@nanobpm/nano-workforce 0.208.4 → 0.209.0

package/app/service.test.ts

@@ -62,6 +62,16 @@ function memOpen(stores: Record<string, { rows: any[]; key: string }>, ops?: str
         }
         return { changed };
       }
+      if (/^UPDATE "pull_requests" SET "merge_human_approval" = 1 WHERE "pr_key" = \? AND "process_key" = \? AND "converged_at" IS NULL$/.test(sql)) {
+        let changed = 0;
+        for (const r of stores.pull_requests?.rows ?? []) {
+          if (r.pr_key === params[0] && r.process_key === params[1] && r.converged_at == null) {
+            r.merge_human_approval = 1;
+            changed++;
+          }
+        }
+        return { changed };
+      }
       throw new Error(`unexpected exec sql: ${sql}`);
     },
   };
@@ -1259,6 +1269,25 @@ function adoptLoop(status: string, loopState: string, convergedAt: string | null
   return { data, engine, narrowed };
 }
 
+test("a gated submitPr stamps an OUTSTANDING approval matching the engine seed (PR #950 review)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, stores, vars } = captureRoot();
+    await submitPr(
+      data,
+      engine,
+      { repo: "owner/repo", number: 25, url: "https://github.com/owner/repo/pull/25", prKey: "owner/repo#25" },
+      [],
+      20,
+      false,
+      null,
+      true, // humanApproval
+    );
+    const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
+    assertEquals(pr.merge_human_approval, vars()?.humanApproval === true ? 1 : 0, "projection agrees with the engine seed");
+    assertEquals(pr.merge_human_approval, 1, "a gated run projects the outstanding gate");
+  });
+});
+
 test("a gated submitPr adopting a live loop narrows it to humanApproval (issue #826)", async () => {
   await withGithubOff(async () => {
     const pr = { repo: "owner/repo", number: 14, url: "https://github.com/owner/repo/pull/14", prKey: "owner/repo#14" };
@@ -1464,6 +1493,140 @@ test("startMerge seeds the merge-policy triple so /status needs no per-instance
   });
 });
 
