.4 → 0.208.5

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.208.5](https://github.com/nanobpm/nano-workforce/compare/v0.208.4...v0.208.5) (2026-11-11)
+
+### Bug Fixes
+
+* **status:** serve the /status merge policy from a durable pull_requests projection ([#950](https://github.com/nanobpm/nano-workforce/issues/950)) ([c3f19d5](https://github.com/nanobpm/nano-workforce/commit/c3f19d50ef6cf4f731f50ab778b5cd7ebdb3454e)), closes [#937](https://github.com/nanobpm/nano-workforce/issues/937) [#937](https://github.com/nanobpm/nano-workforce/issues/937) [#947](https://github.com/nanobpm/nano-workforce/issues/947)
+
 ## [0.208.4](https://github.com/nanobpm/nano-workforce/compare/v0.208.3...v0.208.4) (2026-11-11)
 
 ### Bug Fixes

package/app/agentCompletion.test.ts

@@ -85,6 +85,21 @@ function memData(
       }
       return { changed: 0 };
     }
+    // The guarded merge-approval projection stamp (issue #947, PR #950 review): ownership is checked
+    // IN the UPDATE predicate, so only a row still owned by the approving instance is stamped.
+    const mp = /^UPDATE "pull_requests" SET "merge_human_approval" = 0 WHERE "process_key" = \?$/.exec(sql);
+    if (mp) {
+      const store = stores.pull_requests;
+      if (!store) throw new Error("no such table: pull_requests");
+      let changed = 0;
+      for (const r of store.rows) {
+        if (r.process_key === params[0]) {
+          r.merge_human_approval = 0;
+          changed++;
+        }
+      }
+      return { changed };
+    }
     // The FIRST-HAND agent-revert tombstone keyed on `source_completion_id` (Copilot review of #806) —
     // `invalidateAdjudicationByCompletion`. Tombstones EVERY live row this completion produced (a
     // completion settles one question, so at most one) so reverting a first-hand agent answer (which has
@@ -991,3 +1006,143 @@ test("snapshotUserTaskFormOptions: an unresolvable form_key never throws (safe r
     "an unresolvable form_key falls back to the element's static form",
   );
 });
+
+// ── Issue #947: a merge-approval APPROVE mirrors onto the durable /status merge-policy projection ──
+// `submitPr` stamps `merge_human_approval = 1` when it gates a loop; the human's approve at the
+// `merge-approval` task clears the loop's `humanApproval` variable via the task's output mapping.
+// The canonical completer must stamp the SAME decision onto the row column `/status` reads, or the
+// projection reports `blockedBy: "human-approval"` long after approval landed.
+
+test("a merge-approval APPROVE stamps merge_human_approval=0 on the owning PR row (issue #947)", async () => {
+  const stores = {
+    task_completions: { rows: [] as any[], key: "id" },
+    pull_requests: {
+      rows: [
+        { pr_key: "owner/repo#7", process_key: "PI-7", merge_requested: 1, merge_human_approval: 1 },
+      ],
+      key: "pr_key",
+    },
+  };
+  const data = memData(stores);
+  const { engine } = fakeEngine([{ userTaskKey: "ut-ma", elementId: "merge-approval", processInstanceKey: "PI-7" }]);
+
+  const r = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-ma",
+    operatorId: "alice",
+    variables: { mergeDecision: "approve" },
+  });
+
+  assertEquals(r.ok, true);
+  const row = stores.pull_requests.rows[0];
+  assertEquals(row.merge_human_approval, 0, "the approval is mirrored onto the /status projection");
+  assertEquals(row.merge_requested, 1, "the merge intent is untouched");
+});
+
+test("a merge-approval REVISE leaves the projection gated (issue #947)", async () => {
+  const stores = {
+    task_completions: { rows: [] as any[], key: "id" },
+    pull_requests: {
+      rows: [{ pr_key: "owner/repo#8", process_key: "PI-8", merge_requested: 1, merge_human_approval: 1 }],
+      key: "pr_key",
+    },
+  };
+  const data = memData(stores);
+  const { engine } = fakeEngine([{ userTaskKey: "ut-mr", elementId: "merge-approval", processInstanceKey: "PI-8" }]);
+
+  const r = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-mr",
+    operatorId: "alice",
+    variables: { mergeDecision: "revise", answer: "split the migration" },