+// ── Issue #947: the durable merge-policy projection the writers stamp ────────────────────────────
+// `/status` serves the merge policy off the `pull_requests` row (zero engine reads) — these pin the
+// writer side of that contract: every path that KNOWS the policy must stamp it.
+
+test("submitPr stamps the merge-policy projection on the row (insert path)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, stores } = captureRoot();
+    await submitPr(data, engine, {
+      repo: "owner/repo",
+      number: 21,
+      url: "https://github.com/owner/repo/pull/21",
+      prKey: "owner/repo#21",
+    });
+    const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
+    assertEquals(pr.merge_requested, 1, "the default submit requests the merge");
+    assertEquals(pr.merge_human_approval, 0, "an ungated run mirrors the engine seed humanApproval:false (PR #950 review)");
+  });
+});
+
+test("submitPr stamps a review-only intent as merge_requested 0 (convergeOnly)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, stores } = captureRoot();
+    await submitPr(
+      data,
+      engine,
+      { repo: "owner/repo", number: 22, url: "https://github.com/owner/repo/pull/22", prKey: "owner/repo#22" },
+      [],
+      20,
+      true, // convergeOnly
+    );
+    const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
+    assertEquals(pr.merge_requested, 0, "a review-only run projects requested=false with no engine read");
+    assertEquals(pr.merge_human_approval, 0, "no gate on a review-only run");
+  });
+});
+
+test("submitPr reopen restamps the projection to the FRESH run's intent (run-scoped reset)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, stores } = captureRoot();
+    (stores.pull_requests.rows as unknown[]).push({
+      pr_key: "owner/repo#23",
+      repo: "owner/repo",
+      number: 23,
+      url: "https://github.com/owner/repo/pull/23",
+      status: "converged", // terminal -> reopen path
+      current_round: 2,
+      process_key: "PI-OLD",
+      // The PRIOR run's projection: review-only, approval decided. A fresh default submit must
+      // overwrite both — a carried-over stamp would misreport the new run's policy.
+      merge_requested: 0,
+      merge_human_approval: 0,
+    });
+    await submitPr(data, engine, {
+      repo: "owner/repo",
+      number: 23,
+      url: "https://github.com/owner/repo/pull/23",
+      prKey: "owner/repo#23",
+    });
+    const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
+    assertEquals(pr.merge_requested, 1, "the fresh run's intent wins");
+    assertEquals(pr.merge_human_approval, 0, "the approval state mirrors the fresh ungated seed");
+  });
+});
+
+test("a gated submitPr adopting a live loop stamps merge_human_approval on the row (issue #947)", async () => {
+  await withGithubOff(async () => {
+    const pr = { repo: "owner/repo", number: 14, url: "https://github.com/owner/repo/pull/14", prKey: "owner/repo#14" };
+    const live = adoptLoop("converging", "ACTIVE");
+    await submitPr(live.data, live.engine, pr, [], 20, false, null, true);
+    const row = (await live.data.table("pull_requests", "pr_key").get(pr.prKey)) as {
+      merge_human_approval?: number | null;
+    } | null;
+    assertEquals(row?.merge_human_approval, 1, "the gate is mirrored onto the /status projection");
+
+    const ungated = adoptLoop("converging", "ACTIVE");
+    await submitPr(ungated.data, ungated.engine, pr);
+    const ungatedRow = (await ungated.data.table("pull_requests", "pr_key").get(pr.prKey)) as {
+      merge_human_approval?: number | null;
+    } | null;
+    assertEquals(ungatedRow?.merge_human_approval ?? null, null, "an ungated adopter leaves the projection undecided");
+  });
+});
+
+test("a gated adopter never gates a merge-loop or a row re-pointed mid-handoff (PR #950 review)", async () => {
+  await withGithubOff(async () => {
+    const pr = { repo: "owner/repo", number: 14, url: "https://github.com/owner/repo/pull/14", prKey: "owner/repo#14" };
+    // Variant 1: the key already resolves to the merge-loop (startMerge re-pointed it, converged_at unset).
+    const merge = adoptLoop("converging", "ACTIVE");
+    merge.engine.searchProcessInstances = () =>
+      Promise.resolve([{ processInstanceKey: "PI-LOOP", state: "ACTIVE", processDefinitionId: "merge-loop" }]);
+    await submitPr(merge.data, merge.engine, pr, [], 20, false, null, true);
+    const mergeRow = (await merge.data.table("pull_requests", "pr_key").get(pr.prKey)) as any;
+    assertEquals(mergeRow?.merge_human_approval ?? null, null, "merge-loop policy untouched");
+    assertEquals(merge.narrowed.length, 0, "no humanApproval set on the merge-loop");
+    // Variant 2: the handoff re-points the row between the engine read and the stamp.
+    const race = adoptLoop("converging", "ACTIVE");
+    race.engine.setVariables = async () => {
+      const row = (await race.data.table("pull_requests", "pr_key").get(pr.prKey)) as any;
+      row.process_key = "PI-MERGE";
+      row.merge_human_approval = 0;
+    };
+    await submitPr(race.data, race.engine, pr, [], 20, false, null, true);
+    const raceRow = (await race.data.table("pull_requests", "pr_key").get(pr.prKey)) as any;
+    assertEquals(raceRow?.merge_human_approval, 0, "the handoff's merge-stage policy survives");
+  });
+});
+
+test("startMerge stamps the merge-stage policy on the row (issue #947)", async () => {
+  await withGithubOff(async () => {
+    const { data, engine, stores } = captureRoot();
+    (stores.pull_requests.rows as unknown[]).push({
+      pr_key: "owner/repo#24",
+      repo: "owner/repo",
+      number: 24,
+      url: "https://github.com/owner/repo/pull/24",
+      status: "converged",
+      current_round: 1,
+      process_key: "PI-CONV",
+      merge_requested: 1,
+      merge_human_approval: 1, // the convergence-stage gate — decided by the merge hand-off
+    });
+    await startMerge(data, engine, {
+      repo: "owner/repo",
+      number: 24,
+      url: "https://github.com/owner/repo/pull/24",
+      prKey: "owner/repo#24",
+      round: 1,
+    });
+    const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
+    assertEquals(pr.merge_requested, 1, "a merge loop only starts for a requested merge");
+    assertEquals(pr.merge_human_approval, 0, "…and an approved one — the gate is behind it");
+  });
+});
+
 // The repository envelope drives the c8ctl harness's isolated workspace provisioning: it is
 // emitted under the reserved `io.nanobpm.agentTask` namespace with the PR head branch as the
 // checkout ref, and omitted entirely when the head branch couldn't be resolved (so the harness
@@ -2681,7 +2844,7 @@ test("submitPr handoffFrom: a failed reset restores the prior owner so the hand-
     const PR_KEY = "owner/repo#79";
     const stores: Record<string, { rows: any[]; key: string }> = {
       pull_requests: {
-        rows: [{ pr_key: PR_KEY, repo: "owner/repo", number: 79, url: "https://github.com/owner/repo/pull/79", title: "t", status: "waiting_merge", current_round: 4, process_key: "PI-MERGE" }],
+        rows: [{ pr_key: PR_KEY, repo: "owner/repo", number: 79, url: "https://github.com/owner/repo/pull/79", title: "t", status: "waiting_merge", current_round: 4, process_key: "PI-MERGE", merge_requested: 0, merge_human_approval: 1 }],
         key: "pr_key",
       },
       escalations: { rows: [], key: "id" },
@@ -2722,6 +2885,10 @@ test("submitPr handoffFrom: a failed reset restores the prior owner so the hand-
     assertEquals(row.process_key, "PI-MERGE", "rollback restores the prior owner, never leaves the cancelled key");
     assertEquals(row.status, "waiting_merge", "rollback restores the prior status");
     assertEquals(row.current_round, 4);
+    // PR #950 review: the merge-policy projection is restored WITH ownership, never left as the
+    // failed run's policy under the old owner (which /status would serve as authoritative).
+    assertEquals(row.merge_requested, 0, "rollback restores the prior merge intent");
+    assertEquals(row.merge_human_approval, 1, "rollback restores the prior approval state");
 