+  });
+
+  assertEquals(r.ok, true);
+  assertEquals(stores.pull_requests.rows[0].merge_human_approval, 1, "a revise keeps the gate outstanding");
+});
+
+test("a merge-approval approve against a SUPERSEDED instance never clears the fresh run's gate (issue #947)", async () => {
+  // The stamp is ownership-guarded on the instance the task parked on: after a reopen re-pointed
+  // `process_key` at the fresh run, a straggler completion resolved against the OLD instance must
+  // not clear the new run's projection.
+  const stores = {
+    task_completions: { rows: [] as any[], key: "id" },
+    pull_requests: {
+      rows: [{ pr_key: "owner/repo#9", process_key: "PI-NEW", merge_requested: 1, merge_human_approval: 1 }],
+      key: "pr_key",
+    },
+  };
+  const data = memData(stores);
+  const { engine } = fakeEngine([{ userTaskKey: "ut-stale", elementId: "merge-approval", processInstanceKey: "PI-OLD" }]);
+
+  const r = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-stale",
+    operatorId: "alice",
+    variables: { mergeDecision: "approve" },
+  });
+
+  assertEquals(r.ok, true, "the engine completion itself still lands");
+  assertEquals(stores.pull_requests.rows[0].merge_human_approval, 1, "the fresh run's gate is not cleared by a stale instance");
+});
+
+test("a reopen racing the approval stamp can never let the PREVIOUS run clear the successor's gate (PR #950 review)", async () => {
+  // A reopen re-points `process_key` the moment the stamp looks the row up (simulated in the
+  // table's `findOne`). A read-then-write stamp would then clear the FRESH run's gate; the guarded
+  // single-statement UPDATE checks ownership atomically, so the successor's gate survives.
+  const stores = {
+    task_completions: { rows: [] as any[], key: "id" },
+    pull_requests: {
+      rows: [{ pr_key: "owner/repo#10", process_key: "PI-OLD", merge_requested: 1, merge_human_approval: 1 }],
+      key: "pr_key",
+    },
+  };
+  const base = memData(stores);
+  const reopen = () => {
+    const live = stores.pull_requests.rows[0];
+    live.process_key = "PI-NEW";
+    live.merge_human_approval = 1; // the fresh gated run restarts outstanding
+  };
+  const data: any = Object.create(base);
+  data.table = (name: string, key: string) => {
+    const t: any = base.table(name, key);
+    if (name !== "pull_requests") return t;
+    return {
+      ...t,
+      findOne: async (q: any) => {
+        const row = await t.findOne(q);
+        reopen(); // the reopen lands between a lookup and its write
+        return row;
+      },
+    };
+  };
+  // An atomic statement leaves no window: the reopen can only land after it (and resets the gate).
+  data.open = () => {
+    const db: any = base.open();
+    return { ...db, exec: async (sql: string, params?: unknown[]) => {
+      const res = await db.exec(sql, params);
+      reopen();
+      return res;
+    } };
+  };
+  const { engine } = fakeEngine([{ userTaskKey: "ut-race", elementId: "merge-approval", processInstanceKey: "PI-OLD" }]);
+  const r = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-race",
+    operatorId: "alice",
+    variables: { mergeDecision: "approve" },
+  });
+  assertEquals(r.ok, true);
+  assertEquals(stores.pull_requests.rows[0].merge_human_approval, 1, "the successor's gate stays outstanding");
+});
+
+test("a merge-approval projection-stamp failure never masks the engine completion (issue #947)", async () => {
+  const stores = { task_completions: { rows: [] as any[], key: "id" } };
+  const data = memData(stores); // no pull_requests store — the stamp's table read throws
+  const { engine, completed } = fakeEngine([{ userTaskKey: "ut-mx", elementId: "merge-approval", processInstanceKey: "PI-X" }]);
+
+  const r = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-mx",
+    operatorId: "alice",
+    variables: { mergeDecision: "approve" },
+  });
+
+  assertEquals(r.ok, true, "best-effort: the projection miss is swallowed");
+  assertEquals(completed.length, 1, "the engine resume already happened");
+});