     failReset = false;
     const retry = await submitPr(data, engine, parsed, [], undefined, false, null, false, false, true, "PI-MERGE");

package/app/service.ts

@@ -64,6 +64,7 @@ import { pollLineage } from "./lineage.ts";
 import { mergeableRepollInterval, mergeableWaitTimeout } from "./mergeableWait.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { mergeLandedWaitTimeout } from "./mergeLandedWait.ts";
+import { withMergePolicyLock } from "./mergePolicyLock.ts";
 import {
   freshHeadRunAction,
   headRunPresenceCount,
@@ -431,6 +432,16 @@ export interface PullRequest {
   // Operator Dismiss stamp (app/acknowledge.ts). Run-scoped: cleared on reopen so a dismissal of a
   // PRIOR run never hides an orphaning of the current one.
   acknowledged_at?: string | null;
+  // Durable merge-policy projection (132_pull_requests_merge_policy.sql, issue #947): the run's
+  // merge intent (`merge_requested` 0|1) and its decided merge-approval state
+  // (`merge_human_approval` NULL = outstanding/undecided, 0|1 once decided), stamped by the writers
+  // that already know them — `submitPr` (submit/reopen, and the gated-adopt `setVariables` branch),
+  // `completeUserTaskAttributed` (a `merge-approval` approve clears it to 0, app/agentCompletion.ts),
+  // and `startMerge` — so `/status` serves the policy from the app's own DB with ZERO engine reads.
+  // `merge_requested` NULL marks a row written before this projection existed; only those legacy
+  // rows fall back to the #937 batched engine read. Run-scoped: reset by the atomic reopen.
+  merge_requested?: number | null;
+  merge_human_approval?: number | null;
 }
 
 interface PrDependency {
@@ -742,8 +753,27 @@ async function submitPrCritical(
         (s) => String(s.processInstanceKey) === loopKey,
       );
       const state = match ? String(match.state ?? "").trim().toUpperCase() : null;
-      if (state !== null && !ENGINE_TERMINAL_STATES.has(state)) {
+      // Only the CONVERGENCE loop reads `humanApproval` (PR #950 review): mid-handoff `startMerge`
+      // has already re-pointed `process_key` at the merge-loop (and stamped its approval policy), so a
+      // key that resolves to any other definition must never be gated.
+      const isConvergenceLoop = match?.processDefinitionId == null || match.processDefinitionId === PROCESS_ID;
+      if (state !== null && !ENGINE_TERMINAL_STATES.has(state) && isConvergenceLoop) {
+        // Serialized with merge-approval completion on this loop (PR #950 review): the engine write
+        // and projection stamp form one pair, so an approval can never interleave between them.
+        await withMergePolicyLock(loopKey, async () => {
         await engine.setVariables({ scopeKey: loopKey, variables: { humanApproval: true } });
+        // Mirror the gate onto the durable /status projection (issue #947): the loop variable is
+        // the process's own copy; the row column is what `/status` reads without an engine
+        // round-trip. NULL would read as "outstanding" too, but stamping 1 keeps the projection
+        // explicit (decided-and-gated) rather than undecided.
+        // Atomic compare-and-set on the SAME owner we gated, still pre-finalization: a concurrent
+        // merge handoff (re-pointed key) or reopen between the read and this write leaves its own
+        // policy intact instead of being overwritten with a stale gate.
+        await data.open().exec(
+          `UPDATE "pull_requests" SET "merge_human_approval" = 1 WHERE "pr_key" = ? AND "process_key" = ? AND "converged_at" IS NULL`,
+          [parsed.prKey, loopKey],
+        );
+        });
       }
     }
     // Steward opt-in is monotonic too (issue #889 review): an opted-in caller adopting a live loop —
@@ -838,6 +868,12 @@ async function submitPrCritical(
       abandon_token: abandonToken,
       root_request_key: effectiveRoot,
       auto_resolve_escalations: autoResolveEscalations ? 1 : 0,
+      // Merge-policy projection (issue #947): stamp the run's intent so `/status` serves it from
+      // the row with no engine read. The approve at the `merge-approval` gate later maps to 0.
+      merge_requested: mergeIntent ? 1 : 0,
+      // Mirror the engine seed EXACTLY (PR #950 review): an ungated loop is seeded
+      // `humanApproval: false` (decided — no gate), a gated one `true` (outstanding).
+      merge_human_approval: gated ? 1 : 0,
       created_at: ts,
       updated_at: ts,
     });
@@ -935,7 +971,16 @@ async function submitPrCritical(
   let reopened = false;
   // Snapshot BEFORE the reopen write — the row object may be a live reference the update mutates.
   const prior = existing
-    ? { status: existing.status, current_round: existing.current_round, process_key: existing.process_key }
+    ? {
+        status: existing.status,
+        current_round: existing.current_round,
+        process_key: existing.process_key,
+        // Restore the merge-policy projection WITH ownership (PR #950 review): a rollback that put the
+        // old `process_key` back but kept the failed run's policy would serve a mismatched policy as
+        // authoritative (`stale: false`) in `/status`.
+        merge_requested: existing.merge_requested ?? null,
+        merge_human_approval: existing.merge_human_approval ?? null,
+      }
     : null;
   try {
     if (existing) {
@@ -993,6 +1038,10 @@ async function submitPrCritical(
         // Record the opt-in on the row (the durable source the steward's eligibility reads) so a
         // fresh run's flag is authoritative even across a reopen (issue #889).
         auto_resolve_escalations: autoResolveEscalations ? 1 : 0,
+        // Merge-policy projection (issue #947): run-scoped like every other field in this reset —
+        // the fresh run's intent wins, and the approval state mirrors the fresh loop's `humanApproval` seed.
+        merge_requested: mergeIntent ? 1 : 0,
+        merge_human_approval: gated ? 1 : 0,
         // Publish the fresh run's identity in the SAME write as the status flip (may be null if the
         // instance could not be created — a phantom row a retry re-enrolls, as on first submit).
         process_key: processKey,
@@ -1129,7 +1178,15 @@ export async function startMerge(
     },
   });
   if (processInstanceKey != null) {
-    await prs(data).update(pr.prKey, { process_key: String(processInstanceKey), updated_at: now() });
+    await prs(data).update(pr.prKey, {
+      process_key: String(processInstanceKey),
+      // Merge-policy projection (issue #947): a merge loop only starts for a requested, approved
+      // merge (`pr.finalize`'s gate), so the merge-stage policy is known here — stamp it and the
+      // merge stage of `/status` never pays an engine read either.
+      merge_requested: 1,
+      merge_human_approval: 0,
+      updated_at: now(),
+    });
   }
   return { prKey: pr.prKey, mergeProcessKey: processInstanceKey };
 }
@@ -1150,6 +1207,11 @@ export interface MergePolicy {
    * (convergence-loop.bpmn), so the blocker lifts as soon as approval is complete — even while
    * the `pr.finalize` handoff is still queued or incidented. */
   blockedBy: "env" | "human-approval" | null;
+  /** The timing-guard marker (issue #947): `true` when the policy could not be verified and the row
+   *  was served from the historical default instead of blocking the serve (a legacy row — written
+   *  before the durable projection existed — whose fallback engine read failed). Rows served from
+   *  the `pull_requests` projection always read `false`. */
+  stale: boolean;
 }
 