package/app/agentCompletion.ts

@@ -25,6 +25,7 @@ import type { DataLayer, EngineClient, GatewayDataSource } from "@nanobpm/urban"
 import { invalidateAdjudication, invalidateAdjudicationByCompletion } from "./adjudications.ts";
 import { CONFORMANCE_ESCALATION_ELEMENT } from "./conformance.ts";
 import { DELIVERY_HUMAN_ELEMENT, ESCALATION_FORM, GENERIC_HUMAN_FORM, isDeliveryEscalationTwin, isDeliveryHumanElement, isDeliveryWaitEscalationTwin } from "./deliveryHuman.ts";
+import { withMergePolicyLock } from "./mergePolicyLock.ts";
 import { ACP_PERMISSION_ELEMENT, EMPTY_PLAN_ELEMENT, PR_MERGE_APPROVAL_ELEMENT, READINESS_ESCALATION_ELEMENT, READINESS_ESCALATION_PF_ELEMENT } from "./userTasks.ts";
 
 const now = () => new Date().toISOString();
@@ -432,6 +433,11 @@ export async function completeUserTaskAttributed(
     created_at: now(),
   });
   const completionId = Number(id);
+  // Merge-approval approve: serialize the engine completion + projection stamp against gated adoption
+  // on the same loop (PR #950 review) so a concurrent adopter's stale `1` can never land after our `0`.
+  const approvingMerge = target.elementId === PR_MERGE_APPROVAL_ELEMENT && target.variables.mergeDecision === "approve";
+  const lockKey = approvingMerge ? target.processInstanceKey?.trim() : undefined;
+  const resume = async (): Promise<void> => {
   try {
     // Carry the completed user-task's identity forward on the resumed token (Copilot review of #806).
     // `pr.answer-escalation` (record-answer) reconciles the durable adjudication AFTER this completion
@@ -461,9 +467,42 @@ export async function completeUserTaskAttributed(
     }
     throw err;
   }
+  // Merge-policy projection (issue #947): a human APPROVE at the convergence loop's `merge-approval`
+  // task clears the loop's `humanApproval` variable via the task's output mapping — mirror that
+  // decision onto the durable row column `/status` reads, so the projection lifts the
+  // `human-approval` blocker the moment approval lands instead of reporting a stale block until
+  // `startMerge` re-stamps. Best-effort (the engine resume above already succeeded — a projection
+  // miss only leaves the row reading blocked until the merge hand-off, never blocks the merge) and
+  // ownership-guarded on the instance the task parked on, so a completion replayed against a stale
+  // instance can never clear a SUCCESSOR run's gate after a reopen re-pointed `process_key`.
+  if (approvingMerge) {
+    await stampMergeApprovalProjection(data, target.processInstanceKey);
+  }
+  };
+  if (lockKey) await withMergePolicyLock(lockKey, resume);
+  else await resume();
   return { completionId };
 }
 
+/** Mirror a `merge-approval` approve onto the durable `/status` merge-policy projection
+ *  (`merge_human_approval = 0` — decided-and-approved; 132_pull_requests_merge_policy.sql). The
+ *  stamp is keyed by the OWNING instance: the row is only updated while its `process_key` still
+ *  names the instance the completed task parked on, so a late/stray completion against an
+ *  already-replaced run is a no-op. Best-effort and never throws — the engine-side completion is
+ *  the authority; this column only feeds the read projection. */
+async function stampMergeApprovalProjection(data: DataLayer, processInstanceKey: string | null | undefined): Promise<void> {
+  const key = processInstanceKey?.trim();
+  if (!key) return;
+  try {
+    // ONE guarded UPDATE (PR #950 review): the ownership check and the stamp are a single atomic
+    // statement, so a reopen that re-points `process_key` between a lookup and a write can never let
+    // the PREVIOUS run's approval clear its successor's gate (no read-then-write window).
+    await data.open().exec(`UPDATE "pull_requests" SET "merge_human_approval" = 0 WHERE "process_key" = ?`, [key]);
+  } catch {
+    // swallow — a projection miss never masks a completion the engine has already resumed
+  }
+}
+
 /** The newest recorded completion for a user-task key, or undefined. */
 export async function latestCompletion(
   data: DataLayer,