 /** The status `/status` reports for a run whose instance is parked on an ACTIVE engine incident
@@ -1263,18 +1325,35 @@ export async function activePrs(
   // Merge intent (issue #916): read the loop's `autoMerge` / `convergeOnly` / `humanApproval`
   // variables per PR so the effective merge policy is visible without opening the engine.
   //
-  // A CONSTANT number of batched engine reads per /status call (issue #936) — never a per-row
-  // fan-out. The pre-#936 shape issued 3 `searchVariables` round-trips PER active PR (12 calls at 4
-  // rows ≈ 13 s; concurrent callers stacked until the console proxy 502'd). See
-  // `readMergePolicyVars` for the completeness contract (single-page seam, root scope only, one
-  // per-name root probe only for a page cut or legacy instance). Best-effort: a failed batched read degrades every
-  // PR to the historical default (merge requested); a failed per-instance fallback degrades only
-  // that PR.
+  // Issue #947: the policy is served from the app's OWN projection — the `merge_requested` /
+  // `merge_human_approval` columns `submitPr`/`startMerge` stamp on the row (the writers already
+  // know the policy) — so the hot read path pays ZERO engine round-trips. The #937 batched engine
+  // read below is kept ONLY for legacy rows (`merge_requested` NULL — written before the projection
+  // existed): it is a CONSTANT 3 name-filtered reads for the whole legacy set, never a per-row
+  // fan-out, and it shrinks to the empty set as rows reopen onto the projection. See
+  // `readMergePolicyVars` for the legacy completeness contract (single-page seam, root scope only,
+  // one per-name root probe only for a page cut or legacy instance). Best-effort: a failed batched
+  // read degrades every legacy row to the historical default (merge requested, flagged `stale`); a
+  // failed per-instance fallback degrades only that row.
   const mergeByPr = new Map<string, MergePolicy>();
-  const activeKeys = active.map((p) => p.process_key).filter((k): k is string => k != null && k !== "");
-  const varsByInstance = await readMergePolicyVars(engine, activeKeys);
+  const legacyKeys: string[] = [];
+  for (const p of active) {
+    const projected = mergePolicyFromRow(p);
+    if (projected) {
+      mergeByPr.set(p.pr_key, projected);
+    } else if (p.process_key != null && p.process_key !== "") {
+      legacyKeys.push(p.process_key);
+    }
+  }
+  const varsByInstance = await readMergePolicyVars(engine, legacyKeys);
   for (const p of active) {
-    mergeByPr.set(p.pr_key, mergePolicyFromVars(varsByInstance?.get(p.process_key ?? "")));
+    if (mergeByPr.has(p.pr_key)) continue;
+    const vars = varsByInstance?.get(p.process_key ?? "");
+    mergeByPr.set(p.pr_key, mergePolicyFromVars(vars));
+    // Self-healing hydration (PR #950 review): a legacy row whose policy the engine just proved is
+    // written back onto the projection, so it pays the engine read at most ONCE — the legacy set
+    // drains on the first serves after upgrade instead of keeping every /status on the slow path.
+    await hydrateLegacyMergePolicy(data, p, vars);
   }
   return active.map((p) => {
     // Issue #931: an ACTIVE engine incident parked on the loop's instance must be VISIBLE — the row
@@ -1352,9 +1431,25 @@ function hasOwnTerminationReason(p: {
 
 /** The default merge policy when no instance variables are readable (mid-handoff row, engine
  * unreachable, or a legacy loop carrying neither variable): the pre-#916 behaviour merged by
- * default, so the projection must NOT read such a PR as review-only. */
+ * default, so the projection must NOT read such a PR as review-only. Flagged `stale` (issue #947):
+ * the policy could not be verified — the row was served from the default rather than blocking. */
 function mergePolicyDefault(): MergePolicy {
-  return mergePolicyFrom(true, false);
+  return { ...mergePolicyFrom(true, false), stale: true };
+}
+
+/** Derive a PR's effective merge policy from its DURABLE row projection (issue #947) — the
+ *  `merge_requested` / `merge_human_approval` columns `submitPr`/`startMerge` stamp. Returns
+ *  `undefined` for a legacy row (`merge_requested` NULL — written before the projection existed),
+ *  which the caller falls back to the #937 batched engine read. `merge_human_approval` NULL means
+ *  the approval is outstanding/undecided (the gate still holds); 0|1 is the decided state the
+ *  `merge-approval` task's `humanApproval` variable write mirrors. A projected policy is always
+ *  fresh (`stale: false`) — it never blocks the serve on an engine round-trip. */
+function mergePolicyFromRow(p: {
+  merge_requested?: number | null;
+  merge_human_approval?: number | null;
+}): MergePolicy | undefined {
+  if (p.merge_requested == null) return undefined;
+  return { ...mergePolicyFrom(p.merge_requested === 1, p.merge_human_approval !== 0), stale: false };
 }
 