package/app/mergePolicyLock.test.ts

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { withMergePolicyLock } from "./mergePolicyLock.ts";
+
+// PR #950 review: gated adoption (engine humanApproval=true, stamp 1) and merge approval (engine
+// complete, stamp 0) must never interleave on one loop, or the projection ends at a stale 1.
+test("engine-write/projection-stamp pairs on the same loop never interleave", async () => {
+  const log: string[] = [];
+  let projection: number | null = null;
+  let releaseAdopt!: () => void;
+  const adoptEngineWritten = new Promise<void>((r) => {
+    releaseAdopt = r;
+  });
+  const adopt = withMergePolicyLock("loop-1", async () => {
+    log.push("adopt:engine");
+    await adoptEngineWritten; // the approval tries to run while adoption is mid-pair
+    projection = 1;
+    log.push("adopt:stamp");
+  });
+  const approve = withMergePolicyLock("loop-1", async () => {
+    log.push("approve:engine");
+    projection = 0;
+    log.push("approve:stamp");
+  });
+  await Promise.resolve();
+  releaseAdopt();
+  await Promise.all([adopt, approve]);
+  assert.deepEqual(log, ["adopt:engine", "adopt:stamp", "approve:engine", "approve:stamp"]);
+  assert.equal(projection, 0);
+});
+
+test("a failing holder releases the lock; other keys run independently", async () => {
+  await assert.rejects(
+    withMergePolicyLock("loop-2", async () => {
+      throw new Error("boom");
+    }),
+  );
+  assert.equal(await withMergePolicyLock("loop-2", async () => "next"), "next");
+  let release!: () => void;
+  const held = withMergePolicyLock("loop-3", () => new Promise<void>((r) => (release = r)));
+  assert.equal(await withMergePolicyLock("loop-4", async () => "free"), "free");
+  release();
+  await held;
+});

package/app/mergePolicyLock.ts

@@ -0,0 +1,25 @@
+/** In-process keyed serializer for the merge-policy projection (issue #947, PR #950 review).
+ *
+ *  Two writers touch one convergence loop's `humanApproval` policy as an engine-write +
+ *  projection-stamp PAIR: gated adoption (`submitPr`: `setVariables(humanApproval: true)` then stamp
+ *  `merge_human_approval = 1`) and a `merge-approval` approve (`completeUserTask` then stamp `0`).
+ *  Interleaved, the adopter's stale `1` can land after the approval's `0`, so `/status` reports a
+ *  phantom `human-approval` block. Every such pair runs under this lock keyed by the loop's process
+ *  instance key, so the pairs are applied in a single total order and the projection always matches
+ *  the last engine write. The app is a single node process, so an in-memory promise chain suffices. */
+const tails = new Map<string, Promise<unknown>>();
+
+export async function withMergePolicyLock<T>(processKey: string, fn: () => Promise<T>): Promise<T> {
+  const prev = tails.get(processKey) ?? Promise.resolve();
+  const run = prev.then(fn, fn);
+  const tail = run.then(
+    () => undefined,
+    () => undefined,
+  );
+  tails.set(processKey, tail);
+  try {
+    return await run;
+  } finally {
+    if (tails.get(processKey) === tail) tails.delete(processKey);
+  }
+}

package/app/mergeStatus.test.ts

@@ -55,7 +55,9 @@ function memData(stores: Stores) {
 
 /** A fake engine whose `searchVariables` serves the given per-instance variables. A name-less,
  *  key-less query (`{}` — the batched /status read, issue #936) returns EVERY variable across all
- *  instances, each row carrying its owning `processInstanceKey`, exactly as the real engine does. */
+ *  instances, each row carrying its owning `processInstanceKey`, exactly as the real engine does.
+ *  These tests exercise the LEGACY fallback path (issue #947): the row carries no
+ *  `merge_requested` projection, so the policy is read back off the engine. */
 function fakeEngine(varsByInstance: Record<string, Record<string, unknown>>) {
   return {
     searchVariables: (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
@@ -112,20 +114,20 @@ async function mergeOfWith(
 