 /** Combine a merge intent + human-approval gate with the global switch into the effective policy.
@@ -1362,7 +1457,7 @@ function mergePolicyDefault(): MergePolicy {
  *  and the `merge-approval` user task clears it on an explicit "approve", so an approved PR whose
  *  finalization is still queued/incidented reads `effective` with no blocker rather than a stale
  *  `blockedBy: "human-approval"`. */
-function mergePolicyFrom(requested: boolean, humanApproval: boolean): MergePolicy {
+function mergePolicyFrom(requested: boolean, humanApproval: boolean): Omit<MergePolicy, "stale"> {
   const enabled = AUTO_MERGE;
   const effective = requested && enabled && !humanApproval;
   const blockedBy = !requested ? null : !enabled ? "env" : humanApproval ? "human-approval" : null;
@@ -1376,6 +1471,9 @@ type MergePolicyVars = {
   autoMerge: boolean | undefined;
   convergeOnly: boolean | undefined;
   humanApproval: boolean | undefined;
+  /** True once every policy name for this instance was either seen or proven absent by an
+   *  untruncatable root probe — absence of a name is then real, not a page cut. */
+  proven?: boolean;
 };
 
 function emptyMergePolicyVars(): MergePolicyVars {
@@ -1398,6 +1496,46 @@ function isMergePolicyName(name: string): name is MergePolicyName {
   return MERGE_POLICY_NAMES.some((n) => n === name);
 }
 