 test("merge policy: a loop seeded autoMerge=true reads requested+effective (the #916 phantom)", async () => {
   const merge = await mergeOf({ autoMerge: true, convergeOnly: false, humanApproval: false });
-  assertEquals(merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
 });
 
 test("merge policy: a legacy in-flight loop (convergeOnly only) derives requested from its inverse", async () => {
   // Seeded BEFORE `autoMerge` existed: only the legacy inverted variable is present.
   const review = await mergeOf({ convergeOnly: true });
-  assertEquals(review, { requested: false, enabled: true, effective: false, blockedBy: null });
+  assertEquals(review, { requested: false, enabled: true, effective: false, blockedBy: null, stale: false });
   const merging = await mergeOf({ convergeOnly: false });
-  assertEquals(merging, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(merging, { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
 });
 
 test("merge policy: humanApproval gates the effective merge and is named as the blocker", async () => {
   const merge = await mergeOf({ autoMerge: true, humanApproval: true });
-  assertEquals(merge, { requested: true, enabled: true, effective: false, blockedBy: "human-approval" });
+  assertEquals(merge, { requested: true, enabled: true, effective: false, blockedBy: "human-approval", stale: false });
 });
 
 test("merge policy: an approved PR with finalization still pending reports no blocker (PR #917 review)", async () => {
@@ -135,12 +137,12 @@ test("merge policy: an approved PR with finalization still pending reports no bl
   // an approval that is already complete. (`status` stays non-terminal: `converged_at` is only
   // stamped once `pr.finalize` actually runs.)
   const merge = await mergeOf({ autoMerge: true, humanApproval: false }, { status: "converging" });
-  assertEquals(merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
 });
 
 test("merge policy: a review-only request reads requested=false (distinct from env/human blocking)", async () => {
   const merge = await mergeOf({ autoMerge: false, convergeOnly: true });
-  assertEquals(merge, { requested: false, enabled: true, effective: false, blockedBy: null });
+  assertEquals(merge, { requested: false, enabled: true, effective: false, blockedBy: null, stale: false });
 });
 
 test("merge policy: no readable instance key (or neither variable) defaults to the historical merge default", async () => {
@@ -151,9 +153,9 @@ test("merge policy: no readable instance key (or neither variable) defaults to t
     user_tasks: { rows: [], key: "id" },
   };
   const [noKey] = await activePrs(memData(stores), fakeEngine({}));
-  assertEquals(noKey.merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(noKey.merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true });
   const bare = await mergeOf({});
-  assertEquals(bare, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(bare, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true });
 });
 
 test("merge policy: NANO_PR_AUTO_MERGE=0 blocks a requested merge as env, never a review-only one", async () => {
@@ -165,9 +167,9 @@ test("merge policy: NANO_PR_AUTO_MERGE=0 blocks a requested merge as env, never
   try {
     const mod: typeof import("./service.ts") = await import(`./service.ts?mergeStatusAutoMergeOff=${Date.now()}`);
     const requested = await mergeOfWith(mod, { autoMerge: true, humanApproval: true });
-    assertEquals(requested, { requested: true, enabled: false, effective: false, blockedBy: "env" });
+    assertEquals(requested, { requested: true, enabled: false, effective: false, blockedBy: "env", stale: false });
     const reviewOnly = await mergeOfWith(mod, { autoMerge: false });
-    assertEquals(reviewOnly, { requested: false, enabled: false, effective: false, blockedBy: null });
+    assertEquals(reviewOnly, { requested: false, enabled: false, effective: false, blockedBy: null, stale: false });
   } finally {
     if (prev === undefined) delete process.env["NANO_PR_AUTO_MERGE"];
     else process.env["NANO_PR_AUTO_MERGE"] = prev;
@@ -220,5 +222,5 @@ test("merge policy: a delayed successful probe cannot resurrect a policy after a
   } as any;
   const prs = await activePrs(memData(stores), engine);
   const pr = prs.find((p: { prKey?: string; pr_key?: string; number?: number }) => p.number === 1);
-  assertEquals(pr?.merge, { requested: true, enabled: true, effective: true, blockedBy: null }, "failed probe → default, not a half-read policy");
+  assertEquals(pr?.merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true }, "failed probe → default, not a half-read policy");
 });