+/** Write a legacy row's engine-proven merge policy back onto its `pull_requests` projection (PR #950
+ *  review). Only a COMPLETE read is persisted — a known intent (`autoMerge`, or the legacy inverted
+ *  `convergeOnly`) AND a known `humanApproval` — so a guess is never made authoritative. The UPDATE is
+ *  guarded on the row still being unstamped AND still owned by the instance read, so a concurrent
+ *  submit/reopen stamp always wins. Best-effort: a failed write just leaves the row legacy. */
+async function hydrateLegacyMergePolicy(
+  data: DataLayer,
+  row: { pr_key: string; process_key?: string | null },
+  vars: MergePolicyVars | undefined,
+): Promise<void> {
+  if (!vars || !row.process_key) return;
+  // A legacy loop that predates `humanApproval` legitimately lacks it; once a COMPLETE read proved
+  // that absence it reads as "no outstanding approval", so the row can leave the probe queue
+  // instead of starving later legacy rows (PR #950 review).
+  const humanApproval = vars.humanApproval ?? (vars.proven ? false : undefined);
+  if (humanApproval === undefined) return;
+  const requested = vars.autoMerge ?? (vars.convergeOnly === undefined ? undefined : !vars.convergeOnly);
+  if (requested === undefined) return;
+  try {
+    // `COALESCE` preserves an approval stamp written concurrently (approval / gated adoption leave
+    // `merge_requested` NULL), so a hydration that read the engine BEFORE that decision can never
+    // overwrite it with the older value (PR #950 review).
+    await data.open().exec(
+      `UPDATE "pull_requests" SET "merge_requested" = ?, "merge_human_approval" = COALESCE("merge_human_approval", ?) WHERE "pr_key" = ? AND "process_key" = ? AND "merge_requested" IS NULL`,
+      [requested ? 1 : 0, humanApproval ? 1 : 0, row.pr_key, row.process_key],
+    );
+  } catch {
+    // swallow — hydration is an optimisation; the row simply stays on the legacy read
+  }
+}
+
+/** Upper bound on legacy instances that may pay per-instance root probes in ONE /status serve (PR
+ *  #950 review). Beyond it, an instance missing from the batched pages degrades to the stale default
+ *  for this serve (and is hydrated on a later one), so request-time engine calls stay bounded at
+ *  `3 + 3 * MAX_PROBED_LEGACY_INSTANCES` regardless of how many legacy PRs exist. */
+export const MAX_PROBED_LEGACY_INSTANCES = 4;
+
+/** Rotating start offset into the legacy probe queue (see {@link readMergePolicyVars}). */
+let legacyProbeCursor = 0;
+
 /** Batched merge-policy read (issue #936): ONE name-filtered engine-wide read per policy variable
  *  (3 concurrent calls, independent of row count), bucketed by owning instance.
  *
@@ -1452,15 +1590,27 @@ async function readMergePolicyVars(
     // `convergeOnly` is skipped once a usable boolean `autoMerge` is known (the canonical intent wins). Every loop
     // seeds all three names at creation (submitPr; startMerge seeds the merge loop's policy too), so
     // the steady state is exactly 3 calls; probes are only paid for page cuts and legacy instances.
+    const needsProbe = (pk: string) =>
+      MERGE_POLICY_NAMES.filter(
+        (name) => !seen.get(pk)?.has(name) && !(name === "convergeOnly" && byInstance.get(pk)?.autoMerge !== undefined),
+      );
+    // Bound the request-time fallback (PR #950 review): only the first MAX_PROBED_LEGACY_INSTANCES
+    // instances (callers pass them most-recently-updated first) are probed; the rest degrade fully to
+    // the stale default for this serve — never a half-read policy.
+    for (const pk of wanted) {
+      const vars = byInstance.get(pk);
+      if (vars && needsProbe(pk).length === 0) vars.proven = true;
+    }
+    const probing = [...wanted].filter((pk) => needsProbe(pk).length > 0);
+    // Rotate the probe window across serves (PR #950 review) so a leading row that can never be
+    // hydrated cannot permanently starve the rows behind it.
+    const offset = probing.length > 0 ? legacyProbeCursor % probing.length : 0;
+    const rotated = [...probing.slice(offset), ...probing.slice(0, offset)];
+    legacyProbeCursor += MAX_PROBED_LEGACY_INSTANCES;
+    for (const pk of rotated.slice(MAX_PROBED_LEGACY_INSTANCES)) byInstance.delete(pk);
     await Promise.all(
-      [...wanted].map(async (pk) => {
-        const got = seen.get(pk);
-        const probe = MERGE_POLICY_NAMES.filter(
-          (name) =>
-            !got?.has(name) &&
-            !(name === "convergeOnly" && byInstance.get(pk)?.autoMerge !== undefined),
-        );
-        if (probe.length === 0) return;
+      rotated.slice(0, MAX_PROBED_LEGACY_INSTANCES).map(async (pk) => {
+        const probe = needsProbe(pk);
         try {
           // Collect ALL probe results first and record only once every probe succeeded: recording
           // inside each probe would let a slower successful sibling re-create the entry the catch
@@ -1473,6 +1623,9 @@ async function readMergePolicyVars(
             ),
           );
           for (const rows of results) for (const row of rows) record(row);
+          const vars = byInstance.get(pk) ?? emptyMergePolicyVars();
+          vars.proven = true;
+          byInstance.set(pk, vars);
         } catch {
           // Degrade ONLY this instance — and fully: drop any partial entry the batch recorded so
           // the caller projects the default for it, never a half-read policy.
@@ -1490,11 +1643,14 @@ async function readMergePolicyVars(
  * canonical positive `autoMerge` wins; the legacy inverted `convergeOnly` is the fallback for
  * in-flight loops seeded before `autoMerge` existed; an instance carrying neither (or absent from
  * the batch — mid-handoff row, instance gone) degrades to the historical default (merge
- * requested) rather than failing the status read. */
+ * requested, flagged `stale`) rather than failing the status read. */
 function mergePolicyFromVars(vars: MergePolicyVars | undefined): MergePolicy {
   if (!vars) return mergePolicyDefault();
+  if (vars.autoMerge === undefined && vars.convergeOnly === undefined && vars.humanApproval === undefined) {
+    return mergePolicyDefault();
+  }
   const requested = vars.autoMerge ?? (vars.convergeOnly === undefined ? true : !vars.convergeOnly);
-  return mergePolicyFrom(requested, vars.humanApproval === true);
+  return { ...mergePolicyFrom(requested, vars.humanApproval === true), stale: false };
 }
 
 /** A delivery-graph run currently in flight, as reported by the status endpoint (issue #889 §1 —

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.208.4",
-  "gitSha": "097724344a2f3942af5b1796e2e0a7e8363b44f9",
-  "gitTag": "v0.208.4",
-  "builtAt": "2026-11-11T03:16:35.107Z"
+  "version": "0.209.0",
+  "gitSha": "21622b4529383c575de7ffcf77548a704353c4d4",
+  "gitTag": "v0.209.0",
+  "builtAt": "2026-11-12T05:08:52.210Z"
 }

package/db/migrations/132_pull_requests_merge_policy.sql

@@ -0,0 +1,22 @@
+-- Durable merge-policy projection for /status (issue #947). `/app/api/status` regressed to ~30 s
+-- (502 behind the console proxy) on merlin with only 9 PRs: the #937 batching left the merge-policy
+-- read at 3 engine-wide `searchVariables` pages plus a per-(instance, name) probe for any name cut
+-- from its (single, truncating) page — and on a loaded host each engine read costs ~1 s, so the
+-- serve was O(PRs x reads). The fix for the CLASS is to serve the hot read path from the app's own
+-- projection: the writers that already KNOW the policy stamp it on the row —
+--
+--   * `submitPr`  stamps `merge_requested` (the run's merge intent) at submit/reopen and
+--                 `merge_human_approval = 1` when a gated adopt narrows a live loop;
+--   * `completeUserTaskAttributed` (app/agentCompletion.ts) stamps `merge_human_approval = 0` when a
+--                 human APPROVES at the `merge-approval` task (mirroring the task's `humanApproval`
+--                 output mapping), so /status lifts the blocker the moment approval lands;
+--   * `startMerge` stamps `merge_requested = 1, merge_human_approval = 0` (a merge loop only starts
+--                 for a requested, approved merge).
+--
+-- `merge_requested` is NULL on every pre-#947 row: those legacy rows keep the #937 batched engine
+-- read (constant, never per-row) until they next reopen. `merge_human_approval` is NULL while an
+-- approval is outstanding and 0/1 once decided — mirroring the loop's `humanApproval` variable,
+-- which the `merge-approval` user task clears to `false` on an explicit approve. Both columns are
+-- run-scoped: `submitPr`'s atomic reopen resets them to the fresh run's intent.
+ALTER TABLE pull_requests ADD COLUMN merge_requested INTEGER;
+ALTER TABLE pull_requests ADD COLUMN merge_human_approval INTEGER;

package/db/migrations/133_pull_requests_read_model_merge_policy.sql

@@ -0,0 +1,51 @@
+-- Re-create the `pull_requests_read_model` VIEW so it re-exports the new base columns (the VIEW must pass
+-- through EVERY base `pull_requests` column — app/pullRequestReadModel.test.ts DRIFT GUARD). A mechanical
+-- re-emission of 131 with `merge_requested` / `merge_human_approval` (132, issue #947) added; the derived
+-- columns are emitted VERBATIM from app/pullRequestReadModel.ts and are unchanged. No BEGIN/COMMIT (the
+-- runner wraps each file). Numbered after 132.
+
+DROP VIEW IF EXISTS pull_requests_read_model;
+
+CREATE VIEW pull_requests_read_model AS
+SELECT
+  pr.pr_key AS pr_key,
+  pr.repo AS repo,
+  pr.number AS number,
+  pr.url AS url,
+  pr.title AS title,
+  COALESCE(pr.derived_status, pr.status) AS status,
+  pr.current_round AS current_round,
+  pr.process_key AS process_key,
+  pr.waiting_since AS waiting_since,
+  pr.last_review_id AS last_review_id,
+  pr.outcome AS outcome,
+  pr.created_at AS created_at,
+  pr.updated_at AS updated_at,
+  pr.converged_at AS converged_at,
+  pr.merged_at AS merged_at,
+  pr.active_worker AS active_worker,
+  pr.lease_until AS lease_until,
+  pr.last_nudge_at AS last_nudge_at,
+  pr.fresh_head_run_head AS fresh_head_run_head,
+  pr.abandon_token AS abandon_token,
+  pr.incident_key AS incident_key,
+  pr.incident_type AS incident_type,
+  pr.incident_since AS incident_since,
+  pr.incident_message AS incident_message,
+  pr.last_round_head AS last_round_head,
+  pr.last_progress_job_key AS last_progress_job_key,
+  pr.last_progress_result AS last_progress_result,
+  pr.last_progress_agent_watermark AS last_progress_agent_watermark,
+  pr.churn_escalated_round AS churn_escalated_round,
+  pr.root_request_key AS root_request_key,
+  pr.epic_phase_label AS epic_phase_label,
+  pr.acknowledged_at AS acknowledged_at,
+  pr.auto_resolve_escalations AS auto_resolve_escalations,
+  pr.termination_reason AS termination_reason,
+  pr.termination_process_key AS termination_process_key,
+  pr.retire_pending_key AS retire_pending_key,
+  pr.merge_requested AS merge_requested,
+  pr.merge_human_approval AS merge_human_approval,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND (NOT COALESCE(COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open
+FROM pull_requests__tracking pr;