package/app/migration132.test.ts

@@ -0,0 +1,72 @@
+// Migration guard for 132_pull_requests_merge_policy.sql (issue #947): the durable merge-policy
+// projection `/status` serves. Applies the migration to a real in-memory SQLite DB over a
+// pre-existing `pull_requests` table and asserts the expand-and-contract contract:
+//   * both columns are added NULLABLE with no default — a pre-existing row reads
+//     `merge_requested IS NULL` (the legacy marker `activePrs` falls back to the #937 batched
+//     engine read for), never a fabricated 0/1;
+//   * the writers' stamped values round-trip (0/1 for `merge_requested`, NULL/0/1 for
+//     `merge_human_approval`).
+import { readFileSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { assertEquals } from "#test-assert";
+
+const MIGRATION_132 = fileURLToPath(
+  new URL("../db/migrations/132_pull_requests_merge_policy.sql", import.meta.url),
+);
+
+function migratedDb(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec(
+    `CREATE TABLE pull_requests (
+       pr_key TEXT PRIMARY KEY,
+       repo TEXT NOT NULL,
+       number INTEGER NOT NULL,
+       status TEXT NOT NULL,
+       process_key TEXT
+     );
+     INSERT INTO pull_requests (pr_key, repo, number, status, process_key)
+       VALUES ('owner/repo#1', 'owner/repo', 1, 'converging', 'PI-1');`,
+  );
+  db.exec(readFileSync(MIGRATION_132, "utf8"));
+  return db;
+}
+
+test("migration 132 adds both merge-policy columns NULLABLE — a pre-existing row reads legacy (NULL)", () => {
+  const db = migratedDb();
+  // node:sqlite rows are null-prototype objects; spread to a plain object for the deep-equal.
+  const row = {
+    ...(db
+      .prepare(`SELECT merge_requested, merge_human_approval FROM pull_requests WHERE pr_key = 'owner/repo#1'`)
+      .get() as { merge_requested: number | null; merge_human_approval: number | null }),
+  };
+  assertEquals(
+    row,
+    { merge_requested: null, merge_human_approval: null },
+    "a row written before the projection existed must NOT be back-filled — NULL is the legacy marker the /status fallback keys on",
+  );
+});
+
+test("migration 132 columns round-trip the writers' stamped values", () => {
+  const db = migratedDb();
+  db.prepare(
+    `UPDATE pull_requests SET merge_requested = 1, merge_human_approval = 0 WHERE pr_key = 'owner/repo#1'`,
+  ).run();
+  const row = {
+    ...(db
+      .prepare(`SELECT merge_requested, merge_human_approval FROM pull_requests WHERE pr_key = 'owner/repo#1'`)
+      .get() as { merge_requested: number | null; merge_human_approval: number | null }),
+  };
+  assertEquals(row, { merge_requested: 1, merge_human_approval: 0 });
+  // A review-only run stamps 0; the approval gate stamps 1 while outstanding.
+  db.prepare(
+    `UPDATE pull_requests SET merge_requested = 0, merge_human_approval = 1 WHERE pr_key = 'owner/repo#1'`,
+  ).run();
+  const gated = {
+    ...(db
+      .prepare(`SELECT merge_requested, merge_human_approval FROM pull_requests WHERE pr_key = 'owner/repo#1'`)
+      .get() as { merge_requested: number | null; merge_human_approval: number | null }),
+  };
+  assertEquals(gated, { merge_requested: 0, merge_human_approval: 1 });
+});

package/app/pullRequestReadModel.test.ts

@@ -33,7 +33,7 @@ import {
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const READ_MODEL_MIGRATION = "131_pull_requests_read_model_termination_reason.sql";
+const READ_MODEL_MIGRATION = "133_pull_requests_read_model_merge_policy.sql";
 
 // The real base `pull_requests` columns, in schema order — DERIVED from the migration chain (not a
 // hand-kept list that could silently omit one), used by both the drift guard and the e2e stand-in